Assertion Failure : m_token.tk == tkRCurly in ChakraCore/lib/Parser/Parse.cpp, line 13296

Version
---
Branch : master
Version : https://github.com/chakra-core/ChakraCore/commit/c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

Platform
---
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

Build
---
- Address Sanitizer=On
- Debug
```
./build.sh -d --static --sanitize=address
```

PoC
---
testcase

```javascript
var t = 0 ;
var r = 0 ;
class e {
static method ( { ... e ] ) {
assert . sameValue ( t , 1 ) ;
verifyProperty ( e , " v " , { enumerable : true , writable : true , configurable : true , value : 2 } ) ;
r = r + 1 ;
}
static get method ( ) { return this . method ; }
}
e . method ( { get v ( ) { t ++ ; return 2 ; } } ) ;
assert . sameValue ( r , 1 , " method invoked exactly once " ) ;
```

```javascript
// poc.js
class e {
static method ( { ... e ] ) { }
static get method ( ) { return this . method ; }
}
e . method ( ) ;
```

Execution steps & Output
---

```
$ ./ch poc.js
ASSERTION 202349: (./ChakraCore/lib/Parser/Parse.cpp, line 13296) m_token.tk == tkRCurly
Failure: (m_token.tk == tkRCurly)
Illegal instruction
```

Backtrace
---
```
(gdb) bt
#0 0x0000555559e21030 in Parser::ParseDestructuredObjectLiteral (this=, declarationType=, isDecl=true, topLevel=) at ./ChakraCore/lib/Parser/Parse.cpp:13296
#1 0x0000555559e1de52 in Parser::ParseDestructuredLiteral (this=0x7fffffffc7b0, declarationType=tkLET, isDecl=true, topLevel=false, initializerContext=DIC_None, allowIn=true, forInOfOkay=0x0, nativeForOkay=0x0)
at ./ChakraCore/lib/Parser/Parse.cpp:13207
#2 0x0000555559d9d220 in Parser::ParseFncFormals (this=, pnodeFnc=, pnodeParentFnc=, flags=, isTopLevelDeferredFunc=)
at ./ChakraCore/lib/Parser/Parse.cpp:6920
#3 0x0000555559e40fc3 in Parser::ParseFncDeclHelper (this=, pnodeFnc=, pNameHint=, flags=, fUnaryOrParen=, noStmtContext=,
pNeedScanRCurly=, skipFormals=, pFncNamePid=, fAllowIn=) at ./ChakraCore/lib/Parser/Parse.cpp:5840
#4 0x0000555559e3cf9a in Parser::ParseFncDeclInternal (this=, flags=104, pNameHint=, needsPIDOnRCurlyScan=, fUnaryOrParen=, noStmtContext=,
superRestrictionState=, fAllowIn=) at ./ChakraCore/lib/Parser/Parse.cpp:5421
#5 0x0000555559df0486 in Parser::ParseFncDeclNoCheckScope (this=0x7fffffffc7b0, flags=104, superRestrictionState=SuperRestrictionState::PropertyAllowed, pNameHint=0x621000005e52 u"method", needsPIDOnRCurlyScan=true,
fUnaryOrParen=false, fAllowIn=true) at ./ChakraCore/lib/Parser/Parse.cpp:5327
#6 0x0000555559dfd4cf in Parser::ParseClassDecl (this=, isDeclaration=, pNameHint=, pHintLength=, pShortNameOffset=)
at ./ChakraCore/lib/Parser/Parse.cpp:8152
#7 0x0000555559e0578e in Parser::ParseStatement (this=) at ./ChakraCore/lib/Parser/Parse.cpp:10251
#8 0x0000555559d98511 in Parser::ParseStmtList (this=0x7fffffffc7b0, ppnodeList=, pppnodeLast=, smEnvironment=, isSourceElementList=, strictModeOn=)
at ./ChakraCore/lib/Parser/Parse.cpp:11504
#9 0x0000555559d17284 in Parser::Parse (this=, pszSrc=, offset=, length=, charOffset=, isUtf8=, grfscr=,
lineNumber=, nextFunctionId=, pse=) at ./ChakraCore/lib/Parser/Parse.cpp:12125
#10 0x0000555559d13e13 in Parser::ParseSourceInternal (this=, parseTree=0x7fffffffc540, pszSrc=, offsetInBytes=, encodedCharCount=, offsetInChars=,
isUtf8=, grfscr=, pse=, nextFunctionId=, lineNumber=, sourceContextInfo=) at ./ChakraCore/lib/Parser/Parse.cpp:507
#11 0x0000555559d675f4 in Parser::ParseUtf8Source (this=0x7fffffffc7b0, parseTree=0x7fffffffc540,
pSrc=0x60c000000040 "class e { \n\tstatic method ( { ... e ] ) { } \n\tstatic get method ( ) { return this . method ; } \n} \ne . method ( ) ; \n", length=117, grfsrc=4112, pse=0x7fffffffd710, nextFunctionId=0x7ffff2842304,
sourceContextInfo=0x7ffff2842300) at ./ChakraCore/lib/Parser/Parse.cpp:12347
#12 0x00005555570bba18 in Js::ScriptContext::ParseScript (this=, parser=, script=, cb=, pSrcInfo=, pse=, ppSourceInfo=,
rootDisplayName=, loadScriptFlag=, sourceIndex=, scriptSource=) at ./ChakraCore/lib/Runtime/Base/ScriptContext.cpp:2090
#13 0x00005555570c08d0 in Js::ScriptContext::LoadScriptInternal (this=, parser=, script=, cb=, pSrcInfo=, pse=, ppSourceInfo=,
rootDisplayName=, loadScriptFlag=, scriptSource=) at ./ChakraCore/lib/Runtime/Base/ScriptContext.cpp:2553
#14 0x00005555570c1f52 in Js::ScriptContext::LoadScript (this=0x622000000158, script=, cb=, pSrcInfo=, pse=, ppSourceInfo=, rootDisplayName=,
loadScriptFlag=, scriptSource=) at ./ChakraCore/lib/Runtime/Base/ScriptContext.cpp:2601
#15 0x00005555567a29e3 in RunScriptCore(void*, unsigned char const*, unsigned long, LoadScriptFlag, unsigned long, char16_t const*, bool, _JsParseScriptAttributes, bool, void**)::$_84::operator()(Js::ScriptContext*, TTD::TTDJsRTActionResultAutoRecorder&) const (this=, scriptContext=, _actionEntryPopper=...) at ./ChakraCore/lib/Jsrt/Jsrt.cpp:3611
#16 ContextAPINoScriptWrapper(RunScriptCore(void*, unsigned char const*, unsigned long, LoadScriptFlag, unsigned long, char16_t const*, bool, _JsParseScriptAttributes, bool, void**)::$_84, bool, bool)::{lambda(Js::ScriptContext*)#1}::operator()(Js::ScriptContext*) const (this=,
scriptContext=) at ./ChakraCore/lib/Jsrt/JsrtInternal.h:316
#17 ContextAPINoScriptWrapper_Core(RunScriptCore(void*, unsigned char const*, unsigned long, LoadScriptFlag, unsigned long, char16_t const*, bool, _JsParseScriptAttributes, bool, void**)::$_84, bool, bool)::{lambda(Js::ScriptContext*)#1}>(ContextAPINoScriptWrapper(RunScriptCore(void*, unsigned char const*, unsigned long, LoadScriptFlag, unsigned long, char16_t const*, bool, _JsParseScriptAttributes, bool, void**)::$_84, bool, bool)::{lambda(Js::ScriptContext*)#1}, bool, bool) (fn=..., allowInObjectBeforeCollectCallback=false, scriptExceptionAllowed=false)
at ./ChakraCore/lib/Jsrt/JsrtInternal.h:277
#18 ContextAPINoScriptWrapper(RunScriptCore(void*, unsigned char const*, unsigned long, LoadScriptFlag, unsigned long, char16_t const*, bool, _JsParseScriptAttributes, bool, void**)::$_84, bool, bool) (fn=..., allowInObjectBeforeCollectCallback=false, scriptExceptionAllowed=false)
at ./ChakraCore/lib/Jsrt/JsrtInternal.h:314
#19 RunScriptCore (scriptSource=, script=, cb=, loadScriptFlag=, sourceContext=, sourceUrl=, parseOnly=,
parseAttributes=, isSourceModule=, result=) at ./ChakraCore/lib/Jsrt/Jsrt.cpp:3555
#20 0x00005555567c7eee in CompileRun (scriptVal=0x7ffff2844000, sourceContext=140737353891840, sourceUrl=0x7ffff26e1090, parseAttributes=JsParseScriptAttributeNone, result=0x0, parseOnly=false)
at ./ChakraCore/lib/Jsrt/Jsrt.cpp:5019
#21 JsRun (scriptVal=, sourceContext=, sourceUrl=, parseAttributes=, result=) at ./ChakraCore/lib/Jsrt/Jsrt.cpp:5041
#22 0x000055555640d8fd in ChakraRTInterface::JsRun (script=0x0, sourceContext=0, sourceUrl=0x10007fff7e00, parseAttributes=JsParseScriptAttributeNone, result=0x0)
at ./ChakraCore/bin/ch/ChakraRtInterface.h:487
#23 RunScript (fileName=, fileContents=, fileLength=, fileContentsFinalizeCallback=, bufferValue=, fullPath=, parserStateCache=)
at ./ChakraCore/bin/ch/ch.cpp:451
#24 0x0000555556413102 in ExecuteTest (fileName=) at ./ChakraCore/bin/ch/ch.cpp:917
#25 0x0000555556413905 in ExecuteTestWithMemoryCheck (fileName=0x0) at ./ChakraCore/bin/ch/ch.cpp:967
#26 0x0000555556414fcc in main (argc=, c_argv=) at ./ChakraCore/bin/ch/ch.cpp:1274
```

Credits: @Ye0nny, @EJueon of the seclab-yonsei.