Skip to content

Commit ca5d5f3

Browse files
akroshgakroshg
committed
[1.11>master] [MERGE #6375 @akroshg] ChakraCore servicing fixes for Feb release
Merge pull request #6375 from akroshg:servicing/2002 Fixes following CVEs [CVE-2020-0710] [CVE-2020-0711] [CVE-2020-0712] [CVE-2020-0713] [CVE-2020-0767]
2 parents fc0d2ac + 42485b9 commit ca5d5f3

File tree

11 files changed

+293
-98
lines changed

11 files changed

+293
-98
lines changed

‎lib/Backend/JnHelperMethodList.h

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,17 @@ HELPERCALLCHK(Op_PatchPutValueWithThisPtrNoLocalFastPathPolymorphic, ((void (*)(
257257
HELPERCALLCHK(Op_PatchPutRootValueNoLocalFastPath, ((void (*)(Js::FunctionBody *const, Js::InlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutRootValueNoLocalFastPath<true, Js::InlineCache>), AttrCanThrow)
258258
HELPERCALLCHK(Op_PatchPutRootValueNoLocalFastPathPolymorphic, ((void (*)(Js::FunctionBody *const, Js::PolymorphicInlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutRootValueNoLocalFastPath<true, Js::PolymorphicInlineCache>), AttrCanThrow)
259259

260+
HELPERCALLCHK(Op_PatchInitValueCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::InlineCache *const, const Js::InlineCacheIndex, Js::RecyclableObject*, Js::PropertyId, Js::Var))Js::JavascriptOperators::PatchInitValueCheckLayout<Js::InlineCache>), AttrCanThrow)
261+
HELPERCALLCHK(Op_PatchInitValuePolymorphicCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::PolymorphicInlineCache *const, const Js::InlineCacheIndex, Js::RecyclableObject*, Js::PropertyId, Js::Var))Js::JavascriptOperators::PatchInitValueCheckLayout<Js::PolymorphicInlineCache>), AttrCanThrow)
262+
HELPERCALLCHK(Op_PatchPutValueCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::InlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutValueCheckLayout<Js::InlineCache>), AttrCanThrow)
263+
HELPERCALLCHK(Op_PatchPutValueWithThisPtrCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::InlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutValueWithThisPtrCheckLayout<Js::InlineCache>), AttrCanThrow)
264+
HELPERCALLCHK(Op_PatchPutValuePolymorphicCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::PolymorphicInlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutValueCheckLayout<Js::PolymorphicInlineCache>), AttrCanThrow)
265+
HELPERCALLCHK(Op_PatchPutValueWithThisPtrPolymorphicCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::PolymorphicInlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutValueWithThisPtrCheckLayout<Js::PolymorphicInlineCache>), AttrCanThrow)
266+
HELPERCALLCHK(Op_PatchPutValueNoLocalFastPathCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::InlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutValueNoLocalFastPathCheckLayout<Js::InlineCache>), AttrCanThrow)
267+
HELPERCALLCHK(Op_PatchPutValueWithThisPtrNoLocalFastPathCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::InlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutValueWithThisPtrNoLocalFastPathCheckLayout<Js::InlineCache>), AttrCanThrow)
268+
HELPERCALLCHK(Op_PatchPutValueNoLocalFastPathPolymorphicCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::PolymorphicInlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutValueNoLocalFastPathCheckLayout<Js::PolymorphicInlineCache>), AttrCanThrow)
269+
HELPERCALLCHK(Op_PatchPutValueWithThisPtrNoLocalFastPathPolymorphicCheckLayout, ((bool (*)(Js::FunctionBody *const, Js::PolymorphicInlineCache *const, const Js::InlineCacheIndex, Js::Var, Js::PropertyId, Js::Var, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchPutValueWithThisPtrNoLocalFastPathCheckLayout<Js::PolymorphicInlineCache>), AttrCanThrow)
270+
260271
HELPERCALLCHK(Op_PatchSetPropertyScoped, ((void (*)(Js::FunctionBody *const, Js::InlineCache *const, const Js::InlineCacheIndex, Js::FrameDisplay*, Js::PropertyId, Js::Var, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchSetPropertyScoped<true, Js::InlineCache>), AttrCanThrow)
261272
HELPERCALLCHK(Op_ConsolePatchSetPropertyScoped, ((void(*)(Js::FunctionBody *const, Js::InlineCache *const, const Js::InlineCacheIndex, Js::FrameDisplay*, Js::PropertyId, Js::Var, Js::Var, Js::PropertyOperationFlags))Js::JavascriptOperators::PatchSetPropertyScoped<true, Js::InlineCache>), AttrCanThrow)
262273

‎lib/Backend/Lower.cpp

Lines changed: 102 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -7134,6 +7134,57 @@ Lowerer::LowerStFld(
71347134
IR::Opnd *dst = stFldInstr->UnlinkDst();
71357135
AssertMsg(dst->IsSymOpnd() && dst->AsSymOpnd()->m_sym->IsPropertySym(), "Expected property sym as dst of field store");
71367136

7137+
BailOutInfo * bailOutInfo = nullptr;
7138+
bool doCheckLayout = false;
7139+
IR::PropertySymOpnd * propertySymOpnd = nullptr;
7140+
if (dst->AsSymOpnd()->IsPropertySymOpnd())
7141+
{
7142+
propertySymOpnd = dst->AsPropertySymOpnd();
7143+
if (stFldInstr->HasBailOutInfo() && !propertySymOpnd->IsTypeCheckSeqCandidate() && propertySymOpnd->TypeCheckRequired())
7144+
{
7145+
IR::Instr * instrBailTarget = stFldInstr->ShareBailOut();
7146+
LowerBailTarget(instrBailTarget);
7147+
doCheckLayout = true;
7148+
bailOutInfo = stFldInstr->GetBailOutInfo();
7149+
switch (helperMethod)
7150+
{
7151+
case IR::HelperOp_PatchPutValue:
7152+
helperMethod = IR::HelperOp_PatchPutValueCheckLayout;
7153+
break;
7154+
case IR::HelperOp_PatchPutValuePolymorphic:
7155+
helperMethod = IR::HelperOp_PatchPutValuePolymorphicCheckLayout;
7156+
break;
7157+
case IR::HelperOp_PatchPutValueNoLocalFastPath:
7158+
helperMethod = IR::HelperOp_PatchPutValueNoLocalFastPathCheckLayout;
7159+
break;
7160+
case IR::HelperOp_PatchPutValueNoLocalFastPathPolymorphic:
7161+
helperMethod = IR::HelperOp_PatchPutValueNoLocalFastPathPolymorphicCheckLayout;
7162+
break;
7163+
case IR::HelperOp_PatchPutValueWithThisPtr:
7164+
helperMethod = IR::HelperOp_PatchPutValueWithThisPtrCheckLayout;
7165+
break;
7166+
case IR::HelperOp_PatchPutValueWithThisPtrPolymorphic:
7167+
helperMethod = IR::HelperOp_PatchPutValueWithThisPtrPolymorphicCheckLayout;
7168+
break;
7169+
case IR::HelperOp_PatchPutValueWithThisPtrNoLocalFastPath:
7170+
helperMethod = IR::HelperOp_PatchPutValueWithThisPtrNoLocalFastPathCheckLayout;
7171+
break;
7172+
case IR::HelperOp_PatchPutValueWithThisPtrNoLocalFastPathPolymorphic:
7173+
helperMethod = IR::HelperOp_PatchPutValueWithThisPtrNoLocalFastPathPolymorphicCheckLayout;
7174+
break;
7175+
case IR::HelperOp_PatchInitValue:
7176+
helperMethod = IR::HelperOp_PatchInitValueCheckLayout;
7177+
break;
7178+
case IR::HelperOp_PatchInitValuePolymorphic:
7179+
helperMethod = IR::HelperOp_PatchInitValuePolymorphicCheckLayout;
7180+
break;
7181+
default:
7182+
AssertOrFailFast(false);
7183+
break;
7184+
}
7185+
}
7186+
}
7187+
71377188
IR::Opnd * inlineCacheOpnd = nullptr;
71387189
if (withInlineCache)
71397190
{
@@ -7180,7 +7231,20 @@ Lowerer::LowerStFld(
71807231
}
71817232

71827233
IR::RegOpnd *opndBase = dst->AsSymOpnd()->CreatePropertyOwnerOpnd(m_func);
7183-
m_lowererMD.ChangeToHelperCall(stFldInstr, helperMethod, labelBailOut, opndBase, dst->AsSymOpnd()->IsPropertySymOpnd() ? dst->AsSymOpnd()->AsPropertySymOpnd() : nullptr, isHelper);
7234+
7235+
IR::Instr * callInstr =
7236+
m_lowererMD.ChangeToHelperCall(stFldInstr, helperMethod, labelBailOut, opndBase, propertySymOpnd, isHelper);
7237+
7238+
if (doCheckLayout)
7239+
{
7240+
callInstr->SetDst(IR::RegOpnd::New(TyUint8, bailOutInfo->bailOutFunc));
7241+
IR::Instr * bailOutInstr = IR::BailOutInstr::New(Js::OpCode::BailOnNotEqual, IR::BailOutFailedTypeCheck, bailOutInfo, bailOutInfo->bailOutFunc);
7242+
bailOutInstr->SetSrc1(callInstr->GetDst());
7243+
bailOutInstr->SetSrc2(IR::IntConstOpnd::New(0, TyUint8, bailOutInfo->bailOutFunc));
7244+
callInstr->InsertAfter(bailOutInstr);
7245+
bailOutInfo->polymorphicCacheIndex = propertySymOpnd->m_inlineCacheIndex;
7246+
LowerBailOnEqualOrNotEqual(bailOutInstr, nullptr, nullptr, nullptr, isHelper);
7247+
}
71847248

71857249
return instrPrev;
71867250
}
@@ -25565,6 +25629,8 @@ Lowerer::GenerateLdHomeObj(IR::Instr* instr)
2556525629

2556625630
IR::LabelInstr *labelDone = IR::LabelInstr::New(Js::OpCode::Label, func, false);
2556725631
IR::LabelInstr *testLabel = IR::LabelInstr::New(Js::OpCode::Label, func, false);
25632+
IR::LabelInstr *scriptFuncLabel = IR::LabelInstr::New(Js::OpCode::Label, func, false);
25633+
LABELNAMESET(scriptFuncLabel, "ScriptFunctionWithHomeObj");
2556825634
IR::Opnd *opndUndefAddress = this->LoadLibraryValueOpnd(instr, LibraryValue::ValueUndefined);
2556925635

2557025636
IR::RegOpnd *instanceRegOpnd = IR::RegOpnd::New(TyMachPtr, func);
@@ -25586,65 +25652,53 @@ Lowerer::GenerateLdHomeObj(IR::Instr* instr)
2558625652
if (func->GetJITFunctionBody()->HasHomeObj())
2558725653
{
2558825654
// Is this a generator function with home obj?
25655+
if (func->GetJITFunctionBody()->IsCoroutine())
2558925656
{
25590-
IR::LabelInstr* nextCaseLabel = IR::LabelInstr::New(Js::OpCode::Label, func, false);
25591-
LABELNAMESET(nextCaseLabel, "GeneratorFunctionWithHomeObjAndComputedName");
25592-
25593-
IR::Opnd* vtableAddressInlineFuncHomObjOpnd = this->LoadVTableValueOpnd(instr, VTableValue::VtableVirtualJavascriptGeneratorFunctionWithHomeObj);
25594-
IR::BranchInstr* inlineFuncHomObjOpndBr = InsertCompareBranch(IR::IndirOpnd::New(instanceRegOpnd, 0, TyMachPtr, func), vtableAddressInlineFuncHomObjOpnd, Js::OpCode::BrNeq_A, nextCaseLabel, instr);
25595-
InsertObjectPoison(instanceRegOpnd, inlineFuncHomObjOpndBr, instr, false);
25596-
IR::IndirOpnd* indirInlineFuncHomeObjOpnd = IR::IndirOpnd::New(instanceRegOpnd, Js::FunctionWithHomeObj<Js::GeneratorVirtualScriptFunction>::GetOffsetOfHomeObj(), TyMachPtr, func);
25597-
Lowerer::InsertMove(instanceRegOpnd, indirInlineFuncHomeObjOpnd, instr);
25598-
InsertBranch(Js::OpCode::Br, testLabel, instr);
25657+
uint32 homeObjectOffset = Js::FunctionWithHomeObj<Js::GeneratorVirtualScriptFunction>::GetOffsetOfHomeObj();
2559925658

25600-
instr->InsertBefore(nextCaseLabel);
25601-
}
25602-
25603-
// Is this a generator function with home obj and computed name?
25604-
{
25605-
IR::LabelInstr* nextCaseLabel = IR::LabelInstr::New(Js::OpCode::Label, func, false);
25606-
LABELNAMESET(nextCaseLabel, "FunctionWithInlineCacheAndHomeObj");
25607-
25608-
IR::Opnd* vtableAddressInlineFuncHomObjOpnd = this->LoadVTableValueOpnd(instr, VTableValue::VtableVirtualJavascriptGeneratorFunctionWithHomeObjAndComputedName);
25609-
IR::BranchInstr* inlineFuncHomObjOpndBr = InsertCompareBranch(IR::IndirOpnd::New(instanceRegOpnd, 0, TyMachPtr, func), vtableAddressInlineFuncHomObjOpnd, Js::OpCode::BrNeq_A, nextCaseLabel, instr);
25610-
InsertObjectPoison(instanceRegOpnd, inlineFuncHomObjOpndBr, instr, false);
25611-
IR::IndirOpnd* indirInlineFuncHomeObjOpnd = IR::IndirOpnd::New(instanceRegOpnd, Js::FunctionWithComputedName<Js::FunctionWithHomeObj<Js::GeneratorVirtualScriptFunction>>::GetOffsetOfHomeObj(), TyMachPtr, func);
25612-
Lowerer::InsertMove(instanceRegOpnd, indirInlineFuncHomeObjOpnd, instr);
25613-
InsertBranch(Js::OpCode::Br, testLabel, instr);
25614-
25615-
instr->InsertBefore(nextCaseLabel);
25616-
}
25659+
// Is this a generator function with home obj and computed name?
25660+
if (func->GetJITFunctionBody()->HasComputedName())
25661+
{
25662+
homeObjectOffset = Js::FunctionWithComputedName<Js::FunctionWithHomeObj<Js::GeneratorVirtualScriptFunction>>::GetOffsetOfHomeObj();
25663+
}
2561725664

25618-
// Is this an function with inline cache and home obj?
25619-
{
25620-
IR::LabelInstr* labelInlineFunc = IR::LabelInstr::New(Js::OpCode::Label, func, false);
25621-
LABELNAMESET(labelInlineFunc, "FunctionWithInlineCacheHomeObjAndComputedName");
25665+
{
25666+
IR::IndirOpnd* indirOpnd = IR::IndirOpnd::New(instanceRegOpnd, homeObjectOffset, TyMachPtr, func);
25667+
Lowerer::InsertMove(instanceRegOpnd, indirOpnd, instr);
25668+
}
2562225669

25623-
IR::Opnd* vtableAddressInlineFuncHomObjOpnd = this->LoadVTableValueOpnd(instr, VTableValue::VtableScriptFunctionWithInlineCacheAndHomeObj);
25624-
IR::BranchInstr* inlineFuncHomObjOpndBr = InsertCompareBranch(IR::IndirOpnd::New(instanceRegOpnd, 0, TyMachPtr, func), vtableAddressInlineFuncHomObjOpnd, Js::OpCode::BrNeq_A, labelInlineFunc, instr);
25625-
InsertObjectPoison(instanceRegOpnd, inlineFuncHomObjOpndBr, instr, false);
25626-
IR::IndirOpnd* indirInlineFuncHomeObjOpnd = IR::IndirOpnd::New(instanceRegOpnd, Js::FunctionWithHomeObj<Js::ScriptFunctionWithInlineCache>::GetOffsetOfHomeObj(), TyMachPtr, func);
25627-
Lowerer::InsertMove(instanceRegOpnd, indirInlineFuncHomeObjOpnd, instr);
2562825670
InsertBranch(Js::OpCode::Br, testLabel, instr);
25629-
25630-
instr->InsertBefore(labelInlineFunc);
2563125671
}
25632-
25633-
// Is this a function with inline cache, home obj and computed name?
25672+
else
2563425673
{
25635-
IR::LabelInstr* scriptFuncLabel = IR::LabelInstr::New(Js::OpCode::Label, func, false);
25636-
LABELNAMESET(scriptFuncLabel, "ScriptFunctionWithHomeObj");
25674+
IR::RegOpnd* funcObjHasInlineCachesOpnd = IR::RegOpnd::New(TyUint8, instr->m_func);
25675+
this->InsertMove(funcObjHasInlineCachesOpnd, IR::IndirOpnd::New(instanceRegOpnd, Js::ScriptFunction::GetOffsetOfHasInlineCaches(), TyUint8, instr->m_func), instr);
2563725676

25638-
IR::Opnd* vtableAddressInlineFuncHomObjCompNameOpnd = this->LoadVTableValueOpnd(instr, VTableValue::VtableScriptFunctionWithInlineCacheHomeObjAndComputedName);
25639-
IR::BranchInstr* inlineFuncHomObjCompNameBr = InsertCompareBranch(IR::IndirOpnd::New(instanceRegOpnd, 0, TyMachPtr, func), vtableAddressInlineFuncHomObjCompNameOpnd, Js::OpCode::BrNeq_A, scriptFuncLabel, instr);
25677+
IR::BranchInstr* inlineFuncHomObjCompNameBr = InsertTestBranch(funcObjHasInlineCachesOpnd, funcObjHasInlineCachesOpnd, Js::OpCode::BrEq_A, scriptFuncLabel, instr);
2564025678
InsertObjectPoison(instanceRegOpnd, inlineFuncHomObjCompNameBr, instr, false);
25641-
IR::IndirOpnd* indirInlineFuncHomeObjCompNameOpnd = IR::IndirOpnd::New(instanceRegOpnd, Js::FunctionWithComputedName<Js::FunctionWithHomeObj<Js::ScriptFunctionWithInlineCache>>::GetOffsetOfHomeObj(), TyMachPtr, func);
25642-
Lowerer::InsertMove(instanceRegOpnd, indirInlineFuncHomeObjCompNameOpnd, instr);
25643-
InsertBranch(Js::OpCode::Br, testLabel, instr);
2564425679

25645-
instr->InsertBefore(scriptFuncLabel);
25680+
if (func->GetJITFunctionBody()->HasComputedName())
25681+
{
25682+
// Is this a function with inline cache, home obj and computed name?
25683+
{
25684+
IR::IndirOpnd* indirInlineFuncHomeObjCompNameOpnd = IR::IndirOpnd::New(instanceRegOpnd, Js::FunctionWithComputedName<Js::FunctionWithHomeObj<Js::ScriptFunctionWithInlineCache>>::GetOffsetOfHomeObj(), TyMachPtr, func);
25685+
Lowerer::InsertMove(instanceRegOpnd, indirInlineFuncHomeObjCompNameOpnd, instr);
25686+
InsertBranch(Js::OpCode::Br, testLabel, instr);
25687+
}
25688+
}
25689+
else
25690+
{
25691+
// Is this a function with inline cache and home obj?
25692+
{
25693+
IR::IndirOpnd* indirInlineFuncHomeObjOpnd = IR::IndirOpnd::New(instanceRegOpnd, Js::FunctionWithHomeObj<Js::ScriptFunctionWithInlineCache>::GetOffsetOfHomeObj(), TyMachPtr, func);
25694+
Lowerer::InsertMove(instanceRegOpnd, indirInlineFuncHomeObjOpnd, instr);
25695+
InsertBranch(Js::OpCode::Br, testLabel, instr);
25696+
}
25697+
}
2564625698
}
2564725699

25700+
instr->InsertBefore(scriptFuncLabel);
25701+
2564825702
// All other cases
2564925703
{
2565025704
IR::IndirOpnd* indirOpnd = IR::IndirOpnd::New(instanceRegOpnd, Js::ScriptFunctionWithHomeObj::GetOffsetOfHomeObj(), TyMachPtr, func);

‎lib/Common/ChakraCoreVersion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
//-------------------------------------------------------------------------------------------------------
1+
no//-------------------------------------------------------------------------------------------------------
22
// Copyright (C) Microsoft. All rights reserved.
33
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
44
//-------------------------------------------------------------------------------------------------------

‎lib/Parser/Parse.cpp

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5410,6 +5410,12 @@ ParseNodeFnc * Parser::ParseFncDeclInternal(ushort flags, LPCOLESTR pNameHint, c
54105410
this->m_currentScope->SetHasNestedParamFunc();
54115411
}
54125412

5413+
if (this->m_currentScope && this->m_currentScope->GetScopeType() == ScopeType_Parameter)
5414+
{
5415+
pnodeFnc->SetIsDeclaredInParamScope();
5416+
this->m_currentScope->SetHasNestedParamFunc();
5417+
}
5418+
54135419
IdentPtr pFncNamePid = nullptr;
54145420
bool needScanRCurly = true;
54155421
ParseFncDeclHelper<buildAST>(pnodeFnc, pNameHint, flags, fUnaryOrParen, noStmtContext, &needScanRCurly, fModule, &pFncNamePid, fAllowIn);
@@ -8869,17 +8875,15 @@ ParseNodePtr Parser::ParseExpr(int oplMin,
88698875
// binding operator, be it unary or binary.
88708876
Error(ERRsyntax);
88718877
}
8872-
if (m_currentScope->GetScopeType() == ScopeType_Parameter
8873-
|| (m_currentScope->GetScopeType() == ScopeType_Block && m_currentScope->GetEnclosingScope()->GetScopeType() == ScopeType_Parameter)) // Check whether this is a class definition inside param scope
8878+
if(m_currentScope->AncestorScopeIsParameter()) // Yield is not allowed within any parameter scope
88748879
{
88758880
Error(ERRsyntax);
88768881
}
88778882
}
88788883
else if (nop == knopAwait)
88798884
{
88808885
if (!this->GetScanner()->AwaitIsKeywordRegion() ||
8881-
m_currentScope->GetScopeType() == ScopeType_Parameter ||
8882-
(m_currentScope->GetScopeType() == ScopeType_Block && m_currentScope->GetEnclosingScope()->GetScopeType() == ScopeType_Parameter)) // Check whether this is a class definition inside param scope
8886+
m_currentScope->AncestorScopeIsParameter()) // Await is not allowed within any parameter scope
88838887
{
88848888
// As with the 'yield' keyword, the case where 'await' is scanned as a keyword (tkAWAIT)
88858889
// but the scanner is not treating await as a keyword (!this->GetScanner()->AwaitIsKeyword())

0 commit comments

Comments
 (0)