Bug 179433

Summary:	ArrayPatternNode::bindValue() should close iterator if binding target value throws
Product:	WebKit	Reporter:	Caitlin Potter (:caitp) <caitp>
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	NEW ---
Severity:	Normal	CC:	caitp, gskachkov, saam
Priority:	P2
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Caitlin Potter (:caitp) 2017-11-08 11:09:30 PST

Here's a quick reproduction: https://jsfiddle.net/gke220do/

If an exception occurs when binding the destructuring target to an iterated value, IteratorClose must be called

Spec: https://tc39.github.io/ecma262/#sec-runtime-semantics-iteratordestructuringassignmentevaluation
  AssignmentElement : DestructuringAssignmentTarget Initializer (step 8.)
  AssignmentRestElement : ... DestructuringAssignmentTarget (step 5.a)
  
  https://tc39.github.io/ecma262/#_ref_9921 "If iteratorRecord.[[Done]] is false, return ? IteratorClose(iteratorRecord, result)."

Also applies to binding patterns.

A related bug:

The destructuring assignment target, if not a pattern, must be resolved/evaluated before performing IteratorNext. If resolving the destructuring target throws,
then the iterator must be closed (as above). This also applies to ObjectPatternNode, and is an error in order of evaluation.

Repro: https://jsfiddle.net/e33gpp77/

FireFox is the only browser I know gets this right, in limited testing.