Commit cd78a2b
deps: backport 75f2d65f00 from upstream V8
Original commit message:
Don't treat catch scopes as possibly-shadowing for sloppy eval
Scope analysis is over-conservative when treating variable
resolutions as possibly-shadowed by a sloppy eval. In the attached
bug, this comes into play since catch scopes have different behavior
with respect to the "calls eval" in eager vs lazy compilation (in
the latter, they are never marked as "calls eval" because
CatchContexts don't have an associated ScopeInfo).
This patch changes the scope-type check to also eliminate a few
other cases where shadowing isn't possible, such as non-declaration
block scopes.
BUG=chromium:608279
LOG=n
Committed:
https://crrev.com/75f2d65f003ebb22815489e9970913ba37234f1b
Cr-Commit-Position: refs/heads/master@{#36046}
Fixes: #12308
PR-URL: #12535
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>1 parent e7e83f6 commit cd78a2b
3 files changed
Lines changed: 24 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -11,7 +11,7 @@ | |||
| 11 | 11 | #define V8_MAJOR_VERSION 5 | |
| 12 | 12 | #define V8_MINOR_VERSION 1 | |
| 13 | 13 | #define V8_BUILD_NUMBER 281 | |
| 14 | - #define V8_PATCH_LEVEL 100 | ||
| 14 | + #define V8_PATCH_LEVEL 101 | ||
| 15 | 15 | ||
| 16 | 16 | // Use 1 for candidates and 0 otherwise. | |
| 17 | 17 | // (Boolean macro values are not supported by all preprocessors.) | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1083,12 +1083,15 @@ Variable* Scope::LookupRecursive(VariableProxy* proxy, | |||
| 1083 | 1083 | if (var != NULL && proxy->is_assigned()) var->set_maybe_assigned(); | |
| 1084 | 1084 | *binding_kind = DYNAMIC_LOOKUP; | |
| 1085 | 1085 | return NULL; | |
| 1086 | - } else if (calls_sloppy_eval() && !is_script_scope() && | ||
| 1087 | - name_can_be_shadowed) { | ||
| 1086 | + } else if (calls_sloppy_eval() && is_declaration_scope() && | ||
| 1087 | + !is_script_scope() && name_can_be_shadowed) { | ||
| 1088 | 1088 | // A variable binding may have been found in an outer scope, but the current | |
| 1089 | 1089 | // scope makes a sloppy 'eval' call, so the found variable may not be | |
| 1090 | 1090 | // the correct one (the 'eval' may introduce a binding with the same name). | |
| 1091 | 1091 | // In that case, change the lookup result to reflect this situation. | |
| 1092 | + // Only scopes that can host var bindings (declaration scopes) need be | ||
| 1093 | + // considered here (this excludes block and catch scopes), and variable | ||
| 1094 | + // lookups at script scope are always dynamic. | ||
| 1092 | 1095 | if (*binding_kind == BOUND) { | |
| 1093 | 1096 | *binding_kind = BOUND_EVAL_SHADOWED; | |
| 1094 | 1097 | } else if (*binding_kind == UNBOUND) { | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,18 @@ | |||
| 1 | + // Copyright 2016 the V8 project authors. All rights reserved. | ||
| 2 | + // Use of this source code is governed by a BSD-style license that can be | ||
| 3 | + // found in the LICENSE file. | ||
| 4 | + // | ||
| 5 | + // Flags: --always-opt --no-lazy | ||
| 6 | + | ||
| 7 | + function __f_38() { | ||
| 8 | + try { | ||
| 9 | + throw 0; | ||
| 10 | + } catch (e) { | ||
| 11 | + eval(); | ||
| 12 | + var __v_38 = { a: 'hest' }; | ||
| 13 | + __v_38.m = function () { return __v_38.a; }; | ||
| 14 | + } | ||
| 15 | + return __v_38; | ||
| 16 | + } | ||
| 17 | + var __v_40 = __f_38(); | ||
| 18 | + __v_40.m(); | ||
0 commit comments