From 1b84a17dc775f8a2ca523c2fc9e9437d01b99522 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A9ter=20G=C3=A1l?= <pgal.u-szeged@partner.samsung.com>
Date: Fri, 6 Sep 2019 16:56:04 +0200
Subject: [PATCH] Correctly propagate super prop ref when parsing expressions
 (#3077)

The "super prop ref" flag is incorrectly used at multiple expressions
as it was only cleared if there was an assignment operation.

JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.u-szeged@partner.samsung.com
---
 jerry-core/parser/js/js-parser-expr.c         | 18 +++++++++++
 .../es2015/regression-test-issue-3067.js      | 32 +++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 tests/jerry/es2015/regression-test-issue-3067.js

diff --git a/jerry-core/parser/js/js-parser-expr.c b/jerry-core/parser/js/js-parser-expr.c
index bdb7bf9b2..e4b62f2c4 100644
--- a/jerry-core/parser/js/js-parser-expr.c
+++ b/jerry-core/parser/js/js-parser-expr.c
@@ -2245,6 +2245,16 @@ parser_parse_expression (parser_context_t *context_p, /**< context */
 
   parser_stack_push_uint8 (context_p, LEXER_EXPRESSION_START);
 
+#if ENABLED (JERRY_ES2015_CLASS)
+  /* Parsing a new expression:
+   *  So save, remove, and at the end restore the super prop reference indicator.
+   *
+   * If this is not done, it is possible to carry the flag over to the next expression.
+   */
+  bool has_super_ref = (context_p->status_flags & PARSER_CLASS_SUPER_PROP_REFERENCE);
+  context_p->status_flags &= (uint32_t) ~PARSER_CLASS_SUPER_PROP_REFERENCE;
+#endif
+
   while (true)
   {
     if (options & PARSE_EXPR_HAS_LITERAL)
@@ -2409,6 +2419,14 @@ parser_parse_expression (parser_context_t *context_p, /**< context */
   {
     parser_push_result (context_p);
   }
+
+#if ENABLED (JERRY_ES2015_CLASS)
+  /* Restore the super prop ref flag. */
+  if (has_super_ref)
+  {
+    context_p->status_flags |= (uint32_t) PARSER_CLASS_SUPER_PROP_REFERENCE;
+  }
+#endif /* ENABLED (JERRY_ES2015_CLASS) */
 } /* parser_parse_expression */
 
 /**
diff --git a/tests/jerry/es2015/regression-test-issue-3067.js b/tests/jerry/es2015/regression-test-issue-3067.js
new file mode 100644
index 000000000..f0b378463
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-3067.js
@@ -0,0 +1,32 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Test case minimalized from issue #3067
+
+function f () { }
+
+class B extends f {
+  constructor () {
+    super (0)
+    super.$
+    this.$ = $
+  }
+}
+
+try {
+  var b = new B;
+  assert (false);
+} catch (ex) {
+  assert (ex instanceof ReferenceError);
+}