Bug 1234717 - Fix upvar TDZ for block-scoped functions. (r=jorendorff)

js/src/frontend/Parser.cpp

@@ -1832,7 +1832,6 @@ bool
 Parser<FullParseHandler>::leaveFunction(ParseNode* fn, ParseContext<FullParseHandler>* outerpc,
                                         FunctionSyntaxKind kind)
 {
-    bool bodyLevel = outerpc->atBodyLevel();
     FunctionBox* funbox = fn->pn_funbox;
     MOZ_ASSERT(funbox == pc->sc->asFunctionBox());
 
@@ -1902,10 +1901,10 @@ Parser<FullParseHandler>::leaveFunction(ParseNode* fn, ParseContext<FullParseHan
             if (dn != outer_dn) {
                 if (ParseNode* pnu = dn->dn_uses) {
                     // In ES6, lexical bindings cannot be accessed until
-                    // initialized. If we are parsing a body-level function,
-                    // it is hoisted to the top, so we conservatively mark all
-                    // uses linked to an outer lexical binding as needing TDZ
-                    // checks. e.g.,
+                    // initialized. If we are parsing a function statement it
+                    // is hoisted to the top of its lexical scope, so we
+                    // conservatively mark all uses linked to an outer lexical
+                    // binding as needing TDZ checks. e.g.,
                     //
                     // function outer() {
                     //   inner2();
@@ -1928,7 +1927,7 @@ Parser<FullParseHandler>::leaveFunction(ParseNode* fn, ParseContext<FullParseHan
                     // be marked as needing dead zone checks.
                     RootedAtom name(context, atom);
                     bool markUsesAsLexical = outer_dn->isLexical() &&
-                                             (bodyLevel ||
+                                             (kind == Statement ||
                                               IsNonDominatingInScopedSwitch(outerpc, name, outer_dn));
                     AssociateUsesWithOuterDefinition(pnu, dn, outer_dn, markUsesAsLexical);
                 }

js/src/tests/ecma_6/LexicalEnvironment/block-scoped-functions-hoisted-tdz.js

@@ -0,0 +1,30 @@
+var log = "";
+try {
+  (function() {
+    {
+      let y = f();
+      function f() { y; }
+    }
+  })()
+} catch (e) {
+  log += e instanceof ReferenceError;
+}
+
+try {
+  function f() {
+    switch (1) {
+      case 0:
+        let x;
+      case 1:
+        (function() { x; })();
+    }
+  }
+  f();
+} catch (e) {
+  log += e instanceof ReferenceError;
+}
+
+assertEq(log, "truetrue");
+
+if ("reportCompare" in this)
+  reportCompare(true, true);