archives

« Bugzilla Issues Index

#1789 — 10.5.1: Insufficient redeclaration checks can trigger assertions in 10.2.1.1.2 and 10.2.1.1.3


"10.5.1 Global Declaration Instantiation" checks for invalid redeclarations in step 3-4, but steps 9.a.iii.1, 11.a.i.1.a and maybe 13.c, 14.a (cf. bug 1786) can execute side-effects. This can be used to trigger assertions in 10.2.1.1.2 and 10.2.1.1.3 when 10.5.1 processes step 16.


test case:
---
function triggerAssertion(global, callCounter, code1, code2) {
Object.setPrototypeOf(global, new Proxy(Object.create(null), {
has(t, pk) {
if (pk == "foo" && callCounter > 0 && --callCounter == 0) {
(1,eval)(`eval("${code2}")`)
}
return false;
}
}));
(1,eval)(`eval("${code1}${code2}")`)
}

triggerAssertion(this, 1, "var foo = 0;", "const bar = 0;")

triggerAssertion(this, 1, "var foo = 0;", "let bar = 0;")
---


fixed in rev26 editor's draft.

Added explicit tests for the cases where the assertion failures might occur and noted the possibility that the global script instantiation may abnormally terminate without instantiating some global declaratons.

In the presence of proxies I don't think there is anyway to achieve true all or none instantiation behavior.


Fixed in Rev26