ITStudio_OUC/OxideJS-New
0
1
Fork 0
mirror of https://github.com/pjh456/OxideJS.git synced 2026-10-23 18:21:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: for 头名回填加作用域深度门控防体内同名遮蔽覆写头 cell

Browse Source
This commit is contained in:
彭俊皓
2026-10-05 17:30:42 +00:00
parent 6cb7964764
commit 75810cb8e7
6 changed files with 118 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+18 -18
View File
@@ -1095,7 +1095,7 @@ dependencies = [
[[package]]
name = "oxide_builtins"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"chrono",
"fast-float",
@@ -1120,7 +1120,7 @@ dependencies = [
[[package]]
name = "oxide_bytecode"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"num-bigint",
"oxide_log",
@@ -1128,7 +1128,7 @@ dependencies = [
[[package]]
name = "oxide_cfg"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"oxide_bytecode",
"oxide_emit",
@@ -1139,7 +1139,7 @@ dependencies = [
[[package]]
name = "oxide_cli"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"ansi_term",
"bumpalo",
@@ -1159,7 +1159,7 @@ dependencies = [
[[package]]
name = "oxide_code_cache"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"lru",
"oxide_bytecode",
@@ -1168,7 +1168,7 @@ dependencies = [
[[package]]
name = "oxide_compiler"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"oxide_bytecode",
"oxide_cfg",
@@ -1187,7 +1187,7 @@ dependencies = [
[[package]]
name = "oxide_dce"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"oxide_bytecode",
"oxide_cfg",
@@ -1201,7 +1201,7 @@ dependencies = [
[[package]]
name = "oxide_emit"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"num-bigint",
"oxc_allocator",
@@ -1216,7 +1216,7 @@ dependencies = [
[[package]]
name = "oxide_ir"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"oxide_bytecode",
"oxide_log",
@@ -1225,7 +1225,7 @@ dependencies = [
[[package]]
name = "oxide_kernel"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"bumpalo",
"dashmap",
@@ -1240,7 +1240,7 @@ dependencies = [
[[package]]
name = "oxide_liveness"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"oxide_bytecode",
"oxide_cfg",
@@ -1252,7 +1252,7 @@ dependencies = [
[[package]]
name = "oxide_log"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"tracing",
"tracing-appender",
@@ -1261,7 +1261,7 @@ dependencies = [
[[package]]
name = "oxide_parser"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"oxc_allocator",
"oxc_ast",
@@ -1276,7 +1276,7 @@ dependencies = [
[[package]]
name = "oxide_regalloc"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"oxide_bytecode",
"oxide_cfg",
@@ -1292,7 +1292,7 @@ dependencies = [
[[package]]
name = "oxide_runtime_api"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"num-bigint",
"num-traits",
@@ -1304,7 +1304,7 @@ dependencies = [
[[package]]
name = "oxide_test262"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"oxide_bytecode",
"oxide_compiler",
@@ -1321,7 +1321,7 @@ dependencies = [
[[package]]
name = "oxide_types"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"bumpalo",
"hashbrown 0.14.5",
@@ -1333,7 +1333,7 @@ dependencies = [
[[package]]
name = "oxide_vm"
version = "0.8.10"
version = "0.8.11"
dependencies = [
"bumpalo",
"chrono",
Cargo.toml
+1 -1
View File
@@ -22,7 +22,7 @@ members = [
]
[workspace.package]
version = "0.8.10"
version = "0.8.11"
edition = "2021"
license = "MIT"
rust-version = "1.80"
crates/oxide_emit/src/compile_ctx.rs
+17 -9
View File
@@ -153,12 +153,17 @@ pub struct CompileCtx {
/// 拷贝的源也是寄存器，故 `emit_bind_target` 对集合内名字在 cell 写之外补写
/// 绑定寄存器。init 发射完毕后清空。
pub(crate) for_head_store_registers: HashSet<String>,
/// C 风格 for 头保留集：被闭包引用或与顶层 var/函数同名的头名。这些头名保留
/// 独立 cell 贯穿循环（体/test/update 走 cell），其余头名撤出覆盖回退寄存器循环。
/// 仅 C-for 填充（for-in/for-of 全头名保留，本集为空）；`emit_bind_target` 头名
/// 回填据此门控，非保留头名不置位绑定字段（否则体区读命中陈旧 cell 致死循环）。
/// begin 前按捕获集与顶层 tier 名计算，init 发射完毕后清空。
/// 词法循环头保留集：C-for 填被闭包引用或与顶层 var/函数同名的头名，
/// for-in/for-of 填全头名（无撤出覆盖）。`emit_bind_target` 头名回填据此
/// 门控，非保留头名不置位绑定字段（否则体区读命中陈旧 cell 致死循环）。
/// C-for 在 init 发射完毕后清空；for-in/for-of 经 `restore_for_head_env`
/// 逐头名移除。
pub(crate) for_head_keep: HashSet<String>,
/// 词法头声明所在作用域深度（`push_scope` 后的 `scopes.len()`）：头名回填
/// 仅在该深度（for 语句自身作用域）的声明点执行；for 体内嵌套作用域的同名
/// 遮蔽声明与 catch 参数不在此深度，不触发回填，防遮蔽绑定的追加索引被头名
/// 索引覆写、声明写落入头绑定 cell。嵌套循环由 `ForHeadEnv` 保存前值并恢复。
pub(crate) for_head_depth: Option<usize>,
/// 模块编译上下文：当前模块命名空间对象寄存器（`__moduleObject` 返回值）。
pub(crate) module_ns_reg: Option<u32>,
/// 写穿反演表：本模块源绑定槽寄存器 → 引用它的导出名集合。仅自导入 ns 的
@@ -278,6 +283,7 @@ impl CompileCtx {
register_update_names: Vec::new(),
for_head_store_registers: HashSet::new(),
for_head_keep: HashSet::new(),
for_head_depth: None,
module_ns_reg: None,
module_local_export_regs: HashMap::new(),
module_dep_ns_regs: HashMap::new(),
@@ -480,9 +486,11 @@ impl CompileCtx {
/// 声明点 cell 索引解析：索引按绑定实例取（绑定自身字段是真源）。绑定未分配
/// 索引时，词法循环头名（ForHeadEnv 覆盖捕获映射）走映射回退；最内层为块
/// 作用域的就地声明（catch 参数）现场追加新索引并写回绑定，与函数级同名
/// 绑定的名字排序索引区分。名字不可见（隐式全局登记）或不在捕获集时返回
/// None，调用方落 with/全局臂。顶层 tier 名（顶层 var/函数）的全局对象属性
/// 是唯一存储，不建 cell，返回 None。
/// 绑定的名字排序索引区分。头名判定按作用域深度门控：仅 for 语句自身作用域
/// 的声明点是头绑定本身（走映射回退）；体内嵌套作用域的同名就地声明（catch
/// 参数）不属头绑定，走块级追加臂取独立索引，不共用头 cell。名字不可见（隐式
/// 全局登记）或不在捕获集时返回 None，调用方落 with/全局臂。顶层 tier 名
/// （顶层 var/函数）的全局对象属性是唯一存储，不建 cell，返回 None。
///
/// # 副作用
/// - 就地追加臂写回绑定 cell 索引并递增计数器；指令流不改动。
@@ -494,7 +502,7 @@ impl CompileCtx {
binding.cell_idx,
self.is_implicit_global_reg(binding.reg),
symbols.scopes.last().is_some_and(|s| s.kind == ScopeKind::BlockScope),
self.for_head_env_names.contains(name),
self.for_head_env_names.contains(name) && self.for_head_depth == Some(symbols.scopes.len()),
self.is_global_scope && self.global_tier_names.contains(name) && scope_idx == 0,
)
};
crates/oxide_emit/src/shared/binding.rs
+4 -1
View File
@@ -81,8 +81,11 @@ impl Emitter {
// 头名回填：for 头绑定（字段 None）把覆盖 cell 索引写进绑定字段，解析点
// 按绑定身份取索引。保留集门控：C-for 仅保留头名置位（非保留头名走寄存器
// 循环，置位会使体区读命中陈旧 cell 致死循环）；for-in/for-of 全头名保留。
// 深度门控：仅 for 语句自身作用域的声明点是头绑定声明点；体内嵌套作用域
// 的同名遮蔽声明与 catch 参数不在此深度，不回填（否则遮蔽绑定的追加索引
// 被头名索引覆写，声明写落入头绑定 cell 污染头值）。
// 非 for 头绑定（函数级 / 块级 / catch 参数）已由各自路径置位，不在此覆盖。
if ctx.for_head_keep.contains(name) {
if ctx.for_head_keep.contains(name) && ctx.for_head_depth == Some(ctx.scopes.symbols.scopes.len()) {
if let Some(&idx) = ctx.captured_bindings.get(name) {
ctx.set_binding_cell_idx(name, idx);
}
crates/oxide_emit/src/stmt/iteration/for_in.rs
+10 -1
View File
@@ -15,8 +15,11 @@ use oxide_parser::{ForStatementInit, ForStatementLeft, Statement, VariableDeclar
/// for-in/for-of 词法头的捕获映射覆盖：每头名一条记录，依次为名字、旧条目
/// （无旧条目为 None）、右值区 TDZ cell、体区 fresh cell（切换后填入）。
/// `prev_depth` 保存进入时的 `for_head_depth` 前值，语句收尾恢复（嵌套循环
/// 成对）。
pub(crate) struct ForHeadEnv {
entries: Vec<(String, Option<u8>, u8, u8)>,
prev_depth: Option<usize>,
}
impl Emitter {
@@ -75,6 +78,11 @@ impl Emitter {
/// `switch_for_head_env_to_body` 与 `restore_for_head_env` 成对收尾，
/// 防头名泄漏进兄弟语句的捕获判定。
pub(crate) fn begin_for_head_env(&self, names: Vec<String>, ctx: &mut CompileCtx) -> Result<ForHeadEnv, String> {
// 头名回填门控按作用域深度判定：本环境生效期间，仅 for 语句自身作用域
// （`push_scope` 后最内层）的声明点是头绑定声明点；体内嵌套作用域的同名
// 遮蔽声明不在此深度，不触发回填。
let prev_depth = ctx.for_head_depth;
ctx.for_head_depth = Some(ctx.scopes.symbols.scopes.len());
let mut entries = Vec::with_capacity(names.len());
for name in names {
let saved = ctx.captured_bindings.remove(&name);
@@ -94,7 +102,7 @@ impl Emitter {
));
entries.push((name, saved, tdz_idx, 0));
}
Ok(ForHeadEnv { entries })
Ok(ForHeadEnv { entries, prev_depth })
}
/// 右值区求值完毕后把覆盖从 TDZ cell 切到体区 fresh cell：每头名分配新
@@ -144,6 +152,7 @@ impl Emitter {
ctx.for_head_env_names.remove(&name);
ctx.for_head_keep.remove(&name);
}
ctx.for_head_depth = env.prev_depth;
}
pub(crate) fn emit_for_in_statement(&self, stmt: &Statement, ctx: &mut CompileCtx) -> Result<Option<u32>, String> {
crates/oxide_vm/tests/for_head_lex_tests.rs
+68
View File
@@ -205,3 +205,71 @@ fn c_for_let_head_non_captured_shadow_restores_outer_and_destructures() {
"non-captured shadow restores the outer binding and destructuring heads bind leaf values"
);
}
// ── for-in/for-of 头名与体内块级同名遮蔽 / catch 参数：头值不被污染 ──
#[test]
fn for_in_let_head_block_shadow_keeps_head_value() {
// 体内块级同名遮蔽声明：遮蔽绑定取独立追加索引，声明写落自身 cell，
// 头绑定值在本迭代剩余区间不被遮蔽值污染。
assert_eq!(
eval(
"var out = []; \
for (let x in {a:1, b:2}) { { let x = 100; } out.push(x); } \
out.length === 2 && out[0] === \"a\" && out[1] === \"b\""
),
"true",
"a block-level shadow of the for-in head keeps the head value intact"
);
}
#[test]
fn for_in_let_head_catch_param_keeps_head_value() {
// catch 参数与头名同名：参数就地声明取独立索引，异常值落参数自身 cell，
// 头绑定值不被异常值污染。
assert_eq!(
eval(
"var out = []; \
for (let x in {a:1, b:2}) { \
try { throw new Error(\"boom\"); } catch (x) { out.push(x instanceof Error); } \
out.push(x); \
} \
out.length === 4 && out[0] === true && out[1] === \"a\" && out[2] === true && out[3] === \"b\""
),
"true",
"a catch parameter named like the for-in head keeps the head value intact"
);
}
#[test]
fn for_of_let_head_block_shadow_keeps_head_value() {
// for-of 同形：体内块级同名遮蔽声明不污染头绑定值。
assert_eq!(
eval(
"var out = []; \
for (let x of [10, 20]) { { let x = 100; } out.push(x); } \
out.length === 2 && out[0] === 10 && out[1] === 20"
),
"true",
"a block-level shadow of the for-of head keeps the head value intact"
);
}
#[test]
fn c_for_head_catch_param_keeps_head_value() {
// C-for 头名加体内 catch 参数同名：参数就地声明取独立索引，异常值落参数
// 自身 cell，出 catch 块后头绑定读回迭代值、不被异常值污染。
assert_eq!(
eval(
"var out = []; \
for (let x = 0; x < 2; x++) { \
try { throw new Error(\"boom\"); } catch (x) { out.push(x instanceof Error); } \
out.push(typeof x); \
} \
out.length === 4 && out[0] === true && out[1] === \"number\" \
&& out[2] === true && out[3] === \"number\""
),
"true",
"a catch parameter named like a C-for head keeps the head value intact"
);
}