From 75810cb8e7dae07efc36f968575b924b29605d75 Mon Sep 17 00:00:00 2001 From: pjh456 <147148383@qq.com> Date: Mon, 5 Oct 2026 17:30:42 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20for=20=E5=A4=B4=E5=90=8D=E5=9B=9E?= =?UTF-8?q?=E5=A1=AB=E5=8A=A0=E4=BD=9C=E7=94=A8=E5=9F=9F=E6=B7=B1=E5=BA=A6?= =?UTF-8?q?=E9=97=A8=E6=8E=A7=E9=98=B2=E4=BD=93=E5=86=85=E5=90=8C=E5=90=8D?= =?UTF-8?q?=E9=81=AE=E8=94=BD=E8=A6=86=E5=86=99=E5=A4=B4=20cell?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Cargo.lock | 36 +++++----- Cargo.toml | 2 +- crates/oxide_emit/src/compile_ctx.rs | 26 ++++--- crates/oxide_emit/src/shared/binding.rs | 5 +- .../oxide_emit/src/stmt/iteration/for_in.rs | 11 ++- crates/oxide_vm/tests/for_head_lex_tests.rs | 68 +++++++++++++++++++ 6 files changed, 118 insertions(+), 30 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index e917358a..a43c9e6d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1095,7 +1095,7 @@ dependencies = [ [[package]] name = "oxide_builtins" -version = "0.8.10" +version = "0.8.11" dependencies = [ "chrono", "fast-float", @@ -1120,7 +1120,7 @@ dependencies = [ [[package]] name = "oxide_bytecode" -version = "0.8.10" +version = "0.8.11" dependencies = [ "num-bigint", "oxide_log", @@ -1128,7 +1128,7 @@ dependencies = [ [[package]] name = "oxide_cfg" -version = "0.8.10" +version = "0.8.11" dependencies = [ "oxide_bytecode", "oxide_emit", @@ -1139,7 +1139,7 @@ dependencies = [ [[package]] name = "oxide_cli" -version = "0.8.10" +version = "0.8.11" dependencies = [ "ansi_term", "bumpalo", @@ -1159,7 +1159,7 @@ dependencies = [ [[package]] name = "oxide_code_cache" -version = "0.8.10" +version = "0.8.11" dependencies = [ "lru", "oxide_bytecode", @@ -1168,7 +1168,7 @@ dependencies = [ [[package]] name = "oxide_compiler" -version = "0.8.10" +version = "0.8.11" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1187,7 +1187,7 @@ dependencies = [ [[package]] name = "oxide_dce" -version = "0.8.10" +version = "0.8.11" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1201,7 +1201,7 @@ dependencies = [ [[package]] name = "oxide_emit" -version = "0.8.10" +version = "0.8.11" dependencies = [ "num-bigint", "oxc_allocator", @@ -1216,7 +1216,7 @@ dependencies = [ [[package]] name = "oxide_ir" -version = "0.8.10" +version = "0.8.11" dependencies = [ "oxide_bytecode", "oxide_log", @@ -1225,7 +1225,7 @@ dependencies = [ [[package]] name = "oxide_kernel" -version = "0.8.10" +version = "0.8.11" dependencies = [ "bumpalo", "dashmap", @@ -1240,7 +1240,7 @@ dependencies = [ [[package]] name = "oxide_liveness" -version = "0.8.10" +version = "0.8.11" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1252,7 +1252,7 @@ dependencies = [ [[package]] name = "oxide_log" -version = "0.8.10" +version = "0.8.11" dependencies = [ "tracing", "tracing-appender", @@ -1261,7 +1261,7 @@ dependencies = [ [[package]] name = "oxide_parser" -version = "0.8.10" +version = "0.8.11" dependencies = [ "oxc_allocator", "oxc_ast", @@ -1276,7 +1276,7 @@ dependencies = [ [[package]] name = "oxide_regalloc" -version = "0.8.10" +version = "0.8.11" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1292,7 +1292,7 @@ dependencies = [ [[package]] name = "oxide_runtime_api" -version = "0.8.10" +version = "0.8.11" dependencies = [ "num-bigint", "num-traits", @@ -1304,7 +1304,7 @@ dependencies = [ [[package]] name = "oxide_test262" -version = "0.8.10" +version = "0.8.11" dependencies = [ "oxide_bytecode", "oxide_compiler", @@ -1321,7 +1321,7 @@ dependencies = [ [[package]] name = "oxide_types" -version = "0.8.10" +version = "0.8.11" dependencies = [ "bumpalo", "hashbrown 0.14.5", @@ -1333,7 +1333,7 @@ dependencies = [ [[package]] name = "oxide_vm" -version = "0.8.10" +version = "0.8.11" dependencies = [ "bumpalo", "chrono", diff --git a/Cargo.toml b/Cargo.toml index d9e72cc5..8a0c68c3 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -22,7 +22,7 @@ members = [ ] [workspace.package] -version = "0.8.10" +version = "0.8.11" edition = "2021" license = "MIT" rust-version = "1.80" diff --git a/crates/oxide_emit/src/compile_ctx.rs b/crates/oxide_emit/src/compile_ctx.rs index c87ed937..fdff8abc 100644 --- a/crates/oxide_emit/src/compile_ctx.rs +++ b/crates/oxide_emit/src/compile_ctx.rs @@ -153,12 +153,17 @@ pub struct CompileCtx { /// 拷贝的源也是寄存器，故 `emit_bind_target` 对集合内名字在 cell 写之外补写 /// 绑定寄存器。init 发射完毕后清空。 pub(crate) for_head_store_registers: HashSet, - /// C 风格 for 头保留集：被闭包引用或与顶层 var/函数同名的头名。这些头名保留 - /// 独立 cell 贯穿循环（体/test/update 走 cell），其余头名撤出覆盖回退寄存器循环。 - /// 仅 C-for 填充（for-in/for-of 全头名保留，本集为空）；`emit_bind_target` 头名 - /// 回填据此门控，非保留头名不置位绑定字段（否则体区读命中陈旧 cell 致死循环）。 - /// begin 前按捕获集与顶层 tier 名计算，init 发射完毕后清空。 + /// 词法循环头保留集：C-for 填被闭包引用或与顶层 var/函数同名的头名， + /// for-in/for-of 填全头名（无撤出覆盖）。`emit_bind_target` 头名回填据此 + /// 门控，非保留头名不置位绑定字段（否则体区读命中陈旧 cell 致死循环）。 + /// C-for 在 init 发射完毕后清空；for-in/for-of 经 `restore_for_head_env` + /// 逐头名移除。 pub(crate) for_head_keep: HashSet, + /// 词法头声明所在作用域深度（`push_scope` 后的 `scopes.len()`）：头名回填 + /// 仅在该深度（for 语句自身作用域）的声明点执行；for 体内嵌套作用域的同名 + /// 遮蔽声明与 catch 参数不在此深度，不触发回填，防遮蔽绑定的追加索引被头名 + /// 索引覆写、声明写落入头绑定 cell。嵌套循环由 `ForHeadEnv` 保存前值并恢复。 + pub(crate) for_head_depth: Option, /// 模块编译上下文：当前模块命名空间对象寄存器（`__moduleObject` 返回值）。 pub(crate) module_ns_reg: Option, /// 写穿反演表：本模块源绑定槽寄存器 → 引用它的导出名集合。仅自导入 ns 的 @@ -278,6 +283,7 @@ impl CompileCtx { register_update_names: Vec::new(), for_head_store_registers: HashSet::new(), for_head_keep: HashSet::new(), + for_head_depth: None, module_ns_reg: None, module_local_export_regs: HashMap::new(), module_dep_ns_regs: HashMap::new(), @@ -480,9 +486,11 @@ impl CompileCtx { /// 声明点 cell 索引解析：索引按绑定实例取（绑定自身字段是真源）。绑定未分配 /// 索引时，词法循环头名（ForHeadEnv 覆盖捕获映射）走映射回退；最内层为块 /// 作用域的就地声明（catch 参数）现场追加新索引并写回绑定，与函数级同名 - /// 绑定的名字排序索引区分。名字不可见（隐式全局登记）或不在捕获集时返回 - /// None，调用方落 with/全局臂。顶层 tier 名（顶层 var/函数）的全局对象属性 - /// 是唯一存储，不建 cell，返回 None。 + /// 绑定的名字排序索引区分。头名判定按作用域深度门控：仅 for 语句自身作用域 + /// 的声明点是头绑定本身（走映射回退）；体内嵌套作用域的同名就地声明（catch + /// 参数）不属头绑定，走块级追加臂取独立索引，不共用头 cell。名字不可见（隐式 + /// 全局登记）或不在捕获集时返回 None，调用方落 with/全局臂。顶层 tier 名 + /// （顶层 var/函数）的全局对象属性是唯一存储，不建 cell，返回 None。 /// /// # 副作用 /// - 就地追加臂写回绑定 cell 索引并递增计数器；指令流不改动。 @@ -494,7 +502,7 @@ impl CompileCtx { binding.cell_idx, self.is_implicit_global_reg(binding.reg), symbols.scopes.last().is_some_and(|s| s.kind == ScopeKind::BlockScope), - self.for_head_env_names.contains(name), + self.for_head_env_names.contains(name) && self.for_head_depth == Some(symbols.scopes.len()), self.is_global_scope && self.global_tier_names.contains(name) && scope_idx == 0, ) }; diff --git a/crates/oxide_emit/src/shared/binding.rs b/crates/oxide_emit/src/shared/binding.rs index cbbfc073..ab49453b 100644 --- a/crates/oxide_emit/src/shared/binding.rs +++ b/crates/oxide_emit/src/shared/binding.rs @@ -81,8 +81,11 @@ impl Emitter { // 头名回填：for 头绑定（字段 None）把覆盖 cell 索引写进绑定字段，解析点 // 按绑定身份取索引。保留集门控：C-for 仅保留头名置位（非保留头名走寄存器 // 循环，置位会使体区读命中陈旧 cell 致死循环）；for-in/for-of 全头名保留。 + // 深度门控：仅 for 语句自身作用域的声明点是头绑定声明点；体内嵌套作用域 + // 的同名遮蔽声明与 catch 参数不在此深度，不回填（否则遮蔽绑定的追加索引 + // 被头名索引覆写，声明写落入头绑定 cell 污染头值）。 // 非 for 头绑定（函数级 / 块级 / catch 参数）已由各自路径置位，不在此覆盖。 - if ctx.for_head_keep.contains(name) { + if ctx.for_head_keep.contains(name) && ctx.for_head_depth == Some(ctx.scopes.symbols.scopes.len()) { if let Some(&idx) = ctx.captured_bindings.get(name) { ctx.set_binding_cell_idx(name, idx); } diff --git a/crates/oxide_emit/src/stmt/iteration/for_in.rs b/crates/oxide_emit/src/stmt/iteration/for_in.rs index a387deb1..a0f1cc99 100644 --- a/crates/oxide_emit/src/stmt/iteration/for_in.rs +++ b/crates/oxide_emit/src/stmt/iteration/for_in.rs @@ -15,8 +15,11 @@ use oxide_parser::{ForStatementInit, ForStatementLeft, Statement, VariableDeclar /// for-in/for-of 词法头的捕获映射覆盖：每头名一条记录，依次为名字、旧条目 /// （无旧条目为 None）、右值区 TDZ cell、体区 fresh cell（切换后填入）。 +/// `prev_depth` 保存进入时的 `for_head_depth` 前值，语句收尾恢复（嵌套循环 +/// 成对）。 pub(crate) struct ForHeadEnv { entries: Vec<(String, Option, u8, u8)>, + prev_depth: Option, } impl Emitter { @@ -75,6 +78,11 @@ impl Emitter { /// `switch_for_head_env_to_body` 与 `restore_for_head_env` 成对收尾， /// 防头名泄漏进兄弟语句的捕获判定。 pub(crate) fn begin_for_head_env(&self, names: Vec, ctx: &mut CompileCtx) -> Result { + // 头名回填门控按作用域深度判定：本环境生效期间，仅 for 语句自身作用域 + // （`push_scope` 后最内层）的声明点是头绑定声明点；体内嵌套作用域的同名 + // 遮蔽声明不在此深度，不触发回填。 + let prev_depth = ctx.for_head_depth; + ctx.for_head_depth = Some(ctx.scopes.symbols.scopes.len()); let mut entries = Vec::with_capacity(names.len()); for name in names { let saved = ctx.captured_bindings.remove(&name); @@ -94,7 +102,7 @@ impl Emitter { )); entries.push((name, saved, tdz_idx, 0)); } - Ok(ForHeadEnv { entries }) + Ok(ForHeadEnv { entries, prev_depth }) } /// 右值区求值完毕后把覆盖从 TDZ cell 切到体区 fresh cell：每头名分配新 @@ -144,6 +152,7 @@ impl Emitter { ctx.for_head_env_names.remove(&name); ctx.for_head_keep.remove(&name); } + ctx.for_head_depth = env.prev_depth; } pub(crate) fn emit_for_in_statement(&self, stmt: &Statement, ctx: &mut CompileCtx) -> Result, String> { diff --git a/crates/oxide_vm/tests/for_head_lex_tests.rs b/crates/oxide_vm/tests/for_head_lex_tests.rs index 4ff41041..ce88be7b 100644 --- a/crates/oxide_vm/tests/for_head_lex_tests.rs +++ b/crates/oxide_vm/tests/for_head_lex_tests.rs @@ -205,3 +205,71 @@ fn c_for_let_head_non_captured_shadow_restores_outer_and_destructures() { "non-captured shadow restores the outer binding and destructuring heads bind leaf values" ); } + +// ── for-in/for-of 头名与体内块级同名遮蔽 / catch 参数：头值不被污染 ── + +#[test] +fn for_in_let_head_block_shadow_keeps_head_value() { + // 体内块级同名遮蔽声明：遮蔽绑定取独立追加索引，声明写落自身 cell， + // 头绑定值在本迭代剩余区间不被遮蔽值污染。 + assert_eq!( + eval( + "var out = []; \ + for (let x in {a:1, b:2}) { { let x = 100; } out.push(x); } \ + out.length === 2 && out[0] === \"a\" && out[1] === \"b\"" + ), + "true", + "a block-level shadow of the for-in head keeps the head value intact" + ); +} + +#[test] +fn for_in_let_head_catch_param_keeps_head_value() { + // catch 参数与头名同名：参数就地声明取独立索引，异常值落参数自身 cell， + // 头绑定值不被异常值污染。 + assert_eq!( + eval( + "var out = []; \ + for (let x in {a:1, b:2}) { \ + try { throw new Error(\"boom\"); } catch (x) { out.push(x instanceof Error); } \ + out.push(x); \ + } \ + out.length === 4 && out[0] === true && out[1] === \"a\" && out[2] === true && out[3] === \"b\"" + ), + "true", + "a catch parameter named like the for-in head keeps the head value intact" + ); +} + +#[test] +fn for_of_let_head_block_shadow_keeps_head_value() { + // for-of 同形：体内块级同名遮蔽声明不污染头绑定值。 + assert_eq!( + eval( + "var out = []; \ + for (let x of [10, 20]) { { let x = 100; } out.push(x); } \ + out.length === 2 && out[0] === 10 && out[1] === 20" + ), + "true", + "a block-level shadow of the for-of head keeps the head value intact" + ); +} + +#[test] +fn c_for_head_catch_param_keeps_head_value() { + // C-for 头名加体内 catch 参数同名：参数就地声明取独立索引，异常值落参数 + // 自身 cell，出 catch 块后头绑定读回迭代值、不被异常值污染。 + assert_eq!( + eval( + "var out = []; \ + for (let x = 0; x < 2; x++) { \ + try { throw new Error(\"boom\"); } catch (x) { out.push(x instanceof Error); } \ + out.push(typeof x); \ + } \ + out.length === 4 && out[0] === true && out[1] === \"number\" \ + && out[2] === true && out[3] === \"number\"" + ), + "true", + "a catch parameter named like a C-for head keeps the head value intact" + ); +}