From 31be31c228399ab794090bc27846533cc3331235 Mon Sep 17 00:00:00 2001
From: Tooru Fujisawa <arai_a@mac.com>
Date: Fri, 23 Jan 2015 19:21:41 +0900
Subject: [PATCH] Bug 1096376 - Disallow duplicated parameter when rest
 parameter is present in non-strict mode. r=jorendorff

---
 js/src/frontend/Parser.cpp                      | 10 +++++++++-
 .../ecma_6/Function/rest-has-duplicated.js      | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 js/src/tests/ecma_6/Function/rest-has-duplicated.js

diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index a57ae2464813..099512ef37a9 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -1626,6 +1626,7 @@ Parser<ParseHandler>::functionArguments(FunctionSyntaxKind kind, FunctionType ty
         bool hasDefaults = false;
         Node duplicatedArg = null();
         Node list = null();
+        bool disallowDuplicateArgs = false;
 
         if (type == Getter) {
             report(ParseError, false, null(), JSMSG_ACCESSOR_WRONG_ARGS, "getter", "no", "s");
@@ -1647,6 +1648,7 @@ Parser<ParseHandler>::functionArguments(FunctionSyntaxKind kind, FunctionType ty
               case TOK_LC:
               {
                 /* See comment below in the TOK_NAME case. */
+                disallowDuplicateArgs = true;
                 if (duplicatedArg) {
                     report(ParseError, false, duplicatedArg, JSMSG_BAD_DUP_ARGS);
                     return false;
@@ -1719,6 +1721,12 @@ Parser<ParseHandler>::functionArguments(FunctionSyntaxKind kind, FunctionType ty
                     report(ParseError, false, null(), JSMSG_NO_REST_NAME);
                     return false;
                 }
+                disallowDuplicateArgs = true;
+                if (duplicatedArg) {
+                    // Has duplicated args before the rest parameter.
+                    report(ParseError, false, duplicatedArg, JSMSG_BAD_DUP_ARGS);
+                    return false;
+                }
                 goto TOK_NAME;
               }
 
@@ -1729,7 +1737,6 @@ Parser<ParseHandler>::functionArguments(FunctionSyntaxKind kind, FunctionType ty
                     funbox->setStart(tokenStream);
 
                 RootedPropertyName name(context, tokenStream.currentName());
-                bool disallowDuplicateArgs = funbox->hasDestructuringArgs || hasDefaults;
                 if (!defineArg(funcpn, name, disallowDuplicateArgs, &duplicatedArg))
                     return false;
 
@@ -1747,6 +1754,7 @@ Parser<ParseHandler>::functionArguments(FunctionSyntaxKind kind, FunctionType ty
                         report(ParseError, false, null(), JSMSG_REST_WITH_DEFAULT);
                         return false;
                     }
+                    disallowDuplicateArgs = true;
                     if (duplicatedArg) {
                         report(ParseError, false, duplicatedArg, JSMSG_BAD_DUP_ARGS);
                         return false;
diff --git a/js/src/tests/ecma_6/Function/rest-has-duplicated.js b/js/src/tests/ecma_6/Function/rest-has-duplicated.js
new file mode 100644
index 000000000000..67577ab4e343
--- /dev/null
+++ b/js/src/tests/ecma_6/Function/rest-has-duplicated.js
@@ -0,0 +1,17 @@
+// Make sure duplicated name is allowed in non-strict.
+function f0(a, a) {
+}
+
+// SyntaxError should be thrown if rest parameter name is duplicated.
+assertThrowsInstanceOf(() => eval(`
+function f1(a, ...a) {
+}
+`), SyntaxError);
+
+// SyntaxError should be thrown if there is a duplicated parameter.
+assertThrowsInstanceOf(() => eval(`
+function f2(a, a, ...b) {
+}
+`), SyntaxError);
+
+reportCompare(0, 0, 'ok');