From 52bdb8f2465cfb83a4b9e393ae6173e209750505 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= Date: Sat, 25 Mar 2017 14:45:38 +0100 Subject: [PATCH] deps: backport 2cabc86 from upstream V8 Original commit message: Fix classifier related bug R=adamk@chromium.org BUG=chromium:621111 LOG=N Review-Url: https://codereview.chromium.org/2086513002 Cr-Commit-Position: refs/heads/master@{#37150} Fixes: https://github.com/nodejs/node/issues/11977 PR-URL: https://github.com/nodejs/node/pull/12037 Reviewed-By: Ben Noordhuis Reviewed-By: Myles Borins --- deps/v8/include/v8-version.h | 2 +- deps/v8/src/parsing/parser-base.h | 13 ++++++++----- .../mjsunit/harmony/regress/regress-crbug-621111.js | 6 ++++++ 3 files changed, 15 insertions(+), 6 deletions(-) create mode 100644 deps/v8/test/mjsunit/harmony/regress/regress-crbug-621111.js diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h index 4dcb3e5734..d6df3c2e93 100644 --- a/deps/v8/include/v8-version.h +++ b/deps/v8/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 5 #define V8_MINOR_VERSION 1 #define V8_BUILD_NUMBER 281 -#define V8_PATCH_LEVEL 95 +#define V8_PATCH_LEVEL 96 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h index 0eb19ceb83..d4cc399457 100644 --- a/deps/v8/src/parsing/parser-base.h +++ b/deps/v8/src/parsing/parser-base.h @@ -1400,11 +1400,14 @@ typename ParserBase::ExpressionT ParserBase::ParseExpression( // AssignmentExpression // Expression ',' AssignmentExpression - ExpressionClassifier binding_classifier(this); - ExpressionT result = - this->ParseAssignmentExpression(accept_IN, &binding_classifier, CHECK_OK); - classifier->Accumulate(&binding_classifier, - ExpressionClassifier::AllProductions); + ExpressionT result = this->EmptyExpression(); + { + ExpressionClassifier binding_classifier(this); + result = this->ParseAssignmentExpression(accept_IN, &binding_classifier, + CHECK_OK); + classifier->Accumulate(&binding_classifier, + ExpressionClassifier::AllProductions); + } bool is_simple_parameter_list = this->IsIdentifier(result); bool seen_rest = false; while (peek() == Token::COMMA) { diff --git a/deps/v8/test/mjsunit/harmony/regress/regress-crbug-621111.js b/deps/v8/test/mjsunit/harmony/regress/regress-crbug-621111.js new file mode 100644 index 0000000000..58a0d5ce3f --- /dev/null +++ b/deps/v8/test/mjsunit/harmony/regress/regress-crbug-621111.js @@ -0,0 +1,6 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +(y = 1[1, [...[]]]) => 1; // will core dump, if not fixed +(y = 1[1, [...[]]]) => {}; // will core dump, if not fixed