YourWishes/jerryscript
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CBC_PUSH_THIS should not be mutated in array literal parsing. (#3652)

Browse Source 
This patch fixes #3650 and slightly reverts the changes of #3594.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
This commit is contained in:
Robert Fancsik
2020-03-27 21:20:37 +01:00
committed by GitHub
parent 4240b740aa
commit d63936f371
2 changed files with 32 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jerry-core/parser/js/js-parser-expr.c
+15 -27
View File
@@ -98,8 +98,9 @@ parser_push_result (parser_context_t *context_p) /**< context */
static void static void
parser_check_invalid_assign (parser_context_t *context_p) /**< context */ parser_check_invalid_assign (parser_context_t *context_p) /**< context */
{ {
if (context_p->last_cbc.literal_type == LEXER_IDENT_LITERAL JERRY_ASSERT (context_p->last_cbc.literal_type == LEXER_IDENT_LITERAL);
&& JERRY_UNLIKELY (context_p->status_flags & PARSER_IS_STRICT))
if (JERRY_UNLIKELY (context_p->status_flags & PARSER_IS_STRICT))
{ {
if (context_p->last_cbc.literal_keyword_type == LEXER_KEYW_EVAL) if (context_p->last_cbc.literal_keyword_type == LEXER_KEYW_EVAL)
{ {
@@ -281,6 +282,11 @@ parser_parse_array_literal (parser_context_t *context_p) /**< context */
parser_parse_expression (context_p, PARSE_EXPR_NO_COMMA); parser_parse_expression (context_p, PARSE_EXPR_NO_COMMA);
if (context_p->last_cbc_opcode == CBC_PUSH_THIS)
{
parser_flush_cbc (context_p);
}
if (context_p->token.type == LEXER_COMMA) if (context_p->token.type == LEXER_COMMA)
{ {
lexer_next_token (context_p); lexer_next_token (context_p);
@@ -2212,19 +2218,10 @@ parser_append_binary_single_assignment_token (parser_context_t *context_p, /**<
} }
else if (context_p->last_cbc_opcode == CBC_PUSH_THIS_LITERAL) else if (context_p->last_cbc_opcode == CBC_PUSH_THIS_LITERAL)
{ {
if (context_p->last_cbc.literal_type != LEXER_IDENT_LITERAL) context_p->last_cbc_opcode = CBC_PUSH_THIS;
{ parser_flush_cbc (context_p);
parser_emit_cbc_ext (context_p, CBC_EXT_THROW_REFERENCE_ERROR); parser_stack_push_uint16 (context_p, context_p->last_cbc.literal_index);
parser_stack_push_uint8 (context_p, CBC_ASSIGN); parser_stack_push_uint8 (context_p, assign_ident_opcode);
}
else
{
parser_check_invalid_assign (context_p);
context_p->last_cbc_opcode = CBC_PUSH_THIS;
parser_flush_cbc (context_p);
parser_stack_push_uint16 (context_p, context_p->last_cbc.literal_index);
parser_stack_push_uint8 (context_p, assign_ident_opcode);
}
} }
else if (context_p->last_cbc_opcode == CBC_PUSH_PROP) else if (context_p->last_cbc_opcode == CBC_PUSH_PROP)
{ {
@@ -2313,18 +2310,9 @@ parser_append_binary_token (parser_context_t *context_p) /**< context */
} }
else if (context_p->last_cbc_opcode == CBC_PUSH_THIS_LITERAL) else if (context_p->last_cbc_opcode == CBC_PUSH_THIS_LITERAL)
{ {
if (context_p->last_cbc.literal_type != LEXER_IDENT_LITERAL) context_p->last_cbc_opcode = CBC_PUSH_THIS;
{ parser_flush_cbc (context_p);
parser_emit_cbc_ext (context_p, CBC_EXT_THROW_REFERENCE_ERROR); context_p->last_cbc_opcode = CBC_PUSH_IDENT_REFERENCE;
parser_emit_cbc (context_p, CBC_PUSH_PROP_REFERENCE);
}
else
{
parser_check_invalid_assign (context_p);
context_p->last_cbc_opcode = CBC_PUSH_THIS;
parser_flush_cbc (context_p);
context_p->last_cbc_opcode = CBC_PUSH_IDENT_REFERENCE;
}
} }
else else
{ {
tests/jerry/regression-test-issue-3650.js
+17
View File
@@ -0,0 +1,17 @@
// Copyright JS Foundation and other contributors, http://js.foundation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
var u = 5;
assert ([this, u = u - 1].length === 2);
assert (u === 4);