[destructuring] don't attempt to visit contents of FunctionLiterals

caitp · Commit bot · commit f60048c55637 · 2016-04-05T18:43:17.000Z
The parser eagerly rewrites destructuring assignments occuring in formal parameter initializers, because not doing so would cause the BindingPattern rewriting to be confused and do the wrong thing. This change prevents this rewriting from descending into the bodies of lazily parsed functions. In general, it's a mistake to descend into the bodies of function literals anyways, since they are rewritten separately on their own time, so there is no distinction made between lazily "throw away" eagerly parsed functions in the temporary parser arena, or "real" eagerly parsed functions that will be compiled. BUG=chromium:594084, v8:811 LOG=N R=adamk@chromium.org, littledan@chromium.org Review URL: https://codereview.chromium.org/1864553002 Cr-Commit-Position: refs/heads/master@{#35277}
diff --git a/src/parsing/parser.cc b/src/parsing/parser.cc
@@ -4394,14 +4394,18 @@ class InitializerRewriter : public AstExpressionVisitor {
         scope_(scope) {}
 
  private:
-  void VisitExpression(Expression* expr) {
+  void VisitExpression(Expression* expr) override {
     RewritableExpression* to_rewrite = expr->AsRewritableExpression();
     if (to_rewrite == nullptr || to_rewrite->is_rewritten()) return;
 
     Parser::PatternRewriter::RewriteDestructuringAssignment(parser_, to_rewrite,
                                                             scope_);
   }
 
+  // Code in function literals does not need to be eagerly rewritten, it will be
+  // rewritten when scheduled.
+  void VisitFunctionLiteral(FunctionLiteral* expr) override {}
+
  private:
   Parser* parser_;
   Scope* scope_;
diff --git a/test/mjsunit/es6/regress/regress-594084.js b/test/mjsunit/es6/regress/regress-594084.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --lazy --min-preparse-length=0
+(function() {
+  function CRASH(defaultParameter =
+      (function() { function functionDeclaration() { return 0; } }())) {
+  }
+})();
