172005 2017-05-11 18:08:48 -0700 This crashes object rest parameter 2017-05-16 10:50:13 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 172147 InRadar P2 Normal --- 1 saam mark.lam benjamin fpizlo ggaren gskachkov jfbastien keith_miller mark.lam msaboff oliver ticaiolima webkit-bug-importer ysuzuki oldest_to_newest 1307652 0 saam 2017-05-11 18:08:48 -0700 >>> let a = "foo"; undefined >>> let {[a]:b, ...rest} = {foo:20, baz:40} Segmentation fault: 11 1307653 1 webkit-bug-importer 2017-05-11 18:09:16 -0700 <rdar://problem/32147443> 1307917 2 ticaiolima 2017-05-12 10:18:09 -0700 If it's ok to you, I can look this bug tonight. 1307921 3 mark.lam 2017-05-12 10:23:55 -0700 (In reply to Caio Lima from comment #2) > If it's ok to you, I can look this bug tonight. Hi Caio, I'm already looking into this. But feel free to look and contribute if you like. 1308256 4 ticaiolima 2017-05-12 20:47:52 -0700 (In reply to Mark Lam from comment #3) > (In reply to Caio Lima from comment #2) > > If it's ok to you, I can look this bug tonight. > > Hi Caio, I'm already looking into this. But feel free to look and > contribute if you like. I just looked at it and figured out the problem. I changed ObjectPatternNode::bindValue to add target.propertyName into excluded set and this code consider's that always we have a propertyName, which isn't true and I didn't think in this edge case. FYI, the excludedSet in https://github.com/caiolima/webkit/blob/master/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp#L4070 is used to collect statically the identifiers that should be excluded from the rest destructuring. We then use this set to create a JSSet in constant pool at link time in https://github.com/caiolima/webkit/blob/master/Source/JavaScriptCore/bytecode/CodeBlock.cpp#L870 This approach isn't valid for this case because the property will just be evaluated in runtime and we can't populate excludedSet in compile time here. Does it make sense? One solution I have in mind to handle this specific case is to emit code to populate the identifier/value into excludedSet dynamically, like the first patch version of https://bugs.webkit.org/show_bug.cgi?id=167962 1309184 5 mark.lam 2017-05-16 10:50:13 -0700 The offending patch came from r213697 due to https://bugs.webkit.org/show_bug.cgi?id=167962, ... and was rolled out in r216891: <http://trac.webkit.org/r216891> due to https://bugs.webkit.org/show_bug.cgi?id=172147. Hence, this specific issue is no more. Let's fix the rest destructuring implementation in https://bugs.webkit.org/show_bug.cgi?id=167962. Closing this one as a dupe of 172147. *** This bug has been marked as a duplicate of bug 172147 ***