AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[scanner] Fix scanner stream creation: Sliced strings can have an underlying thin string.

Browse Source 
Bug: chromium:862538
Change-Id: I13a6886f78ee88ca7c69feb0abda6b149a1e423e
Reviewed-on: https://chromium-review.googlesource.com/1133980
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54397}
This commit is contained in:
Toon Verwaest 2018-07-11 22:38:34 +02:00 committed by Commit Bot
parent eb98d5c5c6
commit ae044d697f
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/parsing/scanner-character-streams.cc
View File

@ -564,9 +564,11 @@ Utf16CharacterStream* ScannerStream::For(Isolate* isolate, Handle<String> data,
if (data->IsSlicedString()) {
SlicedString* string = SlicedString::cast(*data);
start_offset = string->offset();
data = handle(string->parent(), string->GetIsolate());
String* parent = string->parent();
if (parent->IsThinString()) parent = ThinString::cast(parent)->actual();
data = handle(parent, isolate);
} else {
data = String::Flatten(data->GetIsolate(), data);
data = String::Flatten(isolate, data);
}
if (data->IsExternalOneByteString()) {
return new BufferedCharacterStream<uint8_t, ExternalStringStream>(

13
test/mjsunit/regress/regress-crbug-862538.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var uvwxyzundefined;
function __f_5778(__v_29973) {
var __v_29975 = __v_29973 + undefined;
var __v_29976 = __v_29975.substring( 20);
({})[__v_29975];
return eval(__v_29976);
}
__f_5778("abcdefghijklmnopqrstuvwxyz");