AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[parser] Prevent lazy parsing of arrow functions

Browse Source 
Change Parser::AllowsLazyParsingWithoutUnresolvedVariables to return
false if it may be parsing an arrow function.

Bug: v8:9758, v8:8510
Change-Id: Ic5d213d4358ff954a169c03e449197c3f050880c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1816510
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63920}
This commit is contained in:
Dan Elphick 2019-09-20 15:19:07 +01:00 committed by Commit Bot
parent 8d7c581a2a
commit 4921821b2f
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/parsing/parser.h
View File

@ -172,8 +172,9 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
parsing::ReportErrorsAndStatisticsMode stats_mode);
bool AllowsLazyParsingWithoutUnresolvedVariables() const {
return scope()->AllowsLazyParsingWithoutUnresolvedVariables(
original_scope_);
return !MaybeParsingArrowhead() &&
scope()->AllowsLazyParsingWithoutUnresolvedVariables(
original_scope_);
}
bool parse_lazily() const { return mode_ == PARSE_LAZILY; }

9
test/mjsunit/regress/regress-v8-9758.js Normal file
View File

@ -0,0 +1,9 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --throws
// Can't put this in a try-catch as that changes the parsing so the crash
// doesn't reproduce.
((a = ((b = a) => {})()) => 1)();