410981 - js1_7/decompilation/regress-356247.js - for (let) allows let as child without block

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Bob Clary [:bc] (inactive)]

js> (function() { for(let x in []) let {} = [1]; })
function () {
    for (let x in []) {
        let [] = [1];
    }
}

Comment 1

[Brendan Eich [:brendan]]

Of course, this exists only given 'for (let x...)' and equivalent let bindings in for loop initial parts, and for-in loop left-hand sides. Such bindings make a block scope around the loop body (and condition and update parts, if for rather than for-in). This means the decompilation is not accurate, but it does not mean the for loop's enclosing scope is polluted by the let in the body. E.g., in

  for (let x in [1,2,3]) let y = x*x

y does not escape the loop body's implicit block scope.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

Comment 3

[timeless]

Comment on attachment 295586 [details] [diff] [review]
fix

@@ -3194,17 +3195,18 @@ Statement(JSContext *cx, JSTokenStream *

the comment described what the old if did, afaict it no longer describes the current logic.

Comment 4

[Brendan Eich [:brendan]]

Attachment: fix, with comment updates

Thanks, timeless!

/be

Comment 5

[Brendan Eich [:brendan]]

Fixed:

js/src/jsemit.h 3.88
js/src/jsparse.c 3.322

/be

Comment 6

[Bob Clary [:bc] (inactive)]

The following also required updating now that this is fixed. 

/cvsroot/mozilla/js/tests/js1_7/extensions/regress-346642-06.js,v
new revision: 1.4; previous revision: 1.3

Comment 7

[Bob Clary [:bc] (inactive)]

v