Trying to understand what accounts for "\8" and "\9" being considered valid string literals with identity escapes in Chrome and FF.
Annex B permits sloppy mode to include legacy octal escapes in strings. It achieves this by replacing the ‘normal’ (strict) EscapeSequence production with a new version accompanied by three new productions.
- Strict: https://tc39.es/ecma262/#prod-EscapeSequence
- Sloppy: https://tc39.es/ecma262/#prod-annexB-EscapeSequence
In the sloppy version, three of the alternatives are the same. The change is replacing this rule:
"0" [lookahead ∉ DecimalDigit]
With this one:
LegacyOctalEscapeSequence
The firsts set of LegacyOctalEscapeSequence is { "0", "1", "2", "3", "4", "5", "6", "7" }. So it doesn’t introduce anything that would accept "\8" or "\9". Identity escapes are handled through CharacterEscapeSequence > NonEscapeCharacter, which is seemingly unchanged:
SourceCharacterbut not one of EscapeCharacter or LineTerminator
where EscapeCharacter is:
SingleEscapeCharacter
DecimalDigit
"x"
"u"
In other words, DecimalDigit is explicitly ruled out here — and it takes 8 and 9 with it. Also FWIW there’s this note:
A conforming implementation, when processing strict mode code, must not extend the syntax of EscapeSequence to include LegacyOctalEscapeSequence as described in B.1.2.
At first I assumed an allowance for "\8" and "\9" must live somewhere in Annex B and that I was just missing it. Then I realized Chrome and FF consider them valid identity escapes even in strict mode. I’m unsure now if this is a spec/web divergence or what.