Update //base to chromium 9659b08ea5a34f889dc4166217f438095ddc10d2

base/json/json_parser.cc

Index: base/json/json_parser.cc
diff --git a/base/json/json_parser.cc b/base/json/json_parser.cc
index 4d79be36194ba343925746edcb93a3bc7f42fa66..fc972cec0d3220b83074eabfef840ef65026ca47 100644
--- a/base/json/json_parser.cc
+++ b/base/json/json_parser.cc
@@ -31,7 +31,7 @@ const int32 kExtendedASCIIStart = 0x80;
 // optimization avoids about 2/3rds of string memory copies. The constructor
 // takes ownership of the input string. The real root value is Swap()ed into
 // the new instance.
-class DictionaryHiddenRootValue : public base::DictionaryValue {
+class DictionaryHiddenRootValue : public DictionaryValue {
  public:
   DictionaryHiddenRootValue(std::string* json, Value* root) : json_(json) {
     DCHECK(root->IsType(Value::TYPE_DICTIONARY));
@@ -43,7 +43,7 @@ class DictionaryHiddenRootValue : public base::DictionaryValue {
 
     // First deep copy to convert JSONStringValue to std::string and swap that
     // copy with |other|, which contains the new contents of |this|.
-    scoped_ptr<base::DictionaryValue> copy(DeepCopy());
+    scoped_ptr<DictionaryValue> copy(DeepCopy());
     copy->Swap(other);
 
     // Then erase the contents of the current dictionary and swap in the
@@ -81,7 +81,7 @@ class DictionaryHiddenRootValue : public base::DictionaryValue {
   DISALLOW_COPY_AND_ASSIGN(DictionaryHiddenRootValue);
 };
 
-class ListHiddenRootValue : public base::ListValue {
+class ListHiddenRootValue : public ListValue {
  public:
   ListHiddenRootValue(std::string* json, Value* root) : json_(json) {
     DCHECK(root->IsType(Value::TYPE_LIST));
@@ -93,7 +93,7 @@ class ListHiddenRootValue : public base::ListValue {
 
     // First deep copy to convert JSONStringValue to std::string and swap that
     // copy with |other|, which contains the new contents of |this|.
-    scoped_ptr<base::ListValue> copy(DeepCopy());
+    scoped_ptr<ListValue> copy(DeepCopy());
     copy->Swap(other);
 
     // Then erase the contents of the current list and swap in the new contents,
@@ -130,14 +130,12 @@ class ListHiddenRootValue : public base::ListValue {
 // A variant on StringValue that uses StringPiece instead of copying the string
 // into the Value. This can only be stored in a child of hidden root (above),
 // otherwise the referenced string will not be guaranteed to outlive it.
-class JSONStringValue : public base::Value {
+class JSONStringValue : public Value {
  public:
-  explicit JSONStringValue(const base::StringPiece& piece)
-      : Value(TYPE_STRING),
-        string_piece_(piece) {
-  }
+  explicit JSONStringValue(const StringPiece& piece)
+      : Value(TYPE_STRING), string_piece_(piece) {}
 
-  // Overridden from base::Value:
+  // Overridden from Value:
   bool GetAsString(std::string* out_value) const override {
     string_piece_.CopyToString(out_value);
     return true;
@@ -157,7 +155,7 @@ class JSONStringValue : public base::Value {
 
  private:
   // The location in the original input stream.
-  base::StringPiece string_piece_;
+  StringPiece string_piece_;
 
   DISALLOW_COPY_AND_ASSIGN(JSONStringValue);
 };
@@ -776,11 +774,17 @@ bool JSONParser::DecodeUTF16(std::string* dest_string) {
 
     uint32 code_point = CBU16_GET_SUPPLEMENTARY(code_unit16_high,
                                                 code_unit16_low);
+    if (!IsValidCharacter(code_point))
+      return false;
+
     offset = 0;
     CBU8_APPEND_UNSAFE(code_unit8, offset, code_point);
   } else {
     // Not a surrogate.
     DCHECK(CBU16_IS_SINGLE(code_unit16_high));
+    if (!IsValidCharacter(code_unit16_high))
+      return false;
+
     CBU8_APPEND_UNSAFE(code_unit8, offset, code_unit16_high);
   }
 
@@ -789,6 +793,8 @@ bool JSONParser::DecodeUTF16(std::string* dest_string) {
 }
 
 void JSONParser::DecodeUTF8(const int32& point, StringBuilder* dest) {
+  DCHECK(IsValidCharacter(point));
+
   // Anything outside of the basic ASCII plane will need to be decoded from
   // int32 to a multi-byte sequence.
   if (point < kExtendedASCIIStart) {
@@ -872,7 +878,7 @@ Value* JSONParser::ConsumeNumber() {
     return new FundamentalValue(num_int);
 
   double num_double;
-  if (base::StringToDouble(num_string.as_string(), &num_double) &&
+  if (StringToDouble(num_string.as_string(), &num_double) &&
       std::isfinite(num_double)) {
     return new FundamentalValue(num_double);
   }