[Webkit-unassigned] [Bug 141881] Function name scope is only created on the function execution of the function that needs it

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=141881

--- Comment #1 from Filip Pizlo <fpizlo at apple.com> ---
Test case below.  Note that this passes on the first execution of check(); the failure is experienced on execution #2.  This has nothing to do with JITing; it's just our mistreatment of the reexecutability of closures.

function foo() {
    return function bar(str) {
        var barBefore = bar;
        var result = eval(str);
        return [
            barBefore,
            bar,
            function () {
                return bar;
            },
            result
        ];
    }
}

function check() {
    var bar = foo();

    function verify(result, barAfter, evalResult) {
        if (result[0] !== bar)
            throw "Error: bad first entry: " + result[0];
        if (result[1] !== barAfter)
            throw "Error: bad first entry: " + result[1];
        var subResult = result[2]();
        if (subResult !== barAfter)
            throw "Error: bad second entry: " + result[2] + "; returned: " + subResult;
        if (result[3] !== evalResult)
            throw "Error: bad third entry: " + result[3] + "; expected: " + evalResult;
    }

    verify(bar("42"), bar, 42);
    verify(bar("bar"), bar, bar);
    verify(bar("var bar = 42; function fuzz() { return bar; }; fuzz()"), 42, 42);
}

for (var i = 0; i < 100; ++i)
    check();

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150223/53f6f553/attachment-0002.html>