fix: bound unclosed comment source positions to input

lib/safe-parser.js

@@ -8,13 +8,12 @@ class SafeParser extends Parser {
   comment(token) {
     let node = new Comment()
     this.init(node, token[2])
-    let pos =
-      this.input.fromOffset(token[3]) ||
-      this.input.fromOffset(this.input.css.length - 1)
+    let end = Math.min(token[3], this.input.css.length - 1)
+    let pos = this.input.fromOffset(end)
     node.source.end = {
       column: pos.col,
       line: pos.line,
-      offset: token[3] + 1
+      offset: end + 1
     }
 
     let text = token[1].slice(2)
@@ -54,7 +53,9 @@ class SafeParser extends Parser {
       this.current = this.current.parent
       this.current.raws.after = ''
     }
-    this.root.source.end = this.getPosition(this.tokenizer.position())
+    this.root.source.end = this.getPosition(
+      Math.min(this.tokenizer.position(), this.input.css.length)
+    )
   }
 
   precheckMissedSemicolon(tokens) {

test/parse.test.js

@@ -34,6 +34,26 @@ test('fixes unclosed comment in safe mode', () => {
   equal(root.first.first.text, 'b')
 })
 
+test('keeps unclosed comment source positions inside the original input', () => {
+  let css = 'a {\n  /* unfinished'
+  let root = parse(css)
+  let comment = root.first.first
+  deepStrictEqual(comment.source.end, {
+    column: 15,
+    line: 2,
+    offset: css.length
+  })
+  deepStrictEqual(root.source.end, {
+    column: 16,
+    line: 2,
+    offset: css.length
+  })
+  equal(comment.source.input.css.slice(
+    comment.source.start.offset,
+    comment.source.end.offset
+  ), '/* unfinished')
+})
+
 test('fixes column and semicolumn case', () => {
   equal(parse('a{:;}').toString(), 'a{}')
 })