d0618585a7
This patch fixes an obscure edge case for functions defined as the
direct body of a for-of/for-in loop, such as the following:
for (foo in []) function foo() { return foo; }
Here, the first occurrence of foo should point to the outer scope;
however, before this patch, it pointed to the inner foo in an
invalid way which caused an assertion about the scope chain to fail.
This patch fixes the scope chain by inserting an extra scope for
the body of the loop, not including the header.
BUG=chromium:542099
LOG=N
R=rossberg
Review URL: https://codereview.chromium.org/1396663004
Cr-Commit-Position: refs/heads/master@{#31268}
19 lines
617 B
JavaScript
19 lines
617 B
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --harmony-sloppy --harmony-sloppy-function
|
|
|
|
// Previously, this caused a CHECK fail in debug mode
|
|
// https://code.google.com/p/chromium/issues/detail?id=542099
|
|
|
|
var foo = {};
|
|
var bar = foo;
|
|
for (foo.x in {a: 1}) function foo() { return foo; }
|
|
assertEquals("object", typeof bar);
|
|
assertEquals("a", bar.x);
|
|
assertEquals("function", typeof foo);
|
|
assertEquals("function", typeof foo());
|
|
assertSame(foo, foo());
|
|
assertEquals(undefined, foo.x);
|