fune/parser/htmlparser/tests/mochitest/file_xml_parse_error.js at d07f44685401a759440ed901b981bb1d46740a25 - nagai/fune - Nagai Git

nagai/fune

forked from mirrors/gecko-dev

Peter Van der Beken 4641d9bef3 Bug 1751796 - XML parsererror eats two first letters. r=bholley

We were calling XML_GetCurrentColumnNumber after ParseBuffer caused Expat
to consume some data. XML_GetCurrentColumnNumber uses the buffer that was
last passed to Expat. Before Expat was put in an RLBox sandbox the caller
of ParseBuffer would keep the data in the scanner string until after the
call to XML_GetCurrentColumnNumber. Now that we copy the data into the
RLBox sandbox the data is freed when the TransferBuffer in ParseBuffer
goes out of scope, so in the caller of ParseBuffer the call to
XML_GetCurrentColumnNumber would cause us to read freed memory inside the
sandbox. Moving the call to XML_GetCurrentColumnNumber to inside
ParseBuffer, when TransferBuffer is still in scope, solves the issue.

Differential Revision: https://phabricator.services.mozilla.com/D141795

2022-04-05 14:10:11 +00:00

1 line

35 B

JavaScript

Raw Blame History

parent.ok(true, "Loaded script.");