JS AST: fix parsing of private identifier tokens, fix nesting error f…

…or fuzzing

js/ast_test.go

@@ -118,6 +118,7 @@ func TestJS(t *testing.T) {
 		{"{};;", "{} ;"},
 		{"{}\n;", "{} ;"},
 		{"- - --3", "- - --3;"},
+		{"new\n#c in z", ""},
 	}
 
 	re := regexp.MustCompile("\n *")

js/parse.go

@@ -1787,13 +1787,14 @@ func (p *Parser) parseExpression(prec OpPrec) IExpr {
 		p.in = prevIn
 	case PrivateIdentifierToken:
 		if OpCompare < prec || !p.in {
-			return left
+			p.fail("expression")
+			return nil
 		}
 		left = &LiteralExpr{p.tt, p.data}
 		p.next()
 		if p.tt != InToken {
 			p.fail("relational expression", InToken)
-			return left
+			return nil
 		}
 	default:
 		p.fail("expression")

tests/js-string/main.go

@@ -4,6 +4,7 @@ package fuzz
 
 import (
 	"fmt"
+	"strings"
 	"unicode/utf8"
 
 	"github.com/tdewolff/parse/v2"
@@ -22,7 +23,9 @@ func Fuzz(data []byte) int {
 		src := ast.JSString()
 		input2 := parse.NewInputString(src)
 		if ast2, err := js.Parse(input2, o); err != nil {
-			panic(err)
+			if !strings.HasPrefix(err.Error(), "too many nested expressions") {
+				panic(err)
+			}
 		} else if src2 := ast2.JSString(); src != src2 {
 			fmt.Println("JS1:", src)
 			fmt.Println("JS2:", src2)