Bug 77340 – Unexpected syntax error

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Sander]

A single line of JS triggers a syntax error which I wouldn't expect since the code within the function is correct and should not be executed at all.

> function a() { new x('x'+y).c = ''; }

Results in a syntax error:

> SyntaxError: Unexpected token '='

Upon removing variable y within this function, the syntax error magically disappears:

> function a() { new x('x').c = ''; }

Also reproducible in stable versions of Safari. Executing this code in Firefox / Chrome works just fine.

[Sander]

Created attachment 124555 [details]
Testcase

[Gavin Barraclough]

Huh, interesting.  I can repro the issue, looks like a bug.

I think the spec defined parsing here may be odd (looks like this should evaluate as:
    new (x('x'+y).c) = ''
and not:
    (new x('x'+y)).c = ''

Very strange that removing the +y influences behavior.  We have some caching of the parsing of very small functions, possible that this works correctly in the initial parse of the outer program, and fails on the reparse of the function body (and in the case without +y maybe the caching means we get to skip the reparse).

[Oliver Hunt]

I have a fix, we weren't doing the correct logic when handling a 'new expr()' expression, so we end up thinking that we don't have a lhs element to assign to

[Oliver Hunt]

Building on my Air, so i won't have patch for ~an hour

[Zoltan Herczeg]

Oh those new expressions... I remember them. Parsing them is a nightmare. Btw 11.2 in Ecma-262

[Oliver Hunt]

(In reply to comment #5)
> Oh those new expressions... I remember them. Parsing them is a nightmare. Btw 11.2 in Ecma-262

This is a regression due to some strictness hardening i did (in terms of parser strictness, rather than "strict mode"), the fix is trivial, alas this machine is slow.

/me wants someone to invent a 24 core processor that runs at 3ghz, produces no heat, and has ~30 hours of battery life.  is that too much to ask?

[Oliver Hunt]

Created attachment 124613 [details]
Patch

[Oliver Hunt]

Committed r106297: <http://trac.webkit.org/changeset/106297>