Bug 171456 – Deep nesting is leading to ReferenceError for hoisted function

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[GSkachkov]

function boo () {
    {
        function foo() {}
    }
    if (true) {
        {
            {
                {
                    {
                        {
                           {
                                {
                                    {
                                        {
                                            let x = 0;
                                            print(x);
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
    print(!!foo); // ReferenceError: Can't find variable: foo, but should be true
};
boo();

Error occurs because we do not copy hosting candidates when we increase buffer for scope stack, so we need to add , m_sloppyModeHoistableFunctionCandidates(WTFMove(other.m_sloppyModeHoistableFunctionCandidates)) to Scope constructor

This error present in latest Safari and STP

[GSkachkov]

Will prepare patch tomorrow with tests.

[Saam Barati]

(In reply to GSkachkov from comment #0)
> function boo () {
>     {
>         function foo() {}
>     }
>     if (true) {
>         {
>             {
>                 {
>                     {
>                         {
>                            {
>                                 {
>                                     {
>                                         {
>                                             let x = 0;
>                                             print(x);
>                                         }
>                                     }
>                                 }
>                             }
>                         }
>                     }
>                 }
>             }
>         }
>     }
Oh man this is glorious. Nice find.
>     print(!!foo); // ReferenceError: Can't find variable: foo, but should be
> true
> };
> boo();
> 
> Error occurs because we do not copy hosting candidates when we increase
> buffer for scope stack, so we need to add ,
> m_sloppyModeHoistableFunctionCandidates(WTFMove(other.
> m_sloppyModeHoistableFunctionCandidates)) to Scope constructor
> 
> This error present in latest Safari and STP

[GSkachkov]

Created attachment 308663 [details]
Patch

Fix

[Yusuke Suzuki]

Comment on attachment 308663 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=308663&action=review

Nice! r=me with comment.

> Source/JavaScriptCore/parser/Parser.h:228
>      {

Listing all the members are not a scalable way. Can we just do `Scope(Scope&&) = default;` here?

[GSkachkov]

(In reply to Yusuke Suzuki from comment #4)
> Comment on attachment 308663 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=308663&action=review
> 
> Nice! r=me with comment.
> 
> > Source/JavaScriptCore/parser/Parser.h:228
> >      {
> 
> Listing all the members are not a scalable way. Can we just do
> `Scope(Scope&&) = default;` here?

Done. Thanks for review!

[GSkachkov]

Patch landed https://trac.webkit.org/r215977

[GSkachkov]

Comment on attachment 308663 [details]
Patch

Clear flags

[Joseph Pecoraro]

Nice!