fix: for 头名回填加作用域深度门控防体内同名遮蔽覆写头 cell

Cargo.lock

@@ -1095,7 +1095,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_builtins"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "chrono",
  "fast-float",
@@ -1120,7 +1120,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_bytecode"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "num-bigint",
  "oxide_log",
@@ -1128,7 +1128,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_cfg"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "oxide_bytecode",
  "oxide_emit",
@@ -1139,7 +1139,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_cli"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "ansi_term",
  "bumpalo",
@@ -1159,7 +1159,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_code_cache"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "lru",
  "oxide_bytecode",
@@ -1168,7 +1168,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_compiler"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1187,7 +1187,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_dce"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1201,7 +1201,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_emit"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "num-bigint",
  "oxc_allocator",
@@ -1216,7 +1216,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_ir"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "oxide_bytecode",
  "oxide_log",
@@ -1225,7 +1225,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_kernel"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "bumpalo",
  "dashmap",
@@ -1240,7 +1240,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_liveness"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1252,7 +1252,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_log"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "tracing",
  "tracing-appender",
@@ -1261,7 +1261,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_parser"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "oxc_allocator",
  "oxc_ast",
@@ -1276,7 +1276,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_regalloc"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1292,7 +1292,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_runtime_api"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "num-bigint",
  "num-traits",
@@ -1304,7 +1304,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_test262"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "oxide_bytecode",
  "oxide_compiler",
@@ -1321,7 +1321,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_types"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "bumpalo",
  "hashbrown 0.14.5",
@@ -1333,7 +1333,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_vm"
-version = "0.8.10"
+version = "0.8.11"
 dependencies = [
  "bumpalo",
  "chrono",

Cargo.toml

@@ -22,7 +22,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.8.10"
+version = "0.8.11"
 edition = "2021"
 license = "MIT"
 rust-version = "1.80"

crates/oxide_emit/src/compile_ctx.rs

@@ -153,12 +153,17 @@ pub struct CompileCtx {
     /// 拷贝的源也是寄存器，故 `emit_bind_target` 对集合内名字在 cell 写之外补写
     /// 绑定寄存器。init 发射完毕后清空。
     pub(crate) for_head_store_registers: HashSet<String>,
-    /// C 风格 for 头保留集：被闭包引用或与顶层 var/函数同名的头名。这些头名保留
+    /// 词法循环头保留集：C-for 填被闭包引用或与顶层 var/函数同名的头名，
-    /// 独立 cell 贯穿循环（体/test/update 走 cell），其余头名撤出覆盖回退寄存器循环。
+    /// for-in/for-of 填全头名（无撤出覆盖）。`emit_bind_target` 头名回填据此
-    /// 仅 C-for 填充（for-in/for-of 全头名保留，本集为空）；`emit_bind_target` 头名
+    /// 门控，非保留头名不置位绑定字段（否则体区读命中陈旧 cell 致死循环）。
-    /// 回填据此门控，非保留头名不置位绑定字段（否则体区读命中陈旧 cell 致死循环）。
+    /// C-for 在 init 发射完毕后清空；for-in/for-of 经 `restore_for_head_env`
-    /// begin 前按捕获集与顶层 tier 名计算，init 发射完毕后清空。
+    /// 逐头名移除。
     pub(crate) for_head_keep: HashSet<String>,
+    /// 词法头声明所在作用域深度（`push_scope` 后的 `scopes.len()`）：头名回填
+    /// 仅在该深度（for 语句自身作用域）的声明点执行；for 体内嵌套作用域的同名
+    /// 遮蔽声明与 catch 参数不在此深度，不触发回填，防遮蔽绑定的追加索引被头名
+    /// 索引覆写、声明写落入头绑定 cell。嵌套循环由 `ForHeadEnv` 保存前值并恢复。
+    pub(crate) for_head_depth: Option<usize>,
     /// 模块编译上下文：当前模块命名空间对象寄存器（`__moduleObject` 返回值）。
     pub(crate) module_ns_reg: Option<u32>,
     /// 写穿反演表：本模块源绑定槽寄存器 → 引用它的导出名集合。仅自导入 ns 的
@@ -278,6 +283,7 @@ impl CompileCtx {
             register_update_names: Vec::new(),
             for_head_store_registers: HashSet::new(),
             for_head_keep: HashSet::new(),
+            for_head_depth: None,
             module_ns_reg: None,
             module_local_export_regs: HashMap::new(),
             module_dep_ns_regs: HashMap::new(),
@@ -480,9 +486,11 @@ impl CompileCtx {
     /// 声明点 cell 索引解析：索引按绑定实例取（绑定自身字段是真源）。绑定未分配
     /// 索引时，词法循环头名（ForHeadEnv 覆盖捕获映射）走映射回退；最内层为块
     /// 作用域的就地声明（catch 参数）现场追加新索引并写回绑定，与函数级同名
-    /// 绑定的名字排序索引区分。名字不可见（隐式全局登记）或不在捕获集时返回
+    /// 绑定的名字排序索引区分。头名判定按作用域深度门控：仅 for 语句自身作用域
-    /// None，调用方落 with/全局臂。顶层 tier 名（顶层 var/函数）的全局对象属性
+    /// 的声明点是头绑定本身（走映射回退）；体内嵌套作用域的同名就地声明（catch
-    /// 是唯一存储，不建 cell，返回 None。
+    /// 参数）不属头绑定，走块级追加臂取独立索引，不共用头 cell。名字不可见（隐式
+    /// 全局登记）或不在捕获集时返回 None，调用方落 with/全局臂。顶层 tier 名
+    /// （顶层 var/函数）的全局对象属性是唯一存储，不建 cell，返回 None。
     ///
     /// # 副作用
     /// - 就地追加臂写回绑定 cell 索引并递增计数器；指令流不改动。
@@ -494,7 +502,7 @@ impl CompileCtx {
                 binding.cell_idx,
                 self.is_implicit_global_reg(binding.reg),
                 symbols.scopes.last().is_some_and(|s| s.kind == ScopeKind::BlockScope),
-                self.for_head_env_names.contains(name),
+                self.for_head_env_names.contains(name) && self.for_head_depth == Some(symbols.scopes.len()),
                 self.is_global_scope && self.global_tier_names.contains(name) && scope_idx == 0,
             )
         };

crates/oxide_emit/src/shared/binding.rs

@@ -81,8 +81,11 @@ impl Emitter {
         // 头名回填：for 头绑定（字段 None）把覆盖 cell 索引写进绑定字段，解析点
         // 按绑定身份取索引。保留集门控：C-for 仅保留头名置位（非保留头名走寄存器
         // 循环，置位会使体区读命中陈旧 cell 致死循环）；for-in/for-of 全头名保留。
+        // 深度门控：仅 for 语句自身作用域的声明点是头绑定声明点；体内嵌套作用域
+        // 的同名遮蔽声明与 catch 参数不在此深度，不回填（否则遮蔽绑定的追加索引
+        // 被头名索引覆写，声明写落入头绑定 cell 污染头值）。
         // 非 for 头绑定（函数级 / 块级 / catch 参数）已由各自路径置位，不在此覆盖。
-        if ctx.for_head_keep.contains(name) {
+        if ctx.for_head_keep.contains(name) && ctx.for_head_depth == Some(ctx.scopes.symbols.scopes.len()) {
             if let Some(&idx) = ctx.captured_bindings.get(name) {
                 ctx.set_binding_cell_idx(name, idx);
             }

crates/oxide_emit/src/stmt/iteration/for_in.rs

@@ -15,8 +15,11 @@ use oxide_parser::{ForStatementInit, ForStatementLeft, Statement, VariableDeclar
 
 /// for-in/for-of 词法头的捕获映射覆盖：每头名一条记录，依次为名字、旧条目
 /// （无旧条目为 None）、右值区 TDZ cell、体区 fresh cell（切换后填入）。
+/// `prev_depth` 保存进入时的 `for_head_depth` 前值，语句收尾恢复（嵌套循环
+/// 成对）。
 pub(crate) struct ForHeadEnv {
     entries: Vec<(String, Option<u8>, u8, u8)>,
+    prev_depth: Option<usize>,
 }
 
 impl Emitter {
@@ -75,6 +78,11 @@ impl Emitter {
     ///   `switch_for_head_env_to_body` 与 `restore_for_head_env` 成对收尾，
     ///   防头名泄漏进兄弟语句的捕获判定。
     pub(crate) fn begin_for_head_env(&self, names: Vec<String>, ctx: &mut CompileCtx) -> Result<ForHeadEnv, String> {
+        // 头名回填门控按作用域深度判定：本环境生效期间，仅 for 语句自身作用域
+        // （`push_scope` 后最内层）的声明点是头绑定声明点；体内嵌套作用域的同名
+        // 遮蔽声明不在此深度，不触发回填。
+        let prev_depth = ctx.for_head_depth;
+        ctx.for_head_depth = Some(ctx.scopes.symbols.scopes.len());
         let mut entries = Vec::with_capacity(names.len());
         for name in names {
             let saved = ctx.captured_bindings.remove(&name);
@@ -94,7 +102,7 @@ impl Emitter {
             ));
             entries.push((name, saved, tdz_idx, 0));
         }
-        Ok(ForHeadEnv { entries })
+        Ok(ForHeadEnv { entries, prev_depth })
     }
 
     /// 右值区求值完毕后把覆盖从 TDZ cell 切到体区 fresh cell：每头名分配新
@@ -144,6 +152,7 @@ impl Emitter {
             ctx.for_head_env_names.remove(&name);
             ctx.for_head_keep.remove(&name);
         }
+        ctx.for_head_depth = env.prev_depth;
     }
 
     pub(crate) fn emit_for_in_statement(&self, stmt: &Statement, ctx: &mut CompileCtx) -> Result<Option<u32>, String> {

crates/oxide_vm/tests/for_head_lex_tests.rs

@@ -205,3 +205,71 @@ fn c_for_let_head_non_captured_shadow_restores_outer_and_destructures() {
         "non-captured shadow restores the outer binding and destructuring heads bind leaf values"
     );
 }
+
+// ── for-in/for-of 头名与体内块级同名遮蔽 / catch 参数：头值不被污染 ──
+
+#[test]
+fn for_in_let_head_block_shadow_keeps_head_value() {
+    // 体内块级同名遮蔽声明：遮蔽绑定取独立追加索引，声明写落自身 cell，
+    // 头绑定值在本迭代剩余区间不被遮蔽值污染。
+    assert_eq!(
+        eval(
+            "var out = []; \
+             for (let x in {a:1, b:2}) { { let x = 100; } out.push(x); } \
+             out.length === 2 && out[0] === \"a\" && out[1] === \"b\""
+        ),
+        "true",
+        "a block-level shadow of the for-in head keeps the head value intact"
+    );
+}
+
+#[test]
+fn for_in_let_head_catch_param_keeps_head_value() {
+    // catch 参数与头名同名：参数就地声明取独立索引，异常值落参数自身 cell，
+    // 头绑定值不被异常值污染。
+    assert_eq!(
+        eval(
+            "var out = []; \
+             for (let x in {a:1, b:2}) { \
+               try { throw new Error(\"boom\"); } catch (x) { out.push(x instanceof Error); } \
+               out.push(x); \
+             } \
+             out.length === 4 && out[0] === true && out[1] === \"a\" && out[2] === true && out[3] === \"b\""
+        ),
+        "true",
+        "a catch parameter named like the for-in head keeps the head value intact"
+    );
+}
+
+#[test]
+fn for_of_let_head_block_shadow_keeps_head_value() {
+    // for-of 同形：体内块级同名遮蔽声明不污染头绑定值。
+    assert_eq!(
+        eval(
+            "var out = []; \
+             for (let x of [10, 20]) { { let x = 100; } out.push(x); } \
+             out.length === 2 && out[0] === 10 && out[1] === 20"
+        ),
+        "true",
+        "a block-level shadow of the for-of head keeps the head value intact"
+    );
+}
+
+#[test]
+fn c_for_head_catch_param_keeps_head_value() {
+    // C-for 头名加体内 catch 参数同名：参数就地声明取独立索引，异常值落参数
+    // 自身 cell，出 catch 块后头绑定读回迭代值、不被异常值污染。
+    assert_eq!(
+        eval(
+            "var out = []; \
+             for (let x = 0; x < 2; x++) { \
+               try { throw new Error(\"boom\"); } catch (x) { out.push(x instanceof Error); } \
+               out.push(typeof x); \
+             } \
+             out.length === 4 && out[0] === true && out[1] === \"number\" \
+               && out[2] === true && out[3] === \"number\""
+        ),
+        "true",
+        "a catch parameter named like a C-for head keeps the head value intact"
+    );
+}