In the declaration of base::internal::JSONParser there is a contract stating that the internal pos_ is equivalent to start_pos_ + index_:
https://codesearch.chromium.org/chromium/src/base/json/json_parser.h?l=230-232

However, this is not always true, which becomes evident when adding DCHECKs in appropriate places.

This mismatch can lead to reads of uninitialized memory, for example on input |JSONParser::Parse("\"\xC3\x83")|.

This bug is a follow up to  http://crbug.com/698693  and the discussion in http://crrev.com/2859513002.