[Webkit-unassigned] [Bug 188899] New: Function evaluation with special characters as params

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=188899

            Bug ID: 188899
           Summary: Function evaluation with special characters as params
           Product: WebKit
           Version: Safari 11
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: isol2 at cin.ufpe.br

Hi everyone,
I found this inconsistency in JSC when it try to parsing the HTML comment block as param, but I don't know if this behavior is expected by others engines. 
This param was generated by a fuzzer.

Version: 235121
OS: Ubuntu 16.04 x64

Steps to reproduce:
let a = Function("<!--", "print(1+1)")
a()
let b = Function("<!--", "<!--", "print(1+1)")
b()

Actual result: 
SyntaxError: Unexpected token '}'. Expected a parameter pattern or a ')' in parameter list.

Expected result:
2
2

V8, Chakra and SpiderMonkey works as expected.

cinfuzz

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180823/15bb8176/attachment.html>