568708 - Bogus ReferenceError with lambda outliving let-block

Status: RESOLVED DUPLICATE of bug 590006

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

var f;
for (var i = 0; i < 9; i++) {
    let k = i;
    f = function() { return k; };
}
assertEq(f(), 8);


ReferenceError: k is not defined

Here f is not a flat closure (for bogus reasons, I think) but it should work anyway. f is just a regular old function, and the opcode that throws is a JSOP_NAME which should find k on the scope chain.

Blake had me look, and we think the bug is that TR::scopeChain() never clones Block objects:

JS_REQUIRES_STACK LIns*
TraceRecorder::scopeChain()
{
    return cx->fp->callee()
           ? get(&cx->fp->scopeChainVal)
           : entryScopeChain();
}

Comment 1

[Brendan Eich [:brendan]]

See bug 545759 -- is this (current) bug a dup?

/be

Comment 2

[Jason Orendorff [:jorendorff]]

Nominating. This bug trips assertions in my brain.

Comment 3

[Jason Orendorff [:jorendorff]]

Well, hang on: the test case passes now. Sorry for the noise. Trying now to find out if anything is really busted here.

Comment 4

[Jason Orendorff [:jorendorff]]

Fix identified!