v8/test/mjsunit/regress/regress-crbug-791256.js
Marja Hölttä 10d9c31488 [parser] Fix NaryOperation positions.
If an initializer is a NaryOperation, its position ends up as a start position
of a Scope, and a DCHECK used to fire.

Interestingly, this was not caught by our existing tests.

BUG=chromium:791256

Change-Id: Id47f850c7ad17ca580352f9bd56c9567b485c3b8
Reviewed-on: https://chromium-review.googlesource.com/822093
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50051}
2017-12-12 18:54:03 +00:00

13 lines
443 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Original repro. A DCHECK used to fire.
(function* (name = (eval(foo), foo, prototype)) { });
// Simpler repro.
(function (name = (foo, bar, baz) ) { });
// A test which uses the value of the n-ary operation.
(function (param = (0, 1, 2)) { assertEquals(2, param); })();