Bug 257677 - Implementation error in ForStatement with LexicalDeclaration
Summary: Implementation error in ForStatement with LexicalDeclaration
Status: RESOLVED DUPLICATE of bug 189799
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari 16
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-06-03 04:19 PDT by webkit
Modified: 2023-10-11 16:56 PDT (History)
5 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description webkit 2023-06-03 04:19:17 PDT 
The POC

let cb;
for (let i = (cb = (() => i), 0); i<10;) {
  i++;
}
console.log(cb());

In chrome(V8) and engine262 we got output "0", but WebKit(JSC) we got "1", which is unexpected and completely wrong.
The spec(https://tc39.es/ecma262/#sec-forbodyevaluation) require to call CreatePerIterationEnvironment in every loop iteration, so the i++ in the loop body cannot effect the variable captured from the LexicalDeclaration, it seems jsc reuse the env in the first iteration.
Comment 1 Radar WebKit Bug Importer 2023-06-04 17:40:59 PDT 
<rdar://problem/110238901>
Comment 2 Alexey Shvayka 2023-10-11 16:53:22 PDT 
Hello, thanks for the report & test case!

As confirmed by naive fix, it is the same issue as https://bugs.webkit.org/show_bug.cgi?id=189799.

*** This bug has been marked as a duplicate of bug 189799 ***
Comment 3 Alexey Shvayka 2023-10-11 16:56:05 PDT 
(In reply to Alexey Shvayka from comment #2)
> Hello, thanks for the report & test case!
> 
> As confirmed by naive fix, it is the same issue as
> https://bugs.webkit.org/show_bug.cgi?id=189799.
> 
> *** This bug has been marked as a duplicate of bug 189799 ***

We can't ship the naive fix as it bloats the bytecode size, but we are working on a better solution!