From f243b987af6776170b4ba1da1637c0a56fb75c6b Mon Sep 17 00:00:00 2001
From: Jake Bailey <5341706+jakebailey@users.noreply.github.com>
Date: Wed, 5 Apr 2023 13:47:02 -0700
Subject: [PATCH] Fix crash in parseJsxChild found by fuzzing (#53674)

---
 src/compiler/parser.ts                         |  2 +-
 ...ElementInUnaryExpressionNoCrash3.errors.txt | 18 ++++++++++++++++++
 ...parseJsxElementInUnaryExpressionNoCrash3.js |  9 +++++++++
 ...JsxElementInUnaryExpressionNoCrash3.symbols |  5 +++++
 ...seJsxElementInUnaryExpressionNoCrash3.types | 10 ++++++++++
 ...parseJsxElementInUnaryExpressionNoCrash3.ts |  5 +++++
 6 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.errors.txt
 create mode 100644 tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.js
 create mode 100644 tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.symbols
 create mode 100644 tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.types
 create mode 100644 tests/cases/compiler/parseJsxElementInUnaryExpressionNoCrash3.ts

diff --git a/src/compiler/parser.ts b/src/compiler/parser.ts
index a1f711f43ad..e6912998b16 100644
--- a/src/compiler/parser.ts
+++ b/src/compiler/parser.ts
@@ -6013,7 +6013,7 @@ namespace Parser {
                     // We want the error span to cover only 'Foo.Bar' in < Foo.Bar >
                     // or to cover only 'Foo' in < Foo >
                     const tag = openingTag.tagName;
-                    const start = skipTrivia(sourceText, tag.pos);
+                    const start = Math.min(skipTrivia(sourceText, tag.pos), tag.end);
                     parseErrorAt(start, tag.end, Diagnostics.JSX_element_0_has_no_corresponding_closing_tag, getTextOfNodeFromSourceText(sourceText, openingTag.tagName));
                 }
                 return undefined;
diff --git a/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.errors.txt b/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.errors.txt
new file mode 100644
index 00000000000..640a20cc6f4
--- /dev/null
+++ b/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.errors.txt
@@ -0,0 +1,18 @@
+tests/cases/compiler/a.js(1,3): error TS17008: JSX element '' has no corresponding closing tag.
+tests/cases/compiler/a.js(1,4): error TS1003: Identifier expected.
+tests/cases/compiler/a.js(1,5): error TS1005: '...' expected.
+tests/cases/compiler/a.js(3,1): error TS1005: '</' expected.
+
+
+==== tests/cases/compiler/a.js (4 errors) ====
+    !< {:>
+      
+!!! error TS17008: JSX element '' has no corresponding closing tag.
+       ~
+!!! error TS1003: Identifier expected.
+        ~
+!!! error TS1005: '...' expected.
+    
+    
+    
+!!! error TS1005: '</' expected.
\ No newline at end of file
diff --git a/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.js b/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.js
new file mode 100644
index 00000000000..ff1e00e879a
--- /dev/null
+++ b/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.js
@@ -0,0 +1,9 @@
+//// [a.js]
+!< {:>
+
+
+
+//// [a.js]
+!< {...}>
+
+</>;
diff --git a/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.symbols b/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.symbols
new file mode 100644
index 00000000000..9ad03d63ec3
--- /dev/null
+++ b/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.symbols
@@ -0,0 +1,5 @@
+=== tests/cases/compiler/a.js ===
+
+!< {:>
+
+
diff --git a/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.types b/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.types
new file mode 100644
index 00000000000..60cd86bd73b
--- /dev/null
+++ b/tests/baselines/reference/parseJsxElementInUnaryExpressionNoCrash3.types
@@ -0,0 +1,10 @@
+=== tests/cases/compiler/a.js ===
+!< {:>
+>!< {:> : boolean
+>< {:> : any
+> : any
+> : any
+
+
+> : any
+
diff --git a/tests/cases/compiler/parseJsxElementInUnaryExpressionNoCrash3.ts b/tests/cases/compiler/parseJsxElementInUnaryExpressionNoCrash3.ts
new file mode 100644
index 00000000000..82316d06077
--- /dev/null
+++ b/tests/cases/compiler/parseJsxElementInUnaryExpressionNoCrash3.ts
@@ -0,0 +1,5 @@
+// @allowJs: true
+// @outDir: ./out
+// @filename: a.js
+!< {:>
+