[es6] Enforce TDZ checks for let/const in StoreLookupSlot

With --harmony-sloppy we can get to a runtime store in the presence of
an eval. We therefor need to check that the value is not the hole which
is used to enforce TDZ.

BUG=v8:4284
LOG=N
R=rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1214733013

Cr-Commit-Position: refs/heads/master@{#29577}

diff --git a/src/runtime/runtime-scopes.cc b/src/runtime/runtime-scopes.cc
index 953a09f..b450651 100644 (file)
--- a/src/runtime/runtime-scopes.cc
+++ b/src/runtime/runtime-scopes.cc
@@ -1026,6 +1026,12 @@ RUNTIME_FUNCTION(Runtime_StoreLookupSlot) {
 
   // The property was found in a context slot.
   if (index >= 0) {
+    if ((binding_flags == MUTABLE_CHECK_INITIALIZED ||
+         binding_flags == IMMUTABLE_CHECK_INITIALIZED_HARMONY) &&
+        Handle<Context>::cast(holder)->is_the_hole(index)) {
+      THROW_NEW_ERROR_RETURN_FAILURE(
+          isolate, NewReferenceError(MessageTemplate::kNotDefined, name));
+    }
     if ((attributes & READ_ONLY) == 0) {
       Handle<Context>::cast(holder)->set(index, *value);
     } else if (is_strict(language_mode)) {

diff --git a/test/mjsunit/es6/block-let-semantics.js b/test/mjsunit/es6/block-let-semantics.js
index b0a826a..5d43041 100644 (file)
--- a/test/mjsunit/es6/block-let-semantics.js
+++ b/test/mjsunit/es6/block-let-semantics.js
@@ -85,20 +85,22 @@ TestAll('f()(); let x; function f() { return function() { ++x; } }');
 TestAll('f()(); let x; function f() { return function() { x++; } }');
 TestAll('f()(); const x = 1; function f() { return function() { return x; } }');
 
-// Use before initialization with a dynamic lookup.
-TestAll('eval("x + 1;"); let x;');
-TestAll('eval("x = 1;"); let x;');
-TestAll('eval("x += 1;"); let x;');
-TestAll('eval("++x;"); let x;');
-TestAll('eval("x++;"); let x;');
-TestAll('eval("x"); const x = 1;');
-
-// Use before initialization with check for eval-shadowed bindings.
-TestAll('function f() { eval("var y = 2;"); x + 1; }; f(); let x;');
-TestAll('function f() { eval("var y = 2;"); x = 1; }; f(); let x;');
-TestAll('function f() { eval("var y = 2;"); x += 1; }; f(); let x;');
-TestAll('function f() { eval("var y = 2;"); ++x; }; f(); let x;');
-TestAll('function f() { eval("var y = 2;"); x++; }; f(); let x;');
+for (var kw of ['let', 'const']) {
+  // Use before initialization with a dynamic lookup.
+  TestAll(`eval("x"); ${kw} x = 2;`);
+  TestAll(`eval("x + 1;"); ${kw} x = 2;`);
+  TestAll(`eval("x = 1;"); ${kw} x = 2;`);
+  TestAll(`eval("x += 1;"); ${kw} x = 2;`);
+  TestAll(`eval("++x;"); ${kw} x = 2;`);
+  TestAll(`eval("x++;"); ${kw} x = 2;`);
+
+  // Use before initialization with check for eval-shadowed bindings.
+  TestAll(`function f() { eval("var y = 2;"); x + 1; }; f(); ${kw} x = 2;`);
+  TestAll(`function f() { eval("var y = 2;"); x = 1; }; f(); ${kw} x = 2;`);
+  TestAll(`function f() { eval("var y = 2;"); x += 1; }; f(); ${kw} x = 2;`);
+  TestAll(`function f() { eval("var y = 2;"); ++x; }; f(); ${kw} x = 2;`);
+  TestAll(`function f() { eval("var y = 2;"); x++; }; f(); ${kw} x = 2;`);
+}
 
 // Test that variables introduced by function declarations are created and
 // initialized upon entering a function / block scope.

diff --git a/test/mjsunit/harmony/block-let-semantics-sloppy.js b/test/mjsunit/harmony/block-let-semantics-sloppy.js
index 4a90a2f..35aad30 100644 (file)
--- a/test/mjsunit/harmony/block-let-semantics-sloppy.js
+++ b/test/mjsunit/harmony/block-let-semantics-sloppy.js
@@ -85,21 +85,22 @@ TestAll('f()(); let x; function f() { return function() { ++x; } }');
 TestAll('f()(); let x; function f() { return function() { x++; } }');
 TestAll('f()(); const x = 1; function f() { return function() { return x; } }');
 
-// Use before initialization with a dynamic lookup.
-TestAll('eval("x + 1;"); let x;');
-TestAll('eval("x = 1;"); let x;');
-TestAll('eval("x += 1;"); let x;');
-TestAll('eval("++x;"); let x;');
-TestAll('eval("x++;"); let x;');
-TestAll('eval("x"); const x = 1;');
-
-// Use before initialization with check for eval-shadowed bindings.
-TestAll('function f() { eval("var y = 2;"); x + 1; }; f(); let x;');
-// TODO(arv): https://code.google.com/p/v8/issues/detail?id=4284
-// TestAll('function f() { eval("var y = 2;"); x = 1; }; f(); let x;');
-TestAll('function f() { eval("var y = 2;"); x += 1; }; f(); let x;');
-TestAll('function f() { eval("var y = 2;"); ++x; }; f(); let x;');
-TestAll('function f() { eval("var y = 2;"); x++; }; f(); let x;');
+for (var kw of ['let', 'const']) {
+  // Use before initialization with a dynamic lookup.
+  TestAll(`eval("x"); ${kw} x = 2;`);
+  TestAll(`eval("x + 1;"); ${kw} x = 2;`);
+  TestAll(`eval("x = 1;"); ${kw} x = 2;`);
+  TestAll(`eval("x += 1;"); ${kw} x = 2;`);
+  TestAll(`eval("++x;"); ${kw} x = 2;`);
+  TestAll(`eval("x++;"); ${kw} x = 2;`);
+
+  // Use before initialization with check for eval-shadowed bindings.
+  TestAll(`function f() { eval("var y = 2;"); x + 1; }; f(); ${kw} x = 2;`);
+  TestAll(`function f() { eval("var y = 2;"); x = 1; }; f(); ${kw} x = 2;`);
+  TestAll(`function f() { eval("var y = 2;"); x += 1; }; f(); ${kw} x = 2;`);
+  TestAll(`function f() { eval("var y = 2;"); ++x; }; f(); ${kw} x = 2;`);
+  TestAll(`function f() { eval("var y = 2;"); x++; }; f(); ${kw} x = 2;`);
+}
 
 // Test that variables introduced by function declarations are created and
 // initialized upon entering a function / block scope.