[Webkit-unassigned] [Bug 179433] New: ArrayPatternNode::bindValue() should close iterator if binding target value throws

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=179433

            Bug ID: 179433
           Summary: ArrayPatternNode::bindValue() should close iterator if
                    binding target value throws
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: caitp at igalia.com

Here's a quick reproduction: https://jsfiddle.net/gke220do/

If an exception occurs when binding the destructuring target to an iterated value, IteratorClose must be called

Spec: https://tc39.github.io/ecma262/#sec-runtime-semantics-iteratordestructuringassignmentevaluation
  AssignmentElement : DestructuringAssignmentTarget Initializer (step 8.)
  AssignmentRestElement : ... DestructuringAssignmentTarget (step 5.a)

  https://tc39.github.io/ecma262/#_ref_9921 "If iteratorRecord.[[Done]] is false, return ? IteratorClose(iteratorRecord, result)."

Also applies to binding patterns.

A related bug:

The destructuring assignment target, if not a pattern, must be resolved/evaluated before performing IteratorNext. If resolving the destructuring target throws,
then the iterator must be closed (as above). This also applies to ObjectPatternNode, and is an error in order of evaluation.

Repro: https://jsfiddle.net/e33gpp77/

FireFox is the only browser I know gets this right, in limited testing.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171108/c548e5f0/attachment.html>