Fix compliance bug in decodeURI/decodeURIComponent.

src/uri.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 187 matching lines @@
       if (k + 2 >= uriLength) throw new $URIError("URI malformed");
       var cc = URIHexCharsToCharCode(uri.charAt(++k), uri.charAt(++k));
       if (cc >> 7) {
         var n = 0;
         while (((cc << ++n) & 0x80) != 0) ;
         if (n == 1 || n > 4) throw new $URIError("URI malformed");
         var octets = new $Array(n);
         octets[0] = cc;
         if (k + 3 * (n - 1) >= uriLength) throw new $URIError("URI malformed");
         for (var i = 1; i < n; i++) {
-          k++;
+          if (uri.charAt(++k) != '%') throw new $URIError("URI malformed");
           octets[i] = URIHexCharsToCharCode(uri.charAt(++k), uri.charAt(++k));
         }
         index = URIDecodeOctets(octets, result, index);
       } else {
         if (reserved(cc)) {
           result[index++] = 37; // Char code of '%'.
           result[index++] = uri.charCodeAt(k - 1);
           result[index++] = uri.charCodeAt(k);
         } else {
           result[index++] = cc;
@@ skipping 186 matching lines @@
     "escape", URIEscape,
     "unescape", URIUnescape,
     "decodeURI", URIDecode,
     "decodeURIComponent", URIDecodeComponent,
     "encodeURI", URIEncode,
     "encodeURIComponent", URIEncodeComponent
   ));
 }
 
 SetupURI();
-