fix: reject new import.defer()/import.source() member access as SyntaxError#21211
Conversation
…Error ImportCall is a CallExpression per spec, so it cannot be the operand of `new`. acorn rejects bare `new import(...)`, but acorn-import-phases accepts `new import.defer(...)`/`new import.source(...)` and member access on them. The existing walkNewExpression guard only covered the bare callee; extend it to descend the leftmost callee chain to the base ImportExpression so `new import.defer(x).prop` is rejected too, while keeping parenthesized forms valid. Also bump test/test262-cases to de8e621 which adds the new no-new-call-expression-prop-access conformance tests.
🦋 Changeset detectedLatest commit: bc95046 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
This PR is packaged and the instant preview is available (bc95046). Install it locally:
npm i -D webpack@https://pkg.pr.new/webpack@bc95046
yarn add -D webpack@https://pkg.pr.new/webpack@bc95046
pnpm add -D webpack@https://pkg.pr.new/webpack@bc95046 |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #21211 +/- ##
=======================================
Coverage 92.74% 92.75%
=======================================
Files 591 591
Lines 64304 64308 +4
Branches 17863 17865 +2
=======================================
+ Hits 59641 59650 +9
+ Misses 4663 4658 -5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Merging this PR will not alter performance
|
| Mode | Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|---|
| ❌ | Memory | benchmark "side-effects-reexport", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}' |
129.6 KB | 850.8 KB | -84.77% |
| ❌ | Memory | benchmark "css-modules", scenario '{"name":"mode-production","mode":"production"}' |
6.6 MB | 9.1 MB | -27.38% |
| ❌ | Memory | benchmark "future-defaults", scenario '{"name":"mode-production","mode":"production"}' |
7 MB | 9.5 MB | -26.1% |
| ❌ | Memory | benchmark "many-modules-esm", scenario '{"name":"mode-production","mode":"production"}' |
8.4 MB | 10.6 MB | -20.71% |
| ⚡ | Memory | benchmark "lodash", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}' |
858.9 KB | 125.8 KB | ×6.8 |
| ⚡ | Memory | benchmark "wasm-modules-async", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}' |
347 KB | 189.9 KB | +82.73% |
| ⚡ | Memory | benchmark "wasm-modules-sync", scenario '{"name":"mode-production","mode":"production"}' |
7.7 MB | 6.4 MB | +20.81% |
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix/new-import-call-member-access (bc95046) with main (6e43ab8)
Summary
new import.defer('').propandnew import.source('').propare accepted by webpack's parser but areSyntaxErrors per spec —ImportCallis aCallExpression, so it cannot be anewoperand. The root cause is anacorn-import-phasesbug: itsparseExprImportoverride omits acorn core's!forNewguard, so phased dynamic imports are wrongly parsed asnewoperands (acorn core rejects barenew import(...)correctly). webpack already rejected the barenew import.defer('')form; this extends thewalkNewExpressionguard to descend the leftmost callee chain to the baseImportExpression, so property-access forms are rejected too, while parenthesized forms (new (import.defer('')).prop) stay valid. Also bumpstest/test262-casestode8e621, which adds the new conformance tests and was failing thetest262 (2/2)job. Supersedes #21161 and tracked by the follow-up issue for removing the workaround once upstream is fixed.What kind of change does this PR introduce?
fix
Did you add tests for your changes?
Yes — covered by the bumped test262 suite (
expressions/dynamic-import/syntax/invalid/*-no-new-call-expression-prop-access.js).Does this PR introduce a breaking change?
No.
If relevant, what needs to be documented once your changes are merged or what have you already documented?
n/a
Use of AI
AI (Claude) was used to investigate the failing test262 job, pinpoint the root cause in
acorn-import-phases, implement the parser guard, and draft this PR.Generated by Claude Code