JavaScriptCore:

        Reviewed by Adele Peterson.

        <rdar://problem/4589530> REGRESSION: null character in JS string causes parse error (works in Tiger and in other browsers)

        * kjs/lexer.cpp:
        (Lexer::shift):
        (Lexer::lex):
        (Lexer::record16):
        (Lexer::scanRegExp):
        * kjs/lexer.h:

LayoutTests:

        Reviewed by Adele Peterson.

        Test case for:

        <rdar://problem/4620646> REGRESSION(10.4.7-10.5): can't type into editing region when creating or editing a blogger.com post

        * fast/js/null-char-in-string-expected.txt: Added.
        * fast/js/null-char-in-string.html: Added.
        * fast/js/resources/null-char-in-string.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15522 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index a0380a88619ed1ec6b2d9175a493eebfc94b191f..17704b05ac854c6781814d0e5d04c0e35a86665f 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2006-07-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adele Peterson.
+        
+        <rdar://problem/4589530> REGRESSION: null character in JS string causes parse error (works in Tiger and in other browsers)
+
+        * kjs/lexer.cpp:
+        (Lexer::shift):
+        (Lexer::lex):
+        (Lexer::record16):
+        (Lexer::scanRegExp):
+        * kjs/lexer.h:
+
 2006-07-18  Tim Omernick  <timo@apple.com>
 
         Reviewed by Tim Hatcher.

diff --git a/JavaScriptCore/kjs/lexer.cpp b/JavaScriptCore/kjs/lexer.cpp
index 62b9cf679ca28f4dad2a59122a51984296a57966..8c894282158a684caffb25ed0bfc44e2f8799c8f 100644 (file)
--- a/JavaScriptCore/kjs/lexer.cpp
+++ b/JavaScriptCore/kjs/lexer.cpp
@@ -125,7 +125,7 @@ void Lexer::shift(unsigned int p)
     next2 = next3;
     do {
       if (pos >= length) {
-        next3 = 0;
+        next3 = -1;
         break;
       }
       next3 = code[pos++].uc;
@@ -188,7 +188,7 @@ int Lexer::lex()
       } else if (current == '/' && next1 == '*') {
         shift(1);
         state = InMultiLineComment;
-      } else if (current == 0) {
+      } else if (current == -1) {
         if (!terminator && !delimited) {
           // automatic semicolon insertion if program incomplete
           token = ';';
@@ -245,7 +245,7 @@ int Lexer::lex()
       if (current == stringType) {
         shift(1);
         setDone(String);
-      } else if (current == 0 || isLineTerminator()) {
+      } else if (isLineTerminator() || current == -1) {
         setDone(Bad);
       } else if (current == '\\') {
         state = InEscapeSequence;
@@ -320,12 +320,12 @@ int Lexer::lex()
           setDone(Other);
         } else
           state = Start;
-      } else if (current == 0) {
+      } else if (current == -1) {
         setDone(Eof);
       }
       break;
     case InMultiLineComment:
-      if (current == 0) {
+      if (current == -1) {
         setDone(Bad);
       } else if (isLineTerminator()) {
         nextLine();
@@ -804,6 +804,13 @@ void Lexer::record8(unsigned short c)
   buffer8[pos8++] = (char) c;
 }
 
+void Lexer::record16(int c)
+{
+  ASSERT(c >= 0);
+  ASSERT(c <= USHRT_MAX);
+  record16(UChar(static_cast<unsigned short>(c)));
+}
+
 void Lexer::record16(KJS::UChar c)
 {
   // enlarge buffer if full
@@ -825,7 +832,7 @@ bool Lexer::scanRegExp()
   bool inBrackets = false;
 
   while (1) {
-    if (isLineTerminator() || current == 0)
+    if (isLineTerminator() || current == -1)
       return false;
     else if (current != '/' || lastWasEscape == true || inBrackets == true)
     {

diff --git a/JavaScriptCore/kjs/lexer.h b/JavaScriptCore/kjs/lexer.h
index d8a9e378e25c24aabdae7a725d22c4268a682912..f9aec1d5a26986d01f1e32c5d83b910c020f48e5 100644 (file)
--- a/JavaScriptCore/kjs/lexer.h
+++ b/JavaScriptCore/kjs/lexer.h
@@ -133,6 +133,7 @@ namespace KJS {
   private:
 
     void record8(unsigned short c);
+    void record16(int c);
     void record16(UChar c);
 
     KJS::Identifier *makeIdentifier(UChar *buffer, unsigned int pos);
@@ -146,8 +147,8 @@ namespace KJS {
 #endif
     bool error;
 
-    // current and following unicode characters
-    unsigned short current, next1, next2, next3;
+    // current and following unicode characters (int to allow for -1 for end-of-file marker)
+    int current, next1, next2, next3;
 
     UString **strings;
     unsigned int numStrings;

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 936e8f888637523560759c3dde0c65c54cf638d7..31a039c21f9fa03a4145f35a0b85ddfa5f9dfdf4 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2006-07-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adele Peterson.
+        
+        Test case for:
+        
+        <rdar://problem/4620646> REGRESSION(10.4.7-10.5): can't type into editing region when creating or editing a blogger.com post
+
+        * fast/js/null-char-in-string-expected.txt: Added.
+        * fast/js/null-char-in-string.html: Added.
+        * fast/js/resources/null-char-in-string.js: Added.
+
 2006-07-18  Anders Carlsson  <acarlsson@apple.com>
 
         Reviewed by Darin.

diff --git a/LayoutTests/fast/js/null-char-in-string-expected.txt b/LayoutTests/fast/js/null-char-in-string-expected.txt
new file mode 100644 (file)
index 0000000..e7cf546
--- /dev/null
+++ b/LayoutTests/fast/js/null-char-in-string-expected.txt
@@ -0,0 +1,6 @@
+This test checks that null characters are allowed in JavaScript strings, rather than causing a parse error.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS String("

diff --git a/LayoutTests/fast/js/null-char-in-string.html b/LayoutTests/fast/js/null-char-in-string.html
new file mode 100644 (file)
index 0000000..e043525
--- /dev/null
+++ b/LayoutTests/fast/js/null-char-in-string.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="resources/null-char-in-string.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>

diff --git a/LayoutTests/fast/js/resources/null-char-in-string.js b/LayoutTests/fast/js/resources/null-char-in-string.js
new file mode 100644 (file)
index 0000000..da088bd
Binary files /dev/null and b/LayoutTests/fast/js/resources/null-char-in-string.js differ