Merged: Don't skip hole checks inside patterns in parameter lists

ajklein · ajklein · commit 75cee5e465d6 · 2016-10-14T18:46:31.000Z
Revision: 3c39bac BUG=v8:5454 NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true TBR=hablich@chromium.org Review URL: https://codereview.chromium.org/2423503002 . Cr-Commit-Position: refs/branch-heads/5.4@{#61} Cr-Branched-From: 5ce2827-refs/heads/5.4.500@{#2} Cr-Branched-From: ad07b49-refs/heads/master@{#38841}
diff --git a/src/parsing/parser.cc b/src/parsing/parser.cc
@@ -4506,9 +4506,6 @@ Block* Parser::BuildParameterInitializationBlock(
     // TODO(adamk): Should this be kNoSourcePosition, since
     // it's just copying from a temp var to the real param var?
     descriptor.initialization_pos = parameter.pattern->position();
-    // The initializer position which will end up in,
-    // Variable::initializer_position(), used for hole check elimination.
-    int initializer_position = parameter.pattern->position();
     Expression* initial_value =
         factory()->NewVariableProxy(parameters.scope->parameter(i));
     if (parameter.initializer != nullptr) {
@@ -4524,7 +4521,6 @@ Block* Parser::BuildParameterInitializationBlock(
       initial_value = factory()->NewConditional(
           condition, parameter.initializer, initial_value, kNoSourcePosition);
       descriptor.initialization_pos = parameter.initializer->position();
-      initializer_position = parameter.initializer_end_position;
     }
 
     Scope* param_scope = scope();
@@ -4547,7 +4543,7 @@ Block* Parser::BuildParameterInitializationBlock(
 
     BlockState block_state(&scope_state_, param_scope);
     DeclarationParsingResult::Declaration decl(
-        parameter.pattern, initializer_position, initial_value);
+        parameter.pattern, parameter.initializer_end_position, initial_value);
     PatternRewriter::DeclareAndInitializeVariables(param_block, &descriptor,
                                                    &decl, nullptr, CHECK_OK);
 
diff --git a/test/mjsunit/regress/regress-5454.js b/test/mjsunit/regress/regress-5454.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function(...[b = !b]) { }, ReferenceError);
+assertThrows(() => (function([b = !b]) { })([]), ReferenceError);
+assertThrows(() => (function({b = !b}) { })({}), ReferenceError);
+
+assertThrows((...[b = !b]) => { }, ReferenceError);
+assertThrows(() => (([b = !b]) => { })([]), ReferenceError);
+assertThrows(() => (({b = !b}) => { })({}), ReferenceError);
