1 files changed, 21 insertions, 4 deletions

diff --git a/js/src/frontend/SyntaxParseHandler.h b/js/src/frontend/SyntaxParseHandler.h
index aa06eaa246..fa63b1e9d3 100644
--- a/js/src/frontend/SyntaxParseHandler.h
+++ b/js/src/frontend/SyntaxParseHandler.h
@@ -57,8 +57,9 @@ enum SyntaxParseHandlerNode {
   // casing.
   NodeName,
 
-  // Nodes representing the names "arguments" and "eval".
+  // Nodes representing the names "arguments", "length" and "eval".
   NodeArgumentsName,
+  NodeLengthName,
   NodeEvalName,
 
   // Node representing the "async" name, which may actually be a
@@ -77,6 +78,10 @@ enum SyntaxParseHandlerNode {
   NodePrivateMemberAccess,
   NodeOptionalPrivateMemberAccess,
 
+  // Node representing the compound Arguments.length expression;
+  // Used only for property access, not assignment.
+  NodeArgumentsLength,
+
   // Destructuring target patterns can't be parenthesized: |([a]) = [3];|
   // must be a syntax error.  (We can't use NodeGeneric instead of these
   // because that would trigger invalid-left-hand-side ReferenceError
@@ -164,7 +169,7 @@ class SyntaxParseHandler {
 
   bool isPropertyOrPrivateMemberAccess(Node node) {
     return node == NodeDottedProperty || node == NodeElement ||
-           node == NodePrivateMemberAccess;
+           node == NodePrivateMemberAccess || node == NodeArgumentsLength;
   }
 
   bool isOptionalPropertyOrPrivateMemberAccess(Node node) {
@@ -572,6 +577,9 @@ class SyntaxParseHandler {
   NameNodeResult newPropertyName(TaggedParserAtomIndex name,
                                  const TokenPos& pos) {
     lastAtom = name;
+    if (name == TaggedParserAtomIndex::WellKnown::length()) {
+      return NodeLengthName;
+    }
     return NodeGeneric;
   }
 
@@ -579,6 +587,10 @@ class SyntaxParseHandler {
     return NodeDottedProperty;
   }
 
+  PropertyAccessResult newArgumentsLength(Node expr, NameNodeType key) {
+    return NodeArgumentsLength;
+  }
+
   PropertyAccessResult newOptionalPropertyAccess(Node expr, NameNodeType key) {
     return NodeOptionalDottedProperty;
   }
@@ -777,13 +789,17 @@ class SyntaxParseHandler {
 
   bool isName(Node node) {
     return node == NodeName || node == NodeArgumentsName ||
-           node == NodeEvalName || node == NodePotentialAsyncKeyword;
+           node == NodeLengthName || node == NodeEvalName ||
+           node == NodePotentialAsyncKeyword;
   }
 
   bool isArgumentsName(Node node) { return node == NodeArgumentsName; }
+  bool isLengthName(Node node) { return node == NodeLengthName; }
   bool isEvalName(Node node) { return node == NodeEvalName; }
   bool isAsyncKeyword(Node node) { return node == NodePotentialAsyncKeyword; }
 
+  bool isArgumentsLength(Node node) { return node == NodeArgumentsLength; }
+
   bool isPrivateName(Node node) { return node == NodePrivateName; }
   bool isPrivateMemberAccess(Node node) {
     return node == NodePrivateMemberAccess;
@@ -795,7 +811,8 @@ class SyntaxParseHandler {
     // |this|.  It's not really eligible for the funapply/funcall
     // optimizations as they're currently implemented (assuming a single
     // value is used for both retrieval and |this|).
-    if (node != NodeDottedProperty && node != NodeOptionalDottedProperty) {
+    if (node != NodeDottedProperty && node != NodeOptionalDottedProperty &&
+        node != NodeArgumentsLength) {
       return TaggedParserAtomIndex::null();
     }
     return lastAtom;