From 8a4d70aef9f9c2b2b3cdaec2d026b81ed06529da Mon Sep 17 00:00:00 2001
From: mooncitydev <hellomooncity@gmail.com>
Date: Tue, 28 Apr 2026 19:18:13 +0900
Subject: [PATCH] fix: load benchmark data with json parse instead of eval

Made-with: Cursor
---
 bench/index.html | 91 ++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 80 insertions(+), 11 deletions(-)

diff --git a/bench/index.html b/bench/index.html
index ed32187ec..45bd2b062 100644
--- a/bench/index.html
+++ b/bench/index.html
@@ -474,6 +474,79 @@
         });
       }
 
+      /**
+       * Parses bench/*/data.js without eval. Expected shape is
+       * window.BENCHMARK_DATA = <JSON object> (github-action-benchmark output).
+       * Uses brace depth with JSON string awareness so commit messages with { } do not break parsing.
+       */
+      function parseBenchmarkDataJs(scriptText) {
+        const prefix = /^\s*window\.BENCHMARK_DATA\s*=\s*/;
+        const m = scriptText.match(prefix);
+        if (!m) {
+          throw new Error("unexpected data.js format (expected window.BENCHMARK_DATA assignment)");
+        }
+        let i = m[0].length;
+        while (i < scriptText.length && /\s/.test(scriptText[i])) {
+          i++;
+        }
+        if (scriptText[i] !== "{") {
+          throw new Error("unexpected data.js format (expected JSON object)");
+        }
+        let depth = 0;
+        let inString = false;
+        let escape = false;
+        const start = i;
+        for (; i < scriptText.length; i++) {
+          const c = scriptText[i];
+          if (inString) {
+            if (escape) {
+              escape = false;
+              continue;
+            }
+            if (c === "\\") {
+              escape = true;
+              continue;
+            }
+            if (c === '"') {
+              inString = false;
+            }
+            continue;
+          }
+          if (c === '"') {
+            inString = true;
+            continue;
+          }
+          if (c === "{") {
+            depth++;
+          } else if (c === "}") {
+            depth--;
+            if (depth === 0) {
+              return JSON.parse(scriptText.slice(start, i + 1));
+            }
+          }
+        }
+        throw new Error("invalid benchmark data (unclosed JSON object)");
+      }
+
+      function showLoadError(branch, commit) {
+        const main = document.getElementById("main");
+        main.textContent = "";
+        const wrap = document.createElement("div");
+        wrap.style.color = "red";
+        wrap.appendChild(
+          document.createTextNode("Could not load benchmark data for branch: ")
+        );
+        const b = document.createElement("b");
+        b.textContent = branch;
+        wrap.appendChild(b);
+        if (commit) {
+          wrap.appendChild(
+            document.createTextNode(" at commit " + commit.substring(0, 7))
+          );
+        }
+        main.appendChild(wrap);
+      }
+
       // Function to load data.js from a specific commit
       async function loadDataFromCommit(branch, commit, isInitialLoad = false) {
         try {
@@ -497,7 +570,7 @@
             }; color: ${
               isDark ? "#e0e0e0" : "#4a4a4a"
             }; padding: 20px; border-radius: 5px; box-shadow: 0 2px 10px rgba(0,0,0,0.3); z-index: 1000;`;
-            loadingDiv.innerHTML = "Loading benchmark data...";
+            loadingDiv.textContent = "Loading benchmark data...";
             document.body.appendChild(loadingDiv);
           }
 
@@ -507,8 +580,7 @@
 
           const scriptText = await response.text();
 
-          // Execute the script
-          eval(scriptText);
+          window.BENCHMARK_DATA = parseBenchmarkDataJs(scriptText);
 
           // Update current position tracking
           if (!isInitialLoad) {
@@ -520,9 +592,10 @@
           }
 
           if (isInitialLoad) {
-            // Only run main script after data is loaded
-            document.getElementById("main-script").removeAttribute("type");
-            eval(document.getElementById("main-script").textContent);
+            const mainScriptEl = document.getElementById("main-script");
+            const injected = document.createElement("script");
+            injected.textContent = mainScriptEl.textContent;
+            document.body.appendChild(injected);
 
             // Setup pagination after data loads
             setupPagination();
@@ -537,11 +610,7 @@
             }
           }
         } catch (error) {
-          document.getElementById(
-            "main"
-          ).innerHTML = `<div style='color:red'>Could not load benchmark data for branch: <b>${branch}</b>${
-            commit ? " at commit " + commit.substring(0, 7) : ""
-          }</div>`;
+          showLoadError(branch, commit);
         }
       }