From daf3b36ea66aae6d98b9cb426ddc33e1a5502a44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A9ter=20G=C3=A1l?= <pgal.u-szeged@partner.samsung.com>
Date: Thu, 16 Jan 2020 16:03:59 +0100
Subject: [PATCH] Fix new.target invalidity check (#3521)

Fixes #3519

Only check the assert if the new.target bytecode is detected.

JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.u-szeged@partner.samsung.com
---
 jerry-core/parser/js/js-parser-expr.c         | 14 ++++++-----
 .../es2015/regression-test-issue-3519.js      | 24 +++++++++++++++++++
 2 files changed, 32 insertions(+), 6 deletions(-)
 create mode 100644 tests/jerry/es2015/regression-test-issue-3519.js

diff --git a/jerry-core/parser/js/js-parser-expr.c b/jerry-core/parser/js/js-parser-expr.c
index 650afaae7..167cc0d42 100644
--- a/jerry-core/parser/js/js-parser-expr.c
+++ b/jerry-core/parser/js/js-parser-expr.c
@@ -119,16 +119,18 @@ parser_check_invalid_assign (parser_context_t *context_p) /**< context */
  */
 static void
 parser_check_invalid_new_target (parser_context_t *context_p, /**< parser context */
-                                     cbc_opcode_t opcode) /**< current opcode under parsing */
+                                 cbc_opcode_t opcode) /**< current opcode under parsing */
 {
-  JERRY_ASSERT ((opcode >= CBC_PRE_INCR && opcode <= CBC_POST_DECR)
-                || (opcode == CBC_ASSIGN
-                    && (context_p->token.type == LEXER_ASSIGN
-                        || LEXER_IS_BINARY_LVALUE_TOKEN (context_p->token.type))));
-
   /* new.target is an invalid left-hand side target */
   if (context_p->last_cbc_opcode == PARSER_TO_EXT_OPCODE (CBC_EXT_PUSH_NEW_TARGET))
   {
+    /* Make sure that the call side is a post/pre increment or an assignment expression.
+     * There should be no other ways the "new.target" expression should be here. */
+    JERRY_ASSERT ((opcode >= CBC_PRE_INCR && opcode <= CBC_POST_DECR)
+                  || (opcode == CBC_ASSIGN
+                      && (context_p->token.type == LEXER_ASSIGN
+                          || LEXER_IS_BINARY_LVALUE_TOKEN (context_p->token.type))));
+
     parser_raise_error (context_p, PARSER_ERR_NEW_TARGET_NOT_ALLOWED);
   }
 } /* parser_check_invalid_new_target */
diff --git a/tests/jerry/es2015/regression-test-issue-3519.js b/tests/jerry/es2015/regression-test-issue-3519.js
new file mode 100644
index 000000000..c51a7d80c
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-3519.js
@@ -0,0 +1,24 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+function method () {
+    [""] = $
+}
+
+try {
+  eval ("function mm () { [new.target] = 3; }");
+  assert (false);
+} catch (ex) {
+  assert (ex instanceof SyntaxError);
+}