Changeset 192586 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Nov 18, 2015, 2:01:19 PM (10 years ago)

Author:

[email protected]

Message:

There is a bug when default parameter values are mixed with destructuring parameter values
​https://bugs.webkit.org/show_bug.cgi?id=151369

Reviewed by Geoffrey Garen and Mark Lam.

This patch changes our parser to no longer declare destructuring
parameters as "var"s. This is a weird bug that just happened
to work in a world without default parameter values. In a world with
default parameter values this is just completely wrong. It would
incorrectly transform this program:
function foo(a = function() { b = 40; }, {b}) { a(); return b; }; foo(undefined, {b: 42}); // Should return 40
into
function foo(a = function() { b = 40; }, {b}) { var b; a(); return b; }; foo(undefined, {b:42}); // Returns 42, not 40.
Which is wrong because we end up with two distinct bindings of "b" when
there should only be one.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseVariableDeclarationList):
(JSC::Parser<LexerType>::createBindingPattern):
(JSC::Parser<LexerType>::parseDestructuringPattern):

• parser/Parser.h:

(JSC::Scope::declareParameter):
(JSC::Scope::getUsedVariables):
(JSC::Parser::strictMode):
(JSC::Parser::isValidStrictMode):
(JSC::Parser::declareParameter):
(JSC::Parser::breakIsValid):
(JSC::Scope::declareBoundParameter): Deleted.
(JSC::Parser::declareBoundParameter): Deleted.

• tests/stress/es6-default-parameters.js:

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-11-18  Saam barati  <[email protected]>
+
+        There is a bug when default parameter values are mixed with destructuring parameter values
+        https://bugs.webkit.org/show_bug.cgi?id=151369
+
+        Reviewed by Geoffrey Garen and Mark Lam.
+
+        This patch changes our parser to no longer declare destructuring
+        parameters as "var"s. This is a weird bug that just happened
+        to work in a world without default parameter values. In a world with
+        default parameter values this is just completely wrong. It would
+        incorrectly transform this program:
+        ```function foo(a = function() { b = 40; }, {b}) { a(); return b; }; foo(undefined, {b: 42}); // Should return 40```
+        into
+        ```function foo(a = function() { b = 40; }, {b}) { var b; a(); return b; }; foo(undefined, {b:42}); // Returns 42, not 40.```
+        Which is wrong because we end up with two distinct bindings of "b" when
+        there should only be one.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::getUsedVariables):
+        (JSC::Parser::strictMode):
+        (JSC::Parser::isValidStrictMode):
+        (JSC::Parser::declareParameter):
+        (JSC::Parser::breakIsValid):
+        (JSC::Scope::declareBoundParameter): Deleted.
+        (JSC::Parser::declareBoundParameter): Deleted.
+        * tests/stress/es6-default-parameters.js:
+
 2015-11-17  Benjamin Poulain  <[email protected]>