Fix bug with nested spreads as patterns

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:5337
LOG=N

Review-Url: https://codereview.chromium.org/2297303003
Cr-Commit-Position: refs/heads/master@{#39118}

src/parsing/pattern-rewriter.cc

@@ -261,12 +261,14 @@ Variable* Parser::PatternRewriter::CreateTempVar(Expression* value) {
 void Parser::PatternRewriter::VisitRewritableExpression(
     RewritableExpression* node) {
   // If this is not a destructuring assignment...
-  if (!IsAssignmentContext() || !node->expression()->IsAssignment()) {
+  if (!IsAssignmentContext()) {
     // Mark the node as rewritten to prevent redundant rewriting, and
     // perform BindingPattern rewriting
     DCHECK(!node->is_rewritten());
     node->Rewrite(node->expression());
     return Visit(node->expression());
+  } else if (!node->expression()->IsAssignment()) {
+    return Visit(node->expression());
   }
 
   if (node->is_rewritten()) return;

test/mjsunit/es6/regress/regress-5337.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testNestedSpreadsInPatterns() {
+  (function () {
+    var [...[...x]] = [42, 17];
+    assertArrayEquals([42, 17], x);
+  })();
+  (function () {
+    let [...[...x]] = [42, 17];
+    assertArrayEquals([42, 17], x);
+  })();
+  (function () {
+    const [...[...x]] = [42, 17];
+    assertArrayEquals([42, 17], x);
+  })();
+  (function () {
+    var x; [...[...x]] = [42, 17];
+    assertArrayEquals([42, 17], x);
+  })();
+
+  function f1([...[...x]] = [42, 17]) { return x; }
+  assertArrayEquals([42, 17], f1());
+  assertArrayEquals([1, 2, 3], f1([1, 2, 3]));
+
+  var f2 = function ([...[...x]] = [42, 17]) { return x; }
+  assertArrayEquals([42, 17], f2());
+  assertArrayEquals([1, 2, 3], f2([1, 2, 3]));
+
+  // The following two were failing in debug mode, until v8:5337 was fixed.
+  var f3 = ([...[...x]] = [42, 17]) => { return x; };
+  assertArrayEquals([42, 17], f3());
+  assertArrayEquals([1, 2, 3], f3([1, 2, 3]));
+
+  var f4 = ([...[...x]] = [42, 17]) => x;
+  assertArrayEquals([42, 17], f4());
+  assertArrayEquals([1, 2, 3], f4([1, 2, 3]));
+})();