JS: Allow await/yield as property names - #22518
Closed
redsun82 wants to merge 3 commits into
Closed
Conversation
`parseIdent` guarded the reserved-word check with `!liberal` but the `yield`/`await` checks only with `!isPrivateField`, so property names such as `pool.await()` were rejected inside an `async` function. Acorn runs both from `checkUnreserved`, which only fires when `!liberal`. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Liberal parsing also covers decorator references, unintentionally allowing restricted bare identifiers there.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 1
New issues introduced by this change (2)
| Severity | Finding |
|---|---|
 |
javascript/extractor/src/com/semmle/jcorn/Parser.java — liberal is not limited to property names: ESNextParser.parseDecoratorBody passes true when… |
 |
javascript/extractor/src/com/semmle/jcorn/Parser.java — The implication here is reversed: isPrivateField requires liberal, but ordinary liberal… |
What changed in this PR
Fixes the JavaScript extractor to allow await and yield as property names while retaining identifier restrictions.
Changes:
- Updates
parseIdenthandling. - Adds parser and end-to-end regression tests.
- Documents the fix.
| File | Description |
|---|---|
javascript/ql/lib/change-notes/2026-09-07-await-property.md |
Records the parser fix. |
javascript/extractor/tests/es2017/input/await-yield-property.js |
Adds extraction input coverage. |
javascript/extractor/tests/es2017/output/trap/await-yield-property.js.trap |
Pins expected extraction output. |
javascript/extractor/test/com/semmle/js/extractor/test/AwaitYieldIdentifierTests.java |
Tests accepted properties and rejected identifiers. |
javascript/extractor/test/com/semmle/js/extractor/test/AllTests.java |
Registers the new test class. |
javascript/extractor/src/com/semmle/jcorn/Parser.java |
Relaxes contextual-keyword validation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+2301
to
+2303
| if (!liberal && this.inGenerator && this.value.equals("yield")) | ||
| this.raiseRecoverable(this.start, "Can not use 'yield' as identifier inside a generator"); | ||
| if (!isPrivateField && this.inAsync && this.value.equals("await")) | ||
| if (!liberal && this.inAsync && this.value.equals("await")) |
Comment on lines
+2299
to
+2300
| // `yield` and `await` are only restricted as bindings and references, not as property | ||
| // names, which is what `liberal` indicates (it also implies `isPrivateField`). |
Contributor
Author
|
already fixed in #22500 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
awaitis a perfectly valid property name, even inside anasyncfunction, but the JavaScript extractor rejectedpool.await()withCan not use 'await' as identifier inside an async function, aborting extraction of the whole file. The same applied toyieldinside a generator.In
jcorn'sparseIdent, the reserved-word check is guarded by!liberal, but theyield/awaitchecks were only guarded by!isPrivateField.liberalis exactly the "this is a property name, not a binding" flag, passed by member-expression parsing and byparsePropertyName, so property names, object literal keys and class method names all wrongly triggered the error. Upstream acorn runs both checks fromcheckUnreserved, which only fires when!liberal; this change aligns with that. Shorthand properties ({ await }) are rejected by a separate check inparseProperty, so they still error correctly.Tests:
AwaitYieldIdentifierTestscovers the accepted property-name forms and the still-rejected binding/reference forms.extractor/tests/es2017/await-yield-property.jspins the extraction end to end. Verified it is a real regression test: with the fix reverted, the trap golden loses the whole AST and keeps only tokens, andTrapTestsfails.Fixes: #22499