Bug 1302994 - Precautionarily peek at the next token after the AssignmentExpression in a for-loop head's declaration, when searching for a for(;;)'s first semicolon, in case the init-component ends in a lazy inner function that, when skipped during full-parsing, clears lookahead. r=arai

--HG--
extra : rebase_source : e068b91e1529b53f89124679b057b18e27a1433c

js/src/frontend/Parser.cpp

@@ -4162,6 +4162,19 @@ Parser<ParseHandler>::initializerInNameDeclaration(Node decl, Node binding,
             *forHeadKind = PNK_FORHEAD;
         } else {
             MOZ_ASSERT(*forHeadKind == PNK_FORHEAD);
+
+            // In the very rare case of Parser::assignExpr consuming an
+            // ArrowFunction with block body, when full-parsing with the arrow
+            // function being a skipped lazy inner function, we don't have
+            // lookahead for the next token.  Do a one-off peek here to be
+            // consistent with what Parser::matchForInOrOf does in the other
+            // arm of this |if|.
+            //
+            // If you think this all sounds pretty code-smelly, you're almost
+            // certainly correct.
+            TokenKind ignored;
+            if (!tokenStream.peekToken(&ignored))
+                return false;
         }
 
         // Per Parser::forHeadStart, the semicolon in |for (;| is ultimately

js/src/tests/ecma_6/Statements/arrow-function-at-end-of-for-statement-head.js

@@ -0,0 +1,64 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+//-----------------------------------------------------------------------------
+var gTestfile = "arrow-function-in-for-statement-head.js";
+var BUGNUMBER = 1302994;
+var summary =
+  "Don't assert when an arrow function occurs at the end of a declaration " +
+  "init-component of a for(;;) loop head";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+function f1()
+{
+  for (var x = a => b; false; false)
+  {}
+}
+f1();
+
+function f2()
+{
+  for (var x = a => b, y = c => d; false; false)
+  {}
+}
+f2();
+
+function f3()
+{
+  for (var x = a => {}; false; false)
+  {}
+}
+f3();
+
+function f4()
+{
+  for (var x = a => {}, y = b => {}; false; false)
+  {}
+}
+f4();
+
+function g1()
+{
+  for (a => b; false; false)
+  {}
+}
+g1();
+
+function g2()
+{
+  for (a => {}; false; false)
+  {}
+}
+g2();
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");