Crash: malformed object destructuring assignment panics in class fields transform

🔎 Search Terms

visitObjectAssignmentElement, IsObjectBindingOrAssignmentElement, class fields destructuring crash, flattenDestructuringAssignment, "Debug failure. False expression", private name destructuring emit

🕗 Version & Regression Information

• This is a crash
• This is the behavior in every version I tried: TypeScript 6.0.3 (JS) and 7.1.0-dev (main, Go)

⏯ Playground Link

https://www.typescriptlang.org/play/?ts=6.0.0-dev.20260416#code/BQbwHsCCB0DEC+BeIA

💻 Code

({x(A.#}=

🙁 Actual behavior

panic: Debug failure. False expression. [recovered, repanicked]

goroutine 82 [running]:
sync.(*WaitGroup).Go.func1.1()
        sync/waitgroup.go:251 +0x48
panic({0x105cc58e0?, 0x53098de1dce0?})
        runtime/panic.go:860 +0x12c
github.com/microsoft/TypeScript/tsc/internal/debug.Fail(...)
        github.com/microsoft/TypeScript/tsc/internal/debug/debug.go:14
github.com/microsoft/TypeScript/tsc/internal/debug.assertSlow(...)
        github.com/microsoft/TypeScript/tsc/internal/debug/debug.go:60 +0x5c
github.com/microsoft/TypeScript/tsc/internal/debug.Assert(...)
        github.com/microsoft/TypeScript/tsc/internal/debug/debug.go:49
github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms.(*classFieldsTransformer).visitObjectAssignmentElement(...)
        github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms/classfields.go:3321 +0x6c
github.com/microsoft/TypeScript/tsc/internal/ast.(*NodeVisitor).VisitSlice(...)
        github.com/microsoft/TypeScript/tsc/internal/ast/visitor.go:148 +0xa0
github.com/microsoft/TypeScript/tsc/internal/ast.(*NodeVisitor).VisitNodes(...)
        github.com/microsoft/TypeScript/tsc/internal/ast/visitor.go:99 +0x3c
github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms.(*classFieldsTransformer).visitAssignmentPattern(...)
        github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms/classfields.go:3360 +0xcc
github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms.(*classFieldsTransformer).visitAssignmentTarget(...)
        github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms/classfields.go:372 +0x30
github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms.(*classFieldsTransformer).visitBinaryExpression(...)
        github.com/microsoft/TypeScript/tsc/internal/transformers/estransforms/classfields.go:1462 +0x7a8
... 108 lines truncated ...
github.com/microsoft/TypeScript/tsc/internal/compiler.(*emitter).emitJSFile(...)
        github.com/microsoft/TypeScript/tsc/internal/compiler/emitter.go:200 +0x198
github.com/microsoft/TypeScript/tsc/internal/compiler.(*emitter).emit(...)
        github.com/microsoft/TypeScript/tsc/internal/compiler/emitter.go:50 +0xec
github.com/microsoft/TypeScript/tsc/internal/compiler.(*Program).Emit.func2()
        github.com/microsoft/TypeScript/tsc/internal/compiler/program.go:1851 +0x1c0

🙂 Expected behavior

The compiler should not crash 😄

Additional information about the issue

Disclosure: This crash was found with a custom mutation fuzzer and AI assistance (Kimi K3). The input was minimized and then verified by hand against TypeScript 7.1.0-dev (main) and TypeScript 6.0.3.

Bắt đầu bằng cách tái hiện input được cung cấp ({x(A.#}= , sau đó kiểm tra visitObjectAssignmentElement và visitAssignmentPattern trong tsc/internal/transformers/estransforms/classfields.go, đặc biệt là assertion được báo cáo ở dòng 3321. Thêm một regression test cho input destructuring không hợp lệ này và xác minh rằng quá trình biên dịch báo cáo hoặc xử lý nó mà không gây ra panic.