Changeset 194107 in webkit

Timestamp:

Dec 15, 2015 9:58:04 AM (8 years ago)

Author:

commit-queue@webkit.org

Message:

[JSC] SyntaxError if AssignmentElement is eval or arguments in strict code
​https://bugs.webkit.org/show_bug.cgi?id=152302

Patch by Caitlin Potter <​caitp@igalia.com> on 2015-12-15
Reviewed by Mark Lam.

eval and arguments must not be assigned to in strict code. This
change fixes language/expressions/assignment/destructuring/obj-id-simple-strict.js
in Test262, as well as a variety of other similar tests.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseAssignmentElement):
(JSC::Parser<LexerType>::parseDestructuringPattern):

• tests/stress/destructuring-assignment-syntax.js:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• parser/Parser.cpp (modified) (2 diffs)
• tests/stress/destructuring-assignment-syntax.js (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-12-15  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] SyntaxError if AssignmentElement is `eval` or `arguments` in strict code
+        https://bugs.webkit.org/show_bug.cgi?id=152302
+
+        Reviewed by Mark Lam.
+
+        `eval` and `arguments` must not be assigned to in strict code. This
+        change fixes `language/expressions/assignment/destructuring/obj-id-simple-strict.js`
+        in Test262, as well as a variety of other similar tests.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentElement):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        * tests/stress/destructuring-assignment-syntax.js:
+
 2015-12-15  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/Source/JavaScriptCore/parser/Parser.cpp

@@ -828 +828 @@
 template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::parseAssignmentElement(TreeBuilder& context, DestructuringKind kind, ExportType exportType, const Identifier** duplicateIdentifier, bool* hasDestructuringPattern, AssignmentContext bindingContext, int depth)
 {
-    SavePoint savePoint = createSavePoint();
     TreeDestructuringPattern assignmentTarget = 0;
 
-    if (match(OPENBRACE) || match(OPENBRACKET))
+    if (match(OPENBRACE) || match(OPENBRACKET)) {
+        SavePoint savePoint = createSavePoint();
         assignmentTarget = parseDestructuringPattern(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth);
-    if (!assignmentTarget || match(DOT) || match(OPENBRACKET) || match(OPENPAREN) || match(TEMPLATE)) {
+        if (assignmentTarget && !match(DOT) && !match(OPENBRACKET) && !match(OPENPAREN) && !match(TEMPLATE))
+            return assignmentTarget;
         restoreSavePoint(savePoint);
-        JSTextPosition startPosition = tokenStartPosition();
-        auto element = parseMemberExpression(context);
-
-        semanticFailIfFalse(element && context.isAssignmentLocation(element), "Invalid destructuring assignment target");
-
-        return createAssignmentElement(context, element, startPosition, lastTokenEndPosition());
-    }
-    return assignmentTarget;
+    }
+
+    JSTextPosition startPosition = tokenStartPosition();
+    auto element = parseMemberExpression(context);
+
+    semanticFailIfFalse(element && context.isAssignmentLocation(element), "Invalid destructuring assignment target");
+
+    if (strictMode() && m_lastIdentifier && context.isResolve(element)) {
+        failIfTrueIfStrict(m_vm->propertyNames->eval == *m_lastIdentifier, "Cannot modify 'eval' in strict mode");
+        failIfTrueIfStrict(m_vm->propertyNames->arguments == *m_lastIdentifier, "Cannot modify 'arguments' in strict mode");
+    }
+
+    return createAssignmentElement(context, element, startPosition, lastTokenEndPosition());
 }
 
@@ -925 +931 @@
                 if (consume(COLON))
                     innerPattern = parseBindingOrAssignmentElement(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth + 1);
-                else
+                else {
+                    if (kind == DestructureToExpressions && strictMode()) {
+                        failIfTrueIfStrict(m_vm->propertyNames->eval == *propertyName, "Cannot modify 'eval' in strict mode");
+                        failIfTrueIfStrict(m_vm->propertyNames->arguments == *propertyName, "Cannot modify 'arguments' in strict mode");
+                    }
                     innerPattern = createBindingPattern(context, kind, exportType, *propertyName, identifierToken, bindingContext, duplicateIdentifier);
+                }
             } else {
                 JSTokenType tokenType = m_token.m_type;

trunk/Source/JavaScriptCore/tests/stress/destructuring-assignment-syntax.js

@@ -58 +58 @@
 testSyntaxError("[null] = []", "SyntaxError: Invalid destructuring assignment target.");
 testSyntaxError("[n\\u{75}ll] = []", "SyntaxError: Invalid destructuring assignment target.");
+
+testSyntaxError("'use strict'; ({ eval } = {})", "SyntaxError: Cannot modify 'eval' in strict mode.");
+// FIXME: support CoverInitializedName properly.
+//testSyntaxError("'use strict'; ({ eval = 0 } = {})", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ({ a: eval } = {})", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ({ a: eval = 0 } = {})", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ({ arguments } = {})", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+// FIXME: support CoverInitializedName properly.
+//testSyntaxError("'use strict'; ({ arguments = 0 } = {})", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+testSyntaxError("'use strict'; ({ a: arguments } = {})", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+testSyntaxError("'use strict'; ({ a: arguments = 0 } = {})", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+testSyntaxError("'use strict'; ([ eval ] = [])", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ([ eval = 0 ] = [])", "SyntaxError: Cannot modify 'eval' in strict mode.");
+testSyntaxError("'use strict'; ([ arguments ] = [])", "SyntaxError: Cannot modify 'arguments' in strict mode.");
+testSyntaxError("'use strict'; ([ arguments = 0 ] = [])", "SyntaxError: Cannot modify 'arguments' in strict mode.");