diff options
| author | Michaël Zasso <targos@protonmail.com> | 2020-06-13 11:34:21 +0300 |
|---|---|---|
| committer | Richard Lau <riclau@uk.ibm.com> | 2020-07-01 16:20:48 +0300 |
| commit | 3acc89f8f2caa2c59c5c04f4acc340156b22daaf (patch) | |
| tree | ce29122f356fddcfbc4ae0fb31eefbdc5dbc204f | |
| parent | 89a306bca9088a79aed3fb3fd511fff82178d3cb (diff) | |
deps: V8: backport cd21f71f9cb5
Original commit message:
[parser] Validate destructuring assignment pattern in correct classifier
Previously we'd first accumulate errors to the parent and validate the
destructuring pattern in the parent. In the case of ParseArguments this
will invalidly propagate binding pattern errors from one argument to the
next. The reason why ParseArguments keeps track of binding pattern errors
is because it could also be used to parse async arrow function parameters.
If we see async(a,b) we don't yet know whether this is the head of an
async arrow function, or a call to async with arguments a and b.
Bug: v8:8241
Change-Id: I670ab9a9c6f2e0bee399808b02a465ae1afa7c3f
Reviewed-on: https://chromium-review.googlesource.com/c/1296229
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56887}
Refs: https://github.com/v8/v8/commit/cd21f71f9cb592b2f9520b97c86eb5456e0e8e6d
Fixes: https://github.com/nodejs/node/issues/23142
PR-URL: https://github.com/nodejs/node/pull/33862
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
| -rw-r--r-- | common.gypi | 2 | ||||
| -rw-r--r-- | deps/v8/src/parsing/parser-base.h | 2 | ||||
| -rw-r--r-- | deps/v8/test/mjsunit/regress/regress-8241.js | 6 |
3 files changed, 8 insertions, 2 deletions
diff --git a/common.gypi b/common.gypi index 7ec4bff1580..d4de1234271 100644 --- a/common.gypi +++ b/common.gypi @@ -33,7 +33,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.57', + 'v8_embedder_string': '-node.58', # Enable disassembler for `--print-code` v8 options 'v8_enable_disassembler': 1, diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h index e7933546c6d..4e66dd8d9d6 100644 --- a/deps/v8/src/parsing/parser-base.h +++ b/deps/v8/src/parsing/parser-base.h @@ -2977,13 +2977,13 @@ ParserBase<Impl>::ParseAssignmentExpression(bool accept_IN, bool* ok) { // This is definitely not an expression so don't accumulate // expression-related errors. productions &= ~ExpressionClassifier::ExpressionProduction; + ValidateAssignmentPattern(CHECK_OK); } Accumulate(productions); if (!Token::IsAssignmentOp(peek())) return expression; if (is_destructuring_assignment) { - ValidateAssignmentPattern(CHECK_OK); } else { expression = CheckAndRewriteReferenceExpression( expression, lhs_beg_pos, scanner()->location().end_pos, diff --git a/deps/v8/test/mjsunit/regress/regress-8241.js b/deps/v8/test/mjsunit/regress/regress-8241.js new file mode 100644 index 00000000000..fb9d5475cb3 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-8241.js @@ -0,0 +1,6 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +function f(x) { } +f(x=>x, [x,y] = [1,2]); |