Changeset 266324 in webkit for trunk/Source/JavaScriptCore/parser/Parser.cpp

Timestamp:

Aug 29, 2020, 1:38:09 AM (5 years ago)

Author:

[email protected]

Message:

[JSC] for-of / for-in left-hand-side target should be simple-assignment-target
​https://bugs.webkit.org/show_bug.cgi?id=215969

Reviewed by Ross Kirsling.

JSTests:

• stress/for-of-in-non-reference.js: Added.

(testSyntax):
(testSyntaxError):
(testSyntaxError.t):
(testSyntaxError.async t):
(testSyntax.async t):

• test262/expectations.yaml:

Source/JavaScriptCore:

Left-hand-side of for-in, for-of, and for-await-of should be simple assignment target[1]
if the target is not declaration and not destructuring pattern.

[1]: ​https://tc39.es/ecma262/#sec-for-in-and-for-of-statements-static-semantics-early-errors

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseForStatement):

• parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createCommaExpr): Should return CommaExpr to align it to ASTBuilder.
(JSC::SyntaxChecker::appendToCommaExpr):
(JSC::SyntaxChecker::appendStatement):
(JSC::SyntaxChecker::combineCommaNodes): Deleted since it is not used.

LayoutTests:

Fix for-in / for-of parser behavior.

• js/basic-strict-mode-expected.txt:
• js/parser-syntax-check-expected.txt:
• js/script-tests/parser-syntax-check.js:

File:

• trunk/Source/JavaScriptCore/parser/Parser.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/parser/Parser.cpp

@@ -1543 +1543 @@
         return result;
     }
+
+    semanticFailIfFalse(isSimpleAssignmentTarget(context, decls), "Left side of assignment is not a reference");
     if (isOfEnumeration)
         result = context.createForOfLoop(isAwaitFor, location, decls, expr, statement, declLocation, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);