Fix free-after-free bug in ExternalStreamingStream::ResetToBookmark.

src/scanner-character-streams.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/scanner-character-streams.h"
 
 #include "include/v8.h"
 #include "src/handles.h"
@@ skipping 416 matching lines @@
   return source_stream_->SetBookmark();
 }
 
 
 void ExternalStreamingStream::ResetToBookmark() {
   source_stream_->ResetToBookmark();
   FlushCurrent();
 
   pos_ = bookmark_;
 
-  // current_data_ can point to bookmark_data_'s buffer.
-  current_data_ = bookmark_data_.start();
+  // bookmark_data_* => current_data_*
+  // (current_data_ assumes ownership of its memory.)
+  uint8_t* data = new uint8_t[bookmark_data_.length()];
   current_data_offset_ = 0;
   current_data_length_ = bookmark_data_.length();
+  CopyCharsUnsigned(data, bookmark_data_.begin(), bookmark_data_.length());
+  delete[] current_data_;
+  current_data_ = data;
 
   // bookmark_buffer_ needs to be copied to buffer_.
   CopyCharsUnsigned(buffer_, bookmark_buffer_.begin(),
                     bookmark_buffer_.length());
   buffer_cursor_ = buffer_;
   buffer_end_ = buffer_ + bookmark_buffer_.length();
 
   // utf8 split char buffer
   utf8_split_char_buffer_length_ = bookmark_utf8_split_char_buffer_length_;
   for (size_t i = 0; i < bookmark_utf8_split_char_buffer_length_; i++) {
@@ skipping 98 matching lines @@
   return true;
 }
 
 
 void ExternalTwoByteStringUtf16CharacterStream::ResetToBookmark() {
   DCHECK(bookmark_ != kNoBookmark);
   pos_ = bookmark_;
   buffer_cursor_ = raw_data_ + bookmark_;
 }
 } }  // namespace v8::internal