diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp index c612899f69b7..91969fbc2a57 100644 --- a/js/src/frontend/Parser.cpp +++ b/js/src/frontend/Parser.cpp @@ -2841,7 +2841,8 @@ Parser::checkFunctionDefinition(HandleAtom funAtom, Node pn, Funct template <> bool -Parser::skipLazyInnerFunction(ParseNode* pn, bool tryAnnexB) +Parser::skipLazyInnerFunction(ParseNode* pn, FunctionSyntaxKind kind, + bool tryAnnexB) { // When a lazily-parsed function is called, we only fully parse (and emit) // that function, not any of its nested children. The initial syntax-only @@ -2867,12 +2868,21 @@ Parser::skipLazyInnerFunction(ParseNode* pn, bool tryAnnexB) // script source. Rooted lazyOuter(context, handler.lazyOuterFunction()); uint32_t userbufBase = lazyOuter->begin() - lazyOuter->column(); - return tokenStream.advance(fun->lazyScript()->end() - userbufBase); + if (!tokenStream.advance(fun->lazyScript()->end() - userbufBase)) + return false; + + if (kind == Statement && fun->isExprBody()) { + if (!MatchOrInsertSemicolonAfterExpression(tokenStream)) + return false; + } + + return true; } template <> bool -Parser::skipLazyInnerFunction(Node pn, bool tryAnnexB) +Parser::skipLazyInnerFunction(Node pn, FunctionSyntaxKind kind, + bool tryAnnexB) { MOZ_CRASH("Cannot skip lazy inner functions when syntax parsing"); } @@ -2970,7 +2980,7 @@ Parser::functionDefinition(InHandling inHandling, YieldHandling yi // functions, which are also lazy. Instead, their free variables and // source extents are recorded and may be skipped. if (handler.canSkipLazyInnerFunctions()) { - if (!skipLazyInnerFunction(pn, tryAnnexB)) + if (!skipLazyInnerFunction(pn, kind, tryAnnexB)) return null(); return pn; } diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h index 1a70eba3ebd4..f0fa6b3f3baf 100644 --- a/js/src/frontend/Parser.h +++ b/js/src/frontend/Parser.h @@ -1259,7 +1259,7 @@ class Parser final : private JS::AutoGCRooter, public StrictModeGetter bool checkFunctionDefinition(HandleAtom funAtom, Node pn, FunctionSyntaxKind kind, GeneratorKind generatorKind, bool* tryAnnexB); - bool skipLazyInnerFunction(Node pn, bool tryAnnexB); + bool skipLazyInnerFunction(Node pn, FunctionSyntaxKind kind, bool tryAnnexB); bool innerFunction(Node pn, ParseContext* outerpc, HandleFunction fun, InHandling inHandling, FunctionSyntaxKind kind, GeneratorKind generatorKind, bool tryAnnexB, diff --git a/js/src/jit-test/tests/parser/bug-1298809.js b/js/src/jit-test/tests/parser/bug-1298809.js new file mode 100644 index 000000000000..b93c7b0834f7 --- /dev/null +++ b/js/src/jit-test/tests/parser/bug-1298809.js @@ -0,0 +1,6 @@ +function f() { + if (0) + function g() x; + else; +} +f();