Changeset 215977 in webkit

Timestamp:

Apr 29, 2017, 2:25:50 PM (8 years ago)

Author:

gskachkov@gmail.com

Message:

Deep nesting is leading to ReferenceError for hoisted function
​https://bugs.webkit.org/show_bug.cgi?id=171456

Reviewed by Yusuke Suzuki.

Current patch fix error that appears during hoisting of the function
in block scope. Error happens only when exist some deep scope that lead
to increase scope stack, after which list of the hosted candidates do not
copied to updated scope stack.

Source/JavaScriptCore:

• parser/Parser.h:

(JSC::Scope::Scope):

LayoutTests:

• js/function-declaration-statement-expected.txt:
• js/script-tests/function-declaration-statement.js:

(deepNesting.foo):
(deepNesting):
(deepNestingForFunctionDeclaration.foo):
(deepNestingForFunctionDeclaration):
(eval.deepNestingInEval.foo):
(eval.deepNestingInEval):
(eval.deepNestingForFunctionDeclarationInEval.foo):
(eval.deepNestingForFunctionDeclarationInEval):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/function-declaration-statement-expected.txt (modified) (1 diff)
• LayoutTests/js/script-tests/function-declaration-statement.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/parser/Parser.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-04-29  Oleksandr Skachkov  <gskachkov@gmail.com>
+
+        Deep nesting is leading to ReferenceError for hoisted function
+        https://bugs.webkit.org/show_bug.cgi?id=171456
+
+        Reviewed by Yusuke Suzuki.
+
+        * js/function-declaration-statement-expected.txt:
+        * js/script-tests/function-declaration-statement.js:
+        (deepNesting.foo):
+        (deepNesting):
+        (deepNestingForFunctionDeclaration.foo):
+        (deepNestingForFunctionDeclaration):
+        (eval.deepNestingInEval.foo):
+        (eval.deepNestingInEval):
+        (eval.deepNestingForFunctionDeclarationInEval.foo):
+        (eval.deepNestingForFunctionDeclarationInEval):
+
 2017-04-28  Zalan Bujtas  <zalan@apple.com>
 

trunk/LayoutTests/js/function-declaration-statement-expected.txt

@@ -7 +7 @@
 PASS ifElseTest() is true
 PASS labelTest() is true
+PASS deepNesting() is 'abc'
+PASS deepNestingForFunctionDeclaration() is 'abc'
+PASS deepNestingInEval() is 'abc'
+PASS deepNestingForFunctionDeclarationInEval() is 'abc'
 PASS successfullyParsed is true
 

trunk/LayoutTests/js/script-tests/function-declaration-statement.js

@@ -48 +48 @@
 
 shouldBeTrue("labelTest()");
+
+
+function deepNesting () {
+    var y = '';
+    {
+        function foo() { return 'abc'; }
+    }
+    if (true) {
+        {
+            {
+                {
+                    {
+                        {
+                           {
+                                {
+                                    {
+                                        {
+                                            { 
+                                                let x = 'abc';
+                                                y = x;
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return foo(); 
+};
+
+shouldBe("deepNesting()", "'abc'");
+
+function deepNestingForFunctionDeclaration () {
+    var y = '';
+    {
+        {
+            {
+                {
+                    {
+                        {
+                            {
+                                {
+                                    {
+                                        {
+                                            {
+                                                {
+                                                    {
+                                                        {
+                                                            function foo() { return 'abc'; }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    if (true) {
+        {
+            {
+                {
+                    {
+                        {
+                           {
+                                {
+                                    {
+                                        {
+                                            { 
+                                                let x = 'abc';
+                                                y = x;
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return foo(); 
+};
+
+shouldBe("deepNestingForFunctionDeclaration()", "'abc'");
+
+eval(`function deepNestingInEval () {
+    var y = '';
+    {
+        function foo() { return 'abc'; }
+    }
+    if (true) {
+        {
+            {
+                {
+                    {
+                        {
+                           {
+                                {
+                                    {
+                                        {
+                                            { 
+                                                let x = 'abc';
+                                                y = x;
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return foo(); 
+};`);
+
+
+shouldBe("deepNestingInEval()", "'abc'");
+
+eval(`function deepNestingForFunctionDeclarationInEval () {
+    var y = '';
+    {
+        {
+            {
+                {
+                    {
+                        {
+                            {
+                                {
+                                    {
+                                        {
+                                            {
+                                                {
+                                                    {
+                                                        {
+                                                            function foo() { return 'abc'; }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    if (true) {
+        {
+            {
+                {
+                    {
+                        {
+                           {
+                                {
+                                    {
+                                        {
+                                            { 
+                                                let x = 'abc';
+                                                y = x;
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return foo(); 
+};`);
+
+shouldBe("deepNestingForFunctionDeclarationInEval()", "'abc'");

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-04-29  Oleksandr Skachkov  <gskachkov@gmail.com>
+
+        Deep nesting is leading to ReferenceError for hoisted function
+        https://bugs.webkit.org/show_bug.cgi?id=171456
+
+        Reviewed by Yusuke Suzuki.
+
+        Current patch fix error that appears during hoisting of the function 
+        in block scope. Error happens only when exist some deep scope that lead
+        to increase scope stack, after which list of the hosted candidates do not 
+        copied to updated scope stack.
+
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+
 2017-04-29  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/parser/Parser.h

@@ -189 +189 @@
     }
 
-    Scope(Scope&& other)
-        : m_vm(other.m_vm)
-        , m_shadowsArguments(other.m_shadowsArguments)
-        , m_usesEval(other.m_usesEval)
-        , m_needsFullActivation(other.m_needsFullActivation)
-        , m_hasDirectSuper(other.m_hasDirectSuper)
-        , m_needsSuperBinding(other.m_needsSuperBinding)
-        , m_allowsVarDeclarations(other.m_allowsVarDeclarations)
-        , m_allowsLexicalDeclarations(other.m_allowsLexicalDeclarations)
-        , m_strictMode(other.m_strictMode)
-        , m_isFunction(other.m_isFunction)
-        , m_isGenerator(other.m_isGenerator)
-        , m_isGeneratorBoundary(other.m_isGeneratorBoundary)
-        , m_isArrowFunction(other.m_isArrowFunction)
-        , m_isArrowFunctionBoundary(other.m_isArrowFunctionBoundary)
-        , m_isAsyncFunction(other.m_isAsyncFunction)
-        , m_isAsyncFunctionBoundary(other.m_isAsyncFunctionBoundary)
-        , m_isLexicalScope(other.m_isLexicalScope)
-        , m_isGlobalCodeScope(other.m_isGlobalCodeScope)
-        , m_isFunctionBoundary(other.m_isFunctionBoundary)
-        , m_isValidStrictMode(other.m_isValidStrictMode)
-        , m_hasArguments(other.m_hasArguments)
-        , m_isEvalContext(other.m_isEvalContext)
-        , m_hasNonSimpleParameterList(other.m_hasNonSimpleParameterList)
-        , m_constructorKind(other.m_constructorKind)
-        , m_expectedSuperBinding(other.m_expectedSuperBinding)
-        , m_loopDepth(other.m_loopDepth)
-        , m_switchDepth(other.m_switchDepth)
-        , m_innerArrowFunctionFeatures(other.m_innerArrowFunctionFeatures)
-        , m_labels(WTFMove(other.m_labels))
-        , m_declaredParameters(WTFMove(other.m_declaredParameters))
-        , m_declaredVariables(WTFMove(other.m_declaredVariables))
-        , m_lexicalVariables(WTFMove(other.m_lexicalVariables))
-        , m_usedVariables(WTFMove(other.m_usedVariables))
-        , m_closedVariableCandidates(WTFMove(other.m_closedVariableCandidates))
-        , m_functionDeclarations(WTFMove(other.m_functionDeclarations))
-    {
-    }
+    Scope(Scope&&) = default;
 
     void startSwitch() { m_switchDepth++; }