Destructuring array without initializer throws an exception

Previously, cases like
  var [foo]
led to a parser crash because the parser tried to do something with
the initializer, which was not syntactically present.

This patch fixes the parser issue (implicitly creating an undefined
initializer) and inserts a check for array destructuring that the
right-hand side is coercible to an object, so it can have iterator
methods called on it safely.

BUG=v8:4462
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1384413002

Cr-Commit-Position: refs/heads/master@{#31128}

src/pattern-rewriter.cc

@@ -244,8 +244,13 @@ void Parser::PatternRewriter::VisitObjectLiteral(ObjectLiteral* pattern) {
 
 
 void Parser::PatternRewriter::VisitArrayLiteral(ArrayLiteral* node) {
-  auto iterator = CreateTempVar(
-      descriptor_->parser->GetIterator(current_value_, factory()));
+  auto temp = CreateTempVar(current_value_);
+
+  block_->statements()->Add(descriptor_->parser->BuildAssertIsCoercible(temp),
+                            zone());
+
+  auto iterator = CreateTempVar(descriptor_->parser->GetIterator(
+      factory()->NewVariableProxy(temp), factory()));
   auto done = CreateTempVar(
       factory()->NewBooleanLiteral(false, RelocInfo::kNoPosition));
   auto result = CreateTempVar();

test/cctest/test-parsing.cc

@@ -7179,13 +7179,11 @@ TEST(LetSloppyOnly) {
     "for (var [let] = 1; let < 1; let++) {}",
     "for (var [let] in {}) {}",
     "var let",
-    // Unrelated parser crash BUG(v8:4462)
-    // "var [let]",
+    "var [let]",
     "for (const let = 1; let < 1; let++) {}",
     "for (const let in {}) {}",
     "for (const [let] = 1; let < 1; let++) {}",
-    // Unrelated parser crash BUG(v8:4461)
-    // "for (const [let] in {}) {}",
+    "for (const [let] in {}) {}",
     "const let",
     "const [let]",
     NULL

test/mjsunit/harmony/destructuring.js

@@ -1103,3 +1103,7 @@
   for (const {foo} of [{foo: 1}]) { result = foo; }
   assertEquals(1, result);
 })();
+
+(function TestDestructuringArrayWithoutInitializer() {
+  assertThrows('var [foo]', TypeError);
+})();