AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[parser] Fix cover-grammar initializer positions

Browse Source 
Since we use a ScopedPtrList to track cover grammar expressions we don't know
the position of the commas anymore. The position of the commas was used to
demark the initializer, which is needed to figure out whether we need hole
checks for variable references. (Typically only references within the
initializer need hole checks for the initialized variable.) Since we didn't
have the comma position, we simply used the position of the first expression as
the position of any subsequent comma, which would make it seem as if the
initializer body wasn't in the initializer. Now instead we simply use the
position of the subsequent parameter as the end of the initializer, which is
close enough.

Bug: chromium:902810
Change-Id: I8d2bc7a2dc9f59db16ce56ccef01e263a18a3b7a
Reviewed-on: https://chromium-review.googlesource.com/c/1326022
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57357}
This commit is contained in:
Toon Verwaest 2018-11-08 11:07:42 +01:00 committed by Commit Bot
parent 42dcc3ccc2
commit 5bf9e470f8
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/parsing/parser.cc
View File

@ -3511,12 +3511,12 @@ Expression* Parser::ExpressionListToExpression(
if (args.length() == 1) return expr; if (args.length() == 1) return expr;
if (args.length() == 2) { if (args.length() == 2) {
return factory()->NewBinaryOperation(Token::COMMA, expr, args.at(1), return factory()->NewBinaryOperation(Token::COMMA, expr, args.at(1),
expr->position()); args.at(1)->position());
} }
NaryOperation* result = NaryOperation* result =
factory()->NewNaryOperation(Token::COMMA, expr, args.length() - 1); factory()->NewNaryOperation(Token::COMMA, expr, args.length() - 1);
for (int i = 1; i < args.length(); i++) { for (int i = 1; i < args.length(); i++) {
result->AddSubsequent(args.at(i), expr->position()); result->AddSubsequent(args.at(i), args.at(i)->position());
} }
return result; return result;
} }

5
test/mjsunit/regress/regress-902810.js Normal file
View File

@ -0,0 +1,5 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertThrows("((__v_4 = __v_4, __v_0) => eval(__v_4))()", ReferenceError)