From adc81d634d12d58a64e0d2a1e95998b766cf6e96 Mon Sep 17 00:00:00 2001
From: Gaming4JC <g4jc@hyperbola.info>
Date: Sat, 8 Jun 2019 16:37:10 -0400
Subject: 1317374 - Don't do Annex B lexical function behavior when redeclaring
 a parameter name.

---
 js/src/frontend/Parser.cpp                               |  6 ++++++
 .../tests/basic/testFunctionStatementAliasLocals.js      |  4 +++-
 .../block-scoped-functions-annex-b-parameter.js          | 16 ++++++++++++++++
 js/src/tests/js1_8/regress/regress-467495-05.js          |  2 +-
 js/src/tests/js1_8/regress/regress-467495-06.js          |  2 +-
 5 files changed, 27 insertions(+), 3 deletions(-)
 create mode 100644 js/src/tests/ecma_6/LexicalEnvironment/block-scoped-functions-annex-b-parameter.js

(limited to 'js')

diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 79b5d70f4..66ada79f2 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -1183,6 +1183,12 @@ Parser<ParseHandler>::tryDeclareVar(HandlePropertyName name, DeclarationKind kin
                     *redeclaredKind = Some(declaredKind);
                     return true;
                 }
+            } else if (kind == DeclarationKind::VarForAnnexBLexicalFunction) {
+                MOZ_ASSERT(DeclarationKindIsParameter(declaredKind));
+
+                // Annex B.3.3.1 disallows redeclaring parameter names.
+                *redeclaredKind = Some(declaredKind);
+                return true;
             }
         } else {
             if (!scope->addDeclaredName(pc, p, name, kind))
diff --git a/js/src/jit-test/tests/basic/testFunctionStatementAliasLocals.js b/js/src/jit-test/tests/basic/testFunctionStatementAliasLocals.js
index 7be49b7f3..be7f528b9 100644
--- a/js/src/jit-test/tests/basic/testFunctionStatementAliasLocals.js
+++ b/js/src/jit-test/tests/basic/testFunctionStatementAliasLocals.js
@@ -8,9 +8,11 @@ assertEq(typeof f1(true), "function");
 assertEq(f1(false), 3);
 
 function f2(b, w) {
+    // Annex B doesn't apply to functions in blocks with the same name as a
+    // parameter.
     if (b)
         function w() {}
     return w;
 }
-assertEq(typeof f2(true, 3), "function");
+assertEq(typeof f2(true, 3), "number");
 assertEq(f2(false, 3), 3);
diff --git a/js/src/tests/ecma_6/LexicalEnvironment/block-scoped-functions-annex-b-parameter.js b/js/src/tests/ecma_6/LexicalEnvironment/block-scoped-functions-annex-b-parameter.js
new file mode 100644
index 000000000..f0adedf7d
--- /dev/null
+++ b/js/src/tests/ecma_6/LexicalEnvironment/block-scoped-functions-annex-b-parameter.js
@@ -0,0 +1,16 @@
+// Annex B.3.3.1 disallows Annex B lexical function behavior when redeclaring a
+// parameter.
+
+(function(f) {
+  if (true) function f() {  }
+  assertEq(f, 123);
+}(123));
+
+(function(f) {
+  { function f() {  } }
+  assertEq(f, 123);
+}(123));
+
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
diff --git a/js/src/tests/js1_8/regress/regress-467495-05.js b/js/src/tests/js1_8/regress/regress-467495-05.js
index 505fb6bd6..ecf47b8fe 100644
--- a/js/src/tests/js1_8/regress/regress-467495-05.js
+++ b/js/src/tests/js1_8/regress/regress-467495-05.js
@@ -20,7 +20,7 @@ function test()
   printBugNumber(BUGNUMBER);
   printStatus (summary);
 
-  expect = 'function x() {}';
+  expect = '1';
 
   function g(x) { if (1) function x() {} return x; }
   print(actual = g(1) + '');
diff --git a/js/src/tests/js1_8/regress/regress-467495-06.js b/js/src/tests/js1_8/regress/regress-467495-06.js
index d8bc81c83..72adeee9e 100644
--- a/js/src/tests/js1_8/regress/regress-467495-06.js
+++ b/js/src/tests/js1_8/regress/regress-467495-06.js
@@ -32,7 +32,7 @@ function test()
 
   var r = f(0);
 
-  if (typeof(r[0]) != "function")
+  if (typeof(r[0]) != "number")
     actual += "Bad r[0]";
 
   if (typeof(r[1]) != "function")
-- 
cgit v1.2.3