Changeset 282968 in webkit for trunk/Source/JavaScriptCore/parser/Parser.cpp

Timestamp:

Sep 23, 2021, 10:24:52 AM (4 years ago)

Author:

Ross Kirsling

Message:

[JSC] Handle syntactic production for #x in expr correctly
​https://bugs.webkit.org/show_bug.cgi?id=230668

Reviewed by Yusuke Suzuki.

JSTests:

• stress/private-in.js: Add tests.
• test262/expectations.yaml: Mark two test cases as passing.

Source/JavaScriptCore:

The production for #x in expr is easy to get wrong.

RelationalExpression[In, Yield, Await] :

ShiftExpression?Await
RelationalExpression?Yield, ?Await < ShiftExpression?Await
RelationalExpression?Yield, ?Await > ShiftExpression?Await
RelationalExpression?Yield, ?Await <= ShiftExpression?Await
RelationalExpression?Yield, ?Await >= ShiftExpression?Await
RelationalExpression?Yield, ?Await instanceof ShiftExpression?Await
[+In] RelationalExpression[+In, ?Yield, ?Await] in ShiftExpression?Await
[+In] PrivateIdentifier in ShiftExpression?Await

We were ensuring that a standalone private name #x is always followed by operator in;
this patch further ensures that that particular in can't have its LHS misparsed as a RelationalExpression.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseBinaryExpression):
Verify the precedence of the topmost operator on the stack (if any) when parsing standalone #x.

File:

• trunk/Source/JavaScriptCore/parser/Parser.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/parser/Parser.cpp

@@ -4239 +4239 @@
     bool hasCoalesceOperator = false;
 
+    int previousOperator = 0;
     while (true) {
         JSTextPosition exprStart = tokenStartPosition();
@@ -4251 +4252 @@
             m_seenPrivateNameUseInNonReparsingFunctionMode = true;
             next();
-            semanticFailIfTrue(m_token.m_type != INTOKEN, "Bare private name can only be used as the left-hand side of an `in` expression");
+            semanticFailIfTrue(m_token.m_type != INTOKEN || previousOperator >= INTOKEN, "Bare private name can only be used as the left-hand side of an `in` expression");
             current = context.createPrivateIdentifierNode(location, *ident);
         } else
@@ -4308 +4309 @@
         }
         context.operatorStackAppend(operatorStackDepth, operatorToken, precedence);
+        previousOperator = operatorToken;
     }
     while (operatorStackDepth) {