Bug 151369 – There is a bug when default parameter values are mixed with destructuring parameter values

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

```
function foo(a = function() { return b; }, {b}) {
    b = 50;
    return a();
}

print(foo(undefined, {b: 34}));
```
this prints 34 instead of 50.

Basically, the problem is that we mark destructuring parameters as "var"s in the function.
This causes us to create an extra lexical environment register on top of the one used
for default parameter values. We essentially create two "b"s in the above function.
The body of the function only has access to the top-most "b" and the default parameter
value function only has access to the bottom-most "b".

[Saam Barati]

Created attachment 265769 [details]
patch

[Geoffrey Garen]

Comment on attachment 265769 [details]
patch

r=me

[Mark Lam]

Comment on attachment 265769 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=265769&action=review

> Source/JavaScriptCore/ChangeLog:12
> +        incorrectly transofrm this program:

typo: transofrm ==> transform.

> Source/JavaScriptCore/ChangeLog:15
> +        ```function foo(a = function() { b = 40; }, {b}) { a(); return b; }```
> +        into
> +        ```function foo(a = function() { b = 40; }, {b}) { var b; a(); return b; }```

nit: It would be nice if you can provide some example values and show how that propagates through to produce a different and wrong result.  Perhaps this is already straightforward to anyone who already is well versed in ES6, but it would certainly highlight the nuance of the bug a little clearer for anyone else who is not.

On second thought, maybe the test case you added should be sufficient to illustrate that.  I'll leave it up to your discretion.

> Source/JavaScriptCore/ChangeLog:17
> +        there whould only be one.

typo: whould ==> should.

[Saam Barati]

landed in:
http://trac.webkit.org/changeset/192586

[WebKit Commit Bot]

Re-opened since this is blocked by bug 151417

[Saam Barati]

landed again:
http://trac.webkit.org/changeset/192603