Bug 247606

Summary: Access of template literal in LHS throws unexpected `SyntaxError`
Product: WebKit Reporter: Kanguk Lee <p51lee>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: mark.lam, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Mac (Apple Silicon)   
OS: macOS 13   

Description Kanguk Lee 2022-11-08 03:27:05 PST
// input.js
`${ + 0 }` [ 0 ] = 0 ;
// Note: this is fine
// `${ 0 }` [ 0 ] = 0 ;
_____________________

Hello,

Executing the input.js using JSC throws SyntaxError, but it is expected to be terminated normally.

This bug looks similar to the bugs I found: https://bugs.webkit.org/show_bug.cgi?id=247435 and https://bugs.webkit.org/show_bug.cgi?id=247497.

However, I personally think this may not be a duplicate of Bug 247435 and Bug 247497, so please let me know if this bug is duplicated or not.

Running the input.js with JSC results in:

---
$ jsc input.js
Exception: SyntaxError: Left hand side of operator '=' must be a reference.
at input.js:1
---

while other engines behave like:

---
# V8
$ node input.js
// no error

# GraalJS
$ js input.js
// no error
---


WebKit version: 615.1.10
Comment 1 Radar WebKit Bug Importer 2022-11-09 10:29:00 PST
<rdar://problem/102148789>
Comment 2 Yusuke Suzuki 2022-11-09 12:24:43 PST
Pull request: https://github.com/WebKit/WebKit/pull/6312
Comment 3 EWS 2022-11-09 14:27:44 PST
Committed 256500@main (8900c3f92d08): <https://commits.webkit.org/256500@main>

Reviewed commits have been landed. Closing PR #6312 and removing active labels.