Crash: malformed object destructuring assignment panics in class fields transform

🔎 Search Terms

visitObjectAssignmentElement, IsObjectBindingOrAssignmentElement, class fields destructuring crash, flattenDestructuringAssignment, "Debug failure. False expression", private name destructuring emit

🕗 Version & Regression Information

• This is a crash
• This is the behavior in every version I tried: TypeScript 6.0.3 (JS) and 7.1.0-dev (main, Go)

⏯ Playground Link

https://www.typescriptlang.org/play/?ts=6.0.0-dev.20260416#code/BQbwHsCCB0DEC+BeIA

💻 Code

({x(A.#}=

🙁 Actual behavior

panic: Debug failure. False expression. [recovered, repanicked]

goroutine 82 [running]:
sync.(*WaitGroup).Go.func1.1()
        sync/waitgroup.go:251 +0x48
panic({0x105cc58e0?, 0x53098de1dce0?})
        runtime/panic.go:860 +0x12c
github.com/microsoft/TypeScript/tsc/internal/debug.Fail(...)
        github.com/microsoft/TypeScript/tsc/internal/debug/debug.go:14
github.com/microsoft/TypeScript/tsc/internal/debug.assertSlow(...)
        github.com/microsoft/TypeScript/tsc/internal/debug/debug.go:60 +0x5c
github.com/microsoft/TypeScript/tsc/internal/debug.Assert(...)
        github.com/microsoft/TypeScript/tsc/internal/debug/debug.go:49
github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms.(*classFieldsTransformer).visitObjectAssignmentElement(...)
        github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms/classfields.go:3321 +0x6c
github.com/microsoft/TypeScript/tsc/internal/ast.(*NodeVisitor).VisitSlice(...)
        github.com/microsoft/TypeScript/tsc/internal/ast/visitor.go:148 +0xa0
github.com/microsoft/TypeScript/tsc/internal/ast.(*NodeVisitor).VisitNodes(...)
        github.com/microsoft/TypeScript/tsc/internal/ast/visitor.go:99 +0x3c
github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms.(*classFieldsTransformer).visitAssignmentPattern(...)
        github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms/classfields.go:3360 +0xcc
github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms.(*classFieldsTransformer).visitAssignmentTarget(...)
        github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms/classfields.go:372 +0x30
github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms.(*classFieldsTransformer).visitBinaryExpression(...)
        github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms/classfields.go:1462 +0x7a8
... 108 lines truncated ...
github.com/microsoft/TypeScript/tsc/internal/compiler.(*emitter).emitJSFile(...)
        github.com/microsoft/TypeScript/tsc/internal/compiler/emitter.go:200 +0x198
github.com/microsoft/TypeScript/tsc/internal/compiler.(*emitter).emit(...)
        github.com/microsoft/TypeScript/tsc/internal/compiler/emitter.go:50 +0xec
github.com/microsoft/TypeScript/tsc/internal/compiler.(*Program).Emit.func2()
        github.com/microsoft/TypeScript/tsc/internal/compiler/program.go:1851 +0x1c0

🙂 Expected behavior

The compiler should not crash 😄

Additional information about the issue

Disclosure: This crash was found with a custom mutation fuzzer and AI assistance (Kimi K3). The input was minimized and then verified by hand against TypeScript 7.1.0-dev (main) and TypeScript 6.0.3.

Beginne damit, die bereitgestellte Eingabe ({x(A.#}= zu reproduzieren, und untersuche anschließend visitObjectAssignmentElement und visitAssignmentPattern in tsc/internal/transformers/estransforms/classfields.go, insbesondere die in Zeile 3321 gemeldete Assertion. Füge für diese fehlerhafte Destrukturierungseingabe einen Regressionstest hinzu und überprüfe, dass die Kompilierung sie ohne Panic meldet oder behandelt.