[webkit-changes] [WebKit/WebKit] 66468f: [JSC] Implement HasVarDeclaration abstract operation

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 66468f0cb22104024c0485895b647744b943eaab
      https://github.com/WebKit/WebKit/commit/66468f0cb22104024c0485895b647744b943eaab
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2023-09-11 (Mon, 11 Sep 2023)

  Changed paths:
    M JSTests/stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js
    A JSTests/stress/global-add-var-should-not-be-shadowed-by-lexical-bindings.js
    A JSTests/stress/has-var-declaration.js
    M Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
    M Source/JavaScriptCore/runtime/ExceptionHelpers.h
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObject.h
    M Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
    M Source/JavaScriptCore/runtime/ProgramExecutable.cpp

  Log Message:
  -----------
  [JSC] Implement HasVarDeclaration abstract operation
https://bugs.webkit.org/show_bug.cgi?id=261179
<rdar://problem/115014147>

Reviewed by Yusuke Suzuki.

Prior to this change, during script evaluation, variable bindings created via eval() -- including
those for hoisted block-level function declarations (Annex B) -- were ignored when checking for
duplicates with lexical declarations.

HasVarDeclaration [1] is introduced to remedy that. It correctly handling static global properties
(like NaN) that only pose as variables for performance reasons, which is achieved due to the fact that
static global properties are declared in the very first place, by the finishCreation() overrides,
and consecutively. So instead of maintaing a list of their identifiers, or adding a SymbolTableEntry
flag, we only need to keep an offset of the last such property.

Also, this change reorders duplicate variable checks into a single loop to match the spec [2],
making error messages more precise, and adds an optimization to avoid looking up each lexical
declaration if JSGlobalLexicalEnvironment is empty.

Even prior to this change, JSGlobalObject did override deleteProperty(), so no possible regression
is introduced.

Aligns JSC with the spec and SpiderMonkey yet not with V8 yet.

[1] https://tc39.es/ecma262/#sec-hasvardeclaration
[2] https://tc39.es/ecma262/#sec-globaldeclarationinstantiation (step 3)

* JSTests/stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js:
* JSTests/stress/global-add-var-should-not-be-shadowed-by-lexical-bindings.js: Added.
* JSTests/stress/has-var-declaration.js: Added.
* Source/JavaScriptCore/runtime/ExceptionHelpers.cpp:
(JSC::createErrorForDuplicateGlobalVariableDeclaration):
(JSC::createErrorForInvalidGlobalAssignment): Deleted.
* Source/JavaScriptCore/runtime/ExceptionHelpers.h: Removed unused createErrorForInvalidGlobalAssignment().
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::deleteProperty):
(JSC::JSGlobalObject::createGlobalFunctionBinding):
(JSC::JSGlobalObject::addStaticGlobals):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
* Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h:
(JSC::JSGlobalObject::hasVarDeclaration):
(JSC::JSGlobalObject::createGlobalVarBinding):
* Source/JavaScriptCore/runtime/ProgramExecutable.cpp:
(JSC::ProgramExecutable::initializeGlobalProperties):

Canonical link: https://commits.webkit.org/267891@main