Bug 105922 – CommaExpression with 'arguments' as last expression throws SyntaxError instead of ReferenceError

• Component: JavaScriptCore
• Status: UNCONFIRMED

[André Bargull]

test case:
---
(function(){"use strict"; (1,arguments)=0 })
---

The `Comma Operator` [11.14] calls `GetValue` on its operands, therefore the conditions listed in 11.13.1 are not fulfilled. In particular that means the left-hand-side of the assignment is never of type `Reference`. Instead of a SyntaxError, it should rather be an early ReferenceError, if those were implemented in JSC.

[Oliver Hunt]

I'm not sure why this is a bug - reference errors are late errors, syntax errors are early.  Assigning to arguments in strict mode is a SyntaxError.  How are you determining that ReferenceError takes priority?

I also would have thought that var a; (1,a) = 0; would be a syntax error in strict mode as well.

[André Bargull]

Per [11.13.1] a SyntaxError is thrown iff
- Type(lref) is Reference is true
- IsStrictReference(lref) is true
- Type(GetBase(lref)) is Environment Record
- GetReferencedName(lref) is either "eval" or "arguments"


In the expression `(1,arguments)=0`, `Type(lref)` is not a Reference, but a value, therefore the strict-mode assignment to arguments rule in [11.13.1] does not apply, hence no SyntaxError. That means step 5 of [11.13.1] gets executed, PutValue(V,W) [8.7.2] will be called and then a ReferenceError gets thrown in step 1 of [8.7.2]. Per [16 Errors], the assignment `(1,arguments)=0` should result in an early error (with type ReferenceError? The spec does not mandate a specific error..?), but early errors for assignments are not implemented in JSC. (Strict mode is irrelevant for early errors in assignment expressions if the left-hand-side is not of type reference.)

As of now, the supplied test case results in an early SyntaxError.