1431461 - Function body var scope mistakenly adds non-var bindings that are immediately shadowed

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[Shu-yu Guo [:shu]]

Something like

    function f(x,y=x) {
         let z;
    }

results in the Parser generating a separate body-level var scope due to the crazy semantics of parameter expressions.

In the Parser itself, there is just a single body-level Parser::Scope that holds all the declarations to perform redeclaration checks. When it finishes parsing the function, it'll generate the actual VM Scope data. This is where vars all put together, and lets/consts are all put together into different scopes. For functions with parameter expressions, the function body emits two VM Scopes: a FunctionBodyVar and a Lexical. When emitting the FunctionBodyVar, all bindings (including lets/consts) are mistakenly put into it. This has not manifested in observable errors because they are always immediately shadowed by the same-named bindings in the enclosed Lexical.

See the double copy of ma,mb in https://github.com/devtools-html/debugger.html/issues/5061#issuecomment-358106778

Comment 1

[Shu-yu Guo [:shu]]

Attachment: 0001-Bug-1431461-Filter-for-only-var-declarations-when-ge.patch

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: Filter for only var declarations when generating FunctionBodyVar scope data

Test added by jorendorff.

Comment 3

[Jason Orendorff [:jorendorff]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f4646f6adf3c19be833db9509eedde3169571c91

Comment 4

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/383d026eaeb7d27f2f2d2ea90e19d07d0b562f3b
Bug 1431461 - Filter for only var declarations when generating FunctionBodyVar scope data. r=jorendorff.

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/383d026eaeb7