Don't crash when preparsing destructured arguments
authoradamk <adamk@chromium.org>
Tue, 22 Sep 2015 17:43:26 +0000 (10:43 -0700)
committerCommit bot <commit-bot@chromium.org>
Tue, 22 Sep 2015 17:43:43 +0000 (17:43 +0000)
commit7485da7ace55cf4318f0a3a02a54fed04bed2a7a
treea758ec3145a1d21d9e683dd8228f42e918b4da36
parent24ec2a0baae57dc9f6e1dfce7c5bdf30ea8c791d
Don't crash when preparsing destructured arguments

This adds the materialized literal count accumulated while parsing the
parameters (in the parser proper) to that accumulated by the preparser.

This should have been caught in cctest/test-parsing, but it's not covered
because the parsing tests call directly into the preparser rather than
using Parser::ParseFunctionLiteral (which fully-parses the parameters
and then calls into the preparser to skip over the function body).

Note that this further-inflates the materialized literal count for
functions with destructured arguments, since some of the counted
literals are actually binding patterns. But that's not specific to
binding patterns in formal parameters: it happens in function bodies, too.

BUG=v8:4400,v8:4407
LOG=n

Review URL: https://codereview.chromium.org/1350913005

Cr-Commit-Position: refs/heads/master@{#30868}
src/parser.cc
test/mjsunit/harmony/regress/regress-4400.js [new file with mode: 0644]