Modified: trunk/Source/_javascript_Core/ChangeLog (194106 => 194107)
--- trunk/Source/_javascript_Core/ChangeLog 2015-12-15 17:40:09 UTC (rev 194106)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-12-15 17:58:04 UTC (rev 194107)
@@ -1,3 +1,19 @@
+2015-12-15 Caitlin Potter <[email protected]>
+
+ [JSC] SyntaxError if AssignmentElement is `eval` or `arguments` in strict code
+ https://bugs.webkit.org/show_bug.cgi?id=152302
+
+ Reviewed by Mark Lam.
+
+ `eval` and `arguments` must not be assigned to in strict code. This
+ change fixes `language/expressions/assignment/destructuring/obj-id-simple-strict.js`
+ in Test262, as well as a variety of other similar tests.
+
+ * parser/Parser.cpp:
+ (JSC::Parser<LexerType>::parseAssignmentElement):
+ (JSC::Parser<LexerType>::parseDestructuringPattern):
+ * tests/stress/destructuring-assignment-syntax.js:
+
2015-12-15 Csaba Osztrogonác <[email protected]>
URTBF after 194062.
Modified: trunk/Source/_javascript_Core/parser/Parser.cpp (194106 => 194107)
--- trunk/Source/_javascript_Core/parser/Parser.cpp 2015-12-15 17:40:09 UTC (rev 194106)
+++ trunk/Source/_javascript_Core/parser/Parser.cpp 2015-12-15 17:58:04 UTC (rev 194107)
@@ -827,21 +827,27 @@
template <typename LexerType>
template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::parseAssignmentElement(TreeBuilder& context, DestructuringKind kind, ExportType exportType, const Identifier** duplicateIdentifier, bool* hasDestructuringPattern, AssignmentContext bindingContext, int depth)
{
- SavePoint savePoint = createSavePoint();
TreeDestructuringPattern assignmentTarget = 0;
- if (match(OPENBRACE) || match(OPENBRACKET))
+ if (match(OPENBRACE) || match(OPENBRACKET)) {
+ SavePoint savePoint = createSavePoint();
assignmentTarget = parseDestructuringPattern(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth);
- if (!assignmentTarget || match(DOT) || match(OPENBRACKET) || match(OPENPAREN) || match(TEMPLATE)) {
+ if (assignmentTarget && !match(DOT) && !match(OPENBRACKET) && !match(OPENPAREN) && !match(TEMPLATE))
+ return assignmentTarget;
restoreSavePoint(savePoint);
- JSTextPosition startPosition = tokenStartPosition();
- auto element = parseMemberExpression(context);
+ }
- semanticFailIfFalse(element && context.isAssignmentLocation(element), "Invalid destructuring assignment target");
+ JSTextPosition startPosition = tokenStartPosition();
+ auto element = parseMemberExpression(context);
- return createAssignmentElement(context, element, startPosition, lastTokenEndPosition());
+ semanticFailIfFalse(element && context.isAssignmentLocation(element), "Invalid destructuring assignment target");
+
+ if (strictMode() && m_lastIdentifier && context.isResolve(element)) {
+ failIfTrueIfStrict(m_vm->propertyNames->eval == *m_lastIdentifier, "Cannot modify 'eval' in strict mode");
+ failIfTrueIfStrict(m_vm->propertyNames->arguments == *m_lastIdentifier, "Cannot modify 'arguments' in strict mode");
}
- return assignmentTarget;
+
+ return createAssignmentElement(context, element, startPosition, lastTokenEndPosition());
}
template <typename LexerType>
@@ -924,8 +930,13 @@
next();
if (consume(COLON))
innerPattern = parseBindingOrAssignmentElement(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth + 1);
- else
+ else {
+ if (kind == DestructureToExpressions && strictMode()) {
+ failIfTrueIfStrict(m_vm->propertyNames->eval == *propertyName, "Cannot modify 'eval' in strict mode");
+ failIfTrueIfStrict(m_vm->propertyNames->arguments == *propertyName, "Cannot modify 'arguments' in strict mode");
+ }
innerPattern = createBindingPattern(context, kind, exportType, *propertyName, identifierToken, bindingContext, duplicateIdentifier);
+ }
} else {
JSTokenType tokenType = m_token.m_type;
switch (m_token.m_type) {
Modified: trunk/Source/_javascript_Core/tests/stress/destructuring-assignment-syntax.js (194106 => 194107)
--- trunk/Source/_javascript_Core/tests/stress/destructuring-assignment-syntax.js 2015-12-15 17:40:09 UTC (rev 194106)
+++ trunk/Source/_javascript_Core/tests/stress/destructuring-assignment-syntax.js 2015-12-15 17:58:04 UTC (rev 194107)
@@ -57,3 +57,18 @@
testSyntaxError("[f\\u0061lse] = []", "SyntaxError: Invalid destructuring assignment target.");
testSyntaxError("[null] = []", "SyntaxError: Invalid destructuring assignment target.");
testSyntaxError("[n\\u{75}ll] = []", "SyntaxError: Invalid destructuring assignment target.");
+
+testSyntaxError("'use strict'; ({ eval } = {})", "SyntaxError: Cannot modify 'eval' in strict mode.");
+// FIXME: support CoverInitializedName properly.
+//testSyntaxError("'use strict'; ({ eval = 0 } = {})", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ({ a: eval } = {})", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ({ a: eval = 0 } = {})", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ({ arguments } = {})", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+// FIXME: support CoverInitializedName properly.
+//testSyntaxError("'use strict'; ({ arguments = 0 } = {})", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+testSyntaxError("'use strict'; ({ a: arguments } = {})", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+testSyntaxError("'use strict'; ({ a: arguments = 0 } = {})", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+testSyntaxError("'use strict'; ([ eval ] = [])", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ([ eval = 0 ] = [])", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ([ arguments ] = [])", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+testSyntaxError("'use strict'; ([ arguments = 0 ] = [])", "SyntaxError: Cannot modify 'arguments' in strict mode.");
\ No newline at end of file
