Don't crash when converting missing array elements to assignable

Closes #220

acorn.js

@@ -1568,25 +1568,24 @@
   // Convert list of expression atoms to binding list.
 
   pp.toAssignableList = function(exprList, isBinding) {
-    if (exprList.length) {
-      for (var i = 0; i < exprList.length - 1; i++) {
-        this.toAssignable(exprList[i], isBinding);
-      }
-      var last = exprList[exprList.length - 1];
-      switch (last.type) {
-        case "RestElement":
-          break;
-        case "SpreadElement":
-          last.type = "RestElement";
-          var arg = last.argument;
-          this.toAssignable(arg, isBinding);
-          if (arg.type !== "Identifier" && arg.type !== "MemberExpression" && arg.type !== "ArrayPattern")
-            this.unexpected(arg.start);
-          break;
-        default:
-          this.toAssignable(last, isBinding);
+    var end = exprList.length;
+    if (end) {
+      var last = exprList[end - 1];
+      if (last && last.type == "RestElement") {
+        --end;
+      } else if (last && last.type == "SpreadElement") {
+        last.type = "RestElement";
+        var arg = last.argument;
+        this.toAssignable(arg, isBinding);
+        if (arg.type !== "Identifier" && arg.type !== "MemberExpression" && arg.type !== "ArrayPattern")
+          this.unexpected(arg.start);
+        --end;
       }
     }
+    for (var i = 0; i < end; i++) {
+      var elt = exprList[i];
+      if (elt) this.toAssignable(elt, isBinding);
+    }
     return exprList;
   };
 

test/tests-harmony.js

@@ -15466,6 +15466,34 @@ test("let {x} = y", {
   "end": 11
 }, {ecmaVersion: 6})
 
+test("[x,,] = 1", {
+  type: "Program",
+  body: [
+    {
+      type: "ExpressionStatement",
+      expression: {
+        type: "AssignmentExpression",
+        operator: "=",
+        left: {
+          type: "ArrayPattern",
+          elements: [
+            {
+              type: "Identifier",
+              name: "x"
+            },
+            null
+          ]
+        },
+        right: {
+          type: "Literal",
+          value: 1,
+          raw: "1"
+        }
+      }
+    }
+  ]
+}, {ecmaVersion: 6});
+
 testFail("let [x]", "Complex binding patterns require an initialization value (1:7)", {ecmaVersion: 6})
 testFail("var [x]", "Complex binding patterns require an initialization value (1:7)", {ecmaVersion: 6})
 testFail("var _𖫵 = 11;", "Unexpected character '𖫵' (1:5)", {ecmaVersion: 6});