Don't crash when preparsing destructured arguments

src/parser.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/parser.h"
 
 #include "src/api.h"
 #include "src/ast.h"
 #include "src/ast-literal-reindexer.h"
 #include "src/bailout-reason.h"
@@ skipping 4182 matching lines @@
       Scanner::BookmarkScope* maybe_bookmark =
           bookmark.Set() ? &bookmark : nullptr;
       SkipLazyFunctionBody(&materialized_literal_count,
                            &expected_property_count, /*CHECK_OK*/ ok,
                            maybe_bookmark);
 
       if (formals.materialized_literals_count > 0) {
         materialized_literal_count += formals.materialized_literals_count;
       }
 
+      if (function_state.materialized_literal_count() > 0) {

[caitp (gmail), 2015/09/18 21:30:08]

FunctionState's materialized_literal_count() never returns less than 0, so it
should be okay to get rid of the if block.

[caitp (gmail), 2015/09/18 21:38:16]

In fact, this seems to be true for FormalParameters too, so maybe both the
conditional checks should be taken out?

[adamk, 2015/09/18 23:23:03]

Sounds good, combined into a single statement.

+        materialized_literal_count +=
+            function_state.materialized_literal_count();
+      }
+
       if (bookmark.HasBeenReset()) {
         // Trigger eager (re-)parsing, just below this block.
         is_lazily_parsed = false;
 
         // This is probably an initialization function. Inform the compiler it
         // should also eager-compile this function, and that we expect it to be
         // used once.
         eager_compile_hint = FunctionLiteral::kShouldEagerCompile;
         should_be_used_once_hint = true;
       }
@@ skipping 2031 matching lines @@
 
 Expression* Parser::SpreadCallNew(Expression* function,
                                   ZoneList<v8::internal::Expression*>* args,
                                   int pos) {
   args->InsertAt(0, function, zone());
 
   return factory()->NewCallRuntime(Context::REFLECT_CONSTRUCT_INDEX, args, pos);
 }
 }  // namespace internal
 }  // namespace v8