[parser] Throw error when there are too many excluded properties

Check that number of properties < Code:kMaxArguments when object
destructuring with a rest property otherwise throw an error.

BUG=v8:5549

Review-Url: https://codereview.chromium.org/2650863002
Cr-Commit-Position: refs/heads/master@{#42613}

src/parsing/parser-base.h

@@ -2134,8 +2134,6 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParsePropertyName(
               scanner()->location(),
               MessageTemplate::kInvalidDestructuringTarget);
         } else {
-          // TODO(gsathya): Throw error if number of properties >
-          // Code::kMaxArguments
           CheckDestructuringElement(expression, pos,
                                     scanner()->location().end_pos);
         }
@@ -2595,6 +2593,16 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseObjectLiteral(
   // Computation of literal_index must happen before pre parse bailout.
   int literal_index = function_state_->NextMaterializedLiteralIndex();
 
+  // In pattern rewriter, we rewrite rest property to call out to a
+  // runtime function passing all the other properties as arguments to
+  // this runtime function. Here, we make sure that the number of
+  // properties is less than number of arguments allowed for a runtime
+  // call.
+  if (has_rest_property && properties->length() > Code::kMaxArguments) {
+    this->classifier()->RecordPatternError(Scanner::Location(pos, position()),
+                                           MessageTemplate::kTooManyArguments);
+  }
+
   return factory()->NewObjectLiteral(properties, literal_index,
                                      number_of_boilerplate_properties, pos,
                                      has_rest_property);

test/cctest/cctest.status

@@ -102,6 +102,7 @@
   'test-debug/CallFunctionInDebugger': [PASS, ['mode == debug', SLOW]],
   'test-strings/StringOOM*': [PASS, ['mode == debug', SKIP]],
   'test-serialize/CustomSnapshotDataBlobImmortalImmovableRoots': [PASS, ['mode == debug', SKIP]],
+  'test-parsing/ObjectRestNegativeTestSlow': [PASS, ['mode == debug', SKIP]],
 }],  # ALWAYS
 
 ##############################################################################

test/cctest/test-parsing.cc

@@ -6973,6 +6973,31 @@ TEST(DestructuringNegativeTests) {
   }
 }
 
+TEST(ObjectRestNegativeTestSlow) {
+  // clang-format off
+  const char* context_data[][2] = {
+    {"var { ", " } = { a: 1};"},
+    { NULL, NULL }
+  };
+
+  using v8::internal::Code;
+  std::string statement;
+  for (int i = 0; i < Code::kMaxArguments; ++i) {
+    statement += std::to_string(i) + " : " + "x, ";
+  }
+  statement += "...y";
+
+  const char* statement_data[] = {
+    statement.c_str(),
+    NULL
+  };
+
+  // clang-format on
+  // The test is quite slow, so run it with a reduced set of flags.
+  static const ParserFlag flags[] = {kAllowLazy, kAllowHarmonyObjectRestSpread};
+  RunParserSyncTest(context_data, statement_data, kError, NULL, 0, flags,
+                    arraysize(flags));
+}
 
 TEST(DestructuringAssignmentPositiveTests) {
   const char* context_data[][2] = {