lexer: step past unknown byte on TSyntaxError in next_inside_jsx_element

src/js_parser/p.rs

@@ -3641,8 +3641,13 @@ impl<'a, const TYPESCRIPT: bool, const SCAN_ONLY: bool> P<'a, TYPESCRIPT, SCAN_O
 
         if cfg!(debug_assertions) {
             // Enforce that scope locations are strictly increasing to help catch bugs
-            // where the pushed scopes are mismatched between the first and second passes
-            if !self.scopes_in_order.is_empty() {
+            // where the pushed scopes are mismatched between the first and second passes.
+            // Skip this check after an error has been logged: error recovery can legitimately
+            // cause `next()` to return a token at a position that was already consumed (e.g. a
+            // zero-length token produced after `TSyntaxError`), which makes the parser push
+            // multiple scopes at the same source offset. Release builds just report the error
+            // and recover, so the debug assertion should not be stricter than release.
+            if !self.log().has_errors() && !self.scopes_in_order.is_empty() {
                 let mut last_i = self.scopes_in_order.len() - 1;
                 while self.scopes_in_order[last_i].is_none() && last_i > 0 {
                     last_i -= 1;

test/regression/issue/jsx-template-string-crash.test.ts

@@ -28,3 +28,40 @@ test("JSX lexer should not crash with slice bounds issues", async () => {
   `);
   expect(normalizeBunSnapshot(stdout.toString())).toMatchInlineSnapshot(`""`);
 });
+
+test("#30959 JSX attribute with invalid '(' value parses cleanly in debug builds", async () => {
+  // Previously, parsing `<r L=((` in a debug build panicked with
+  // `Scope location must be greater than previous 6 must be greater than 6`
+  // in push_scope_for_parse_pass. The recovery path after
+  // `expect(TOpenBrace)` against a TSyntaxError lexer token caused two
+  // FunctionArgs scopes to be pushed at the same source offset.
+  //
+  // Release builds already reported the two parse errors and recovered;
+  // the debug assertion is now relaxed once an error has been logged so
+  // debug matches release. We assert the expected release-mode error
+  // messages instead of the absence of a panic, so the test fails cleanly
+  // both when the panic returns (exit code / hang) and when the error
+  // output regresses.
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "-e", "export function x(){return<r L=((}"],
+    env: bunEnv,
+    stderr: "pipe",
+    stdout: "pipe",
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  expect(normalizeBunSnapshot(stderr.toString().replace(/(Bun v.*)$/gm, ""))).toMatchInlineSnapshot(`
+    "1 | export function x(){return<r L=((}
+                                       ^
+    error: Expected "{" but found "("
+        at <cwd>/[eval]:1:32
+
+    1 | export function x(){return<r L=((}
+                                         ^
+    error: Unexpected }
+        at <cwd>/[eval]:1:34"
+  `);
+  expect(stdout).toBe("");
+  expect(exitCode).toBe(1);
+});