From ed2260f2ff8baaf1679d1d5d4a55d40346c2868a Mon Sep 17 00:00:00 2001
From: Zoltan Herczeg <zherczeg.u-szeged@partner.samsung.com>
Date: Thu, 4 Jun 2020 01:48:39 -0700
Subject: [PATCH] Don't continue parsing expressions after ternary operators.

Further benefits: new code requires less checks.

Fixes #3841
Fixes #3842

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg.u-szeged@partner.samsung.com
---
 jerry-core/parser/js/js-parser-expr.c         | 37 +++++++++----------
 .../es2015/regresssion-test-issue-3841.js     | 20 ++++++++++
 .../es2015/regresssion-test-issue-3842.js     | 20 ++++++++++
 3 files changed, 58 insertions(+), 19 deletions(-)
 create mode 100644 tests/jerry/es2015/regresssion-test-issue-3841.js
 create mode 100644 tests/jerry/es2015/regresssion-test-issue-3842.js

diff --git a/jerry-core/parser/js/js-parser-expr.c b/jerry-core/parser/js/js-parser-expr.c
index 15983a9fe6..9ad0451e7c 100644
--- a/jerry-core/parser/js/js-parser-expr.c
+++ b/jerry-core/parser/js/js-parser-expr.c
@@ -3304,13 +3304,9 @@ parser_parse_initializer_by_next_char (parser_context_t *context_p, /**< context
 
 /**
  * Process ternary expression.
- *
- * @return true - continue with primary expression parsing
- *         false - otherwise
  */
-static bool
-parser_process_ternary_expression (parser_context_t *context_p, /**< context */
-                                   size_t grouping_level) /**< grouping level */
+static void
+parser_process_ternary_expression (parser_context_t *context_p) /**< context */
 {
   JERRY_ASSERT (context_p->token.type == LEXER_QUESTION_MARK);
 
@@ -3354,7 +3350,6 @@ parser_process_ternary_expression (parser_context_t *context_p, /**< context */
   parser_flush_cbc (context_p);
 
   parser_process_binary_opcodes (context_p, 0);
-  return grouping_level >= PARSER_GROUPING_LEVEL_INCREASE;
 } /* parser_process_ternary_expression */
 
 /**
@@ -3523,12 +3518,6 @@ parser_parse_expression (parser_context_t *context_p, /**< context */
         continue;
       }
 
-      if (JERRY_UNLIKELY (context_p->token.type == LEXER_QUESTION_MARK)
-          && (grouping_level != PARSE_EXPR_LEFT_HAND_SIDE)
-          && parser_process_ternary_expression (context_p, grouping_level))
-      {
-        continue;
-      }
       break;
     }
 
@@ -3537,19 +3526,29 @@ parser_parse_expression (parser_context_t *context_p, /**< context */
       break;
     }
 
-    if (JERRY_UNLIKELY (context_p->token.type == LEXER_COMMA)
-        && (!(options & PARSE_EXPR_NO_COMMA) || grouping_level >= PARSER_GROUPING_LEVEL_INCREASE))
+    if (JERRY_UNLIKELY (context_p->token.type == LEXER_QUESTION_MARK))
     {
-      parser_process_expression_sequence (context_p);
-      continue;
-    }
+      parser_process_ternary_expression (context_p);
 
-    if (LEXER_IS_BINARY_OP_TOKEN (context_p->token.type))
+      if (context_p->token.type == LEXER_RIGHT_PAREN)
+      {
+        goto process_unary_expression;
+      }
+    }
+    else if (LEXER_IS_BINARY_OP_TOKEN (context_p->token.type))
     {
       parser_append_binary_token (context_p);
       lexer_next_token (context_p);
       continue;
     }
+
+    if (JERRY_UNLIKELY (context_p->token.type == LEXER_COMMA)
+        && (!(options & PARSE_EXPR_NO_COMMA) || grouping_level >= PARSER_GROUPING_LEVEL_INCREASE))
+    {
+      parser_process_expression_sequence (context_p);
+      continue;
+    }
+
     break;
   }
 
diff --git a/tests/jerry/es2015/regresssion-test-issue-3841.js b/tests/jerry/es2015/regresssion-test-issue-3841.js
new file mode 100644
index 0000000000..3e0e8ccd9d
--- /dev/null
+++ b/tests/jerry/es2015/regresssion-test-issue-3841.js
@@ -0,0 +1,20 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+try {
+  eval('$?$:$=>{ }?{ }:$')
+  assert(false)
+} catch (e) {
+  assert(e instanceof SyntaxError)
+}
diff --git a/tests/jerry/es2015/regresssion-test-issue-3842.js b/tests/jerry/es2015/regresssion-test-issue-3842.js
new file mode 100644
index 0000000000..918b3ef983
--- /dev/null
+++ b/tests/jerry/es2015/regresssion-test-issue-3842.js
@@ -0,0 +1,20 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+try {
+  eval('while(0 ? 0 : ()=>{} | {})')
+  assert(false)
+} catch (e) {
+  assert(e instanceof SyntaxError)
+}