This should fail:
but doesn't. The problem is that jsemit.cpp does the check (and throws a TypeError with JSMSG_BAD_OBJECT_INIT), and jsreflect.cpp is not doing the same check.
Fix should be easy: just check for the PNX_DESTRUCT bit, same as jsemit.cpp.
CC'ing Jesse, who may want to feed his fuzzer with some tasty new inputs.
Created attachment 567654 [details] [diff] [review]
checks PNX_DESTRUCT bit on TOK_RC expression nodes