@@ -1664,6 +1664,16 @@ IRBuilder::BuildReg1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot R0)
16641664 newOpcode = Js::OpCode::Ld_A;
16651665 break ;
16661666
1667+ case Js::OpCode::LdParamObj:
1668+ if (!m_func->GetJITFunctionBody ()->HasScopeObject ())
1669+ {
1670+ Js::Throw::FatalInternalError ();
1671+ }
1672+ srcOpnd = BuildSrcOpnd (m_func->GetJITFunctionBody ()->GetParamClosureReg ());
1673+ isNotInt = true ;
1674+ newOpcode = Js::OpCode::Ld_A;
1675+ break ;
1676+
16671677 case Js::OpCode::Throw:
16681678 {
16691679 srcOpnd = this ->BuildSrcOpnd (srcRegOpnd);
@@ -3504,9 +3514,9 @@ IRBuilder::BuildElementSlotI1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
35043514 IR::ByteCodeUsesInstr *byteCodeUse;
35053515 PropertySym *fieldSym = nullptr ;
35063516 StackSym * stackFuncPtrSym = nullptr ;
3507- SymID symID;
3517+ SymID symID = m_func-> GetJITFunctionBody ()-> GetLocalClosureReg () ;
35083518 bool isLdSlotThatWasNotProfiled = false ;
3509- uint scopeSlotSize = 0 ;
3519+ uint scopeSlotSize = m_func-> GetJITFunctionBody ()-> GetScopeSlotArraySize () ;
35103520 StackSym* closureSym = m_func->GetLocalClosureSym ();
35113521
35123522 switch (newOpcode)
@@ -3515,14 +3525,9 @@ IRBuilder::BuildElementSlotI1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
35153525 scopeSlotSize = m_func->GetJITFunctionBody ()->GetParamScopeSlotArraySize ();
35163526 closureSym = m_func->GetParamClosureSym ();
35173527 symID = m_func->GetJITFunctionBody ()->GetParamClosureReg ();
3518- fieldSym = PropertySym::New (closureSym, slotId, (uint32)-1 , (uint)-1 , PropertyKindSlots, m_func);
3519- goto LdLocalSlot;
3528+ // Fall through
35203529
35213530 case Js::OpCode::LdLocalSlot:
3522- scopeSlotSize = m_func->GetJITFunctionBody ()->GetScopeSlotArraySize ();
3523- symID = m_func->GetJITFunctionBody ()->GetLocalClosureReg ();
3524-
3525- LdLocalSlot:
35263531 if (PHASE_ON (Js::ClosureRangeCheckPhase, m_func))
35273532 {
35283533 if ((uint32)slotId >= scopeSlotSize + Js::ScopeSlots::FirstSlotIndex)
@@ -3562,7 +3567,7 @@ IRBuilder::BuildElementSlotI1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
35623567 this ->EnsureLoopBodyLoadSlot (symID);
35633568 }
35643569
3565- fieldSym = fieldSym ? fieldSym : PropertySym::FindOrCreate (symID, slotId, (uint32)-1 , (uint)-1 , PropertyKindSlots, m_func);
3570+ fieldSym = PropertySym::FindOrCreate (symID, slotId, (uint32)-1 , (uint)-1 , PropertyKindSlots, m_func);
35663571 fieldOpnd = IR::SymOpnd::New (fieldSym, TyVar, m_func);
35673572 regOpnd = this ->BuildDstOpnd (regSlot);
35683573 instr = nullptr ;
@@ -3587,12 +3592,9 @@ IRBuilder::BuildElementSlotI1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
35873592 closureSym = m_func->GetParamClosureSym ();
35883593 symID = m_func->GetJITFunctionBody ()->GetParamClosureReg ();
35893594 newOpcode = Js::OpCode::LdLocalObjSlot;
3590- goto LdLocalObjSlot;
3595+ // Fall through
35913596
35923597 case Js::OpCode::LdLocalObjSlot:
3593- symID = m_func->GetJITFunctionBody ()->GetLocalClosureReg ();
3594-
3595- LdLocalObjSlot:
35963598 if (closureSym->HasByteCodeRegSlot ())
35973599 {
35983600 byteCodeUse = IR::ByteCodeUsesInstr::New (m_func, offset);
@@ -3622,12 +3624,19 @@ IRBuilder::BuildElementSlotI1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
36223624 this ->AddInstr (instr, offset);
36233625 break ;
36243626
3627+ case Js::OpCode::StParamSlot:
3628+ case Js::OpCode::StParamSlotChkUndecl:
3629+ scopeSlotSize = m_func->GetJITFunctionBody ()->GetParamScopeSlotArraySize ();
3630+ closureSym = m_func->GetParamClosureSym ();
3631+ symID = m_func->GetJITFunctionBody ()->GetParamClosureReg ();
3632+ newOpcode = newOpcode == Js::OpCode::StParamSlot ? Js::OpCode::StLocalSlot : Js::OpCode::StLocalSlotChkUndecl;
3633+ // Fall through
3634+
36253635 case Js::OpCode::StLocalSlot:
36263636 case Js::OpCode::StLocalSlotChkUndecl:
3627-
36283637 if (PHASE_ON (Js::ClosureRangeCheckPhase, m_func))
36293638 {
3630- if ((uint32)slotId >= m_func-> GetJITFunctionBody ()-> GetScopeSlotArraySize () + Js::ScopeSlots::FirstSlotIndex)
3639+ if ((uint32)slotId >= scopeSlotSize + Js::ScopeSlots::FirstSlotIndex)
36313640 {
36323641 Js::Throw::FatalInternalError ();
36333642 }
@@ -3660,7 +3669,6 @@ IRBuilder::BuildElementSlotI1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
36603669 }
36613670 else
36623671 {
3663- symID = m_func->GetJITFunctionBody ()->GetLocalClosureReg ();
36643672 if (IsLoopBody ())
36653673 {
36663674 this ->EnsureLoopBodyLoadSlot (symID);
@@ -3683,9 +3691,15 @@ IRBuilder::BuildElementSlotI1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
36833691 }
36843692 break ;
36853693
3694+ case Js::OpCode::StParamObjSlot:
3695+ case Js::OpCode::StParamObjSlotChkUndecl:
3696+ closureSym = m_func->GetParamClosureSym ();
3697+ symID = m_func->GetJITFunctionBody ()->GetParamClosureReg ();
3698+ newOpcode = newOpcode == Js::OpCode::StParamObjSlot ? Js::OpCode::StLocalObjSlot : Js::OpCode::StLocalObjSlotChkUndecl;
3699+ // Fall through
3700+
36863701 case Js::OpCode::StLocalObjSlot:
36873702 case Js::OpCode::StLocalObjSlotChkUndecl:
3688-
36893703 if (closureSym->HasByteCodeRegSlot ())
36903704 {
36913705 byteCodeUse = IR::ByteCodeUsesInstr::New (m_func, offset);
@@ -3694,7 +3708,7 @@ IRBuilder::BuildElementSlotI1(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
36943708 }
36953709
36963710 regOpnd = IR::RegOpnd::New (TyVar, m_func);
3697- fieldOpnd = this ->BuildFieldOpnd (Js::OpCode::LdSlotArr, m_func-> GetJITFunctionBody ()-> GetLocalClosureReg () , (Js::DynamicObject::GetOffsetOfAuxSlots ())/sizeof (Js::Var), (Js::PropertyIdIndexType)-1 , PropertyKindSlotArray);
3711+ fieldOpnd = this ->BuildFieldOpnd (Js::OpCode::LdSlotArr, symID , (Js::DynamicObject::GetOffsetOfAuxSlots ())/sizeof (Js::Var), (Js::PropertyIdIndexType)-1 , PropertyKindSlotArray);
36983712 instr = IR::Instr::New (Js::OpCode::LdSlotArr, regOpnd, fieldOpnd, m_func);
36993713 this ->AddInstr (instr, offset);
37003714
@@ -6795,7 +6809,9 @@ IRBuilder::BuildEmpty(Js::OpCode newOpcode, uint32 offset)
67956809 this ->m_func ),
67966810 offset);
67976811
6798- if (this ->m_func ->GetJITFunctionBody ()->GetScopeSlotArraySize ())
6812+ // Create a new local closure for the body when either body scope has scope slots allocated or
6813+ // eval is present which can leak declarations.
6814+ if (this ->m_func ->GetJITFunctionBody ()->GetScopeSlotArraySize () > 0 || this ->m_func ->GetJITFunctionBody ()->HasScopeObject ())
67996815 {
68006816 if (this ->m_func ->GetJITFunctionBody ()->HasScopeObject ())
68016817 {
0 commit comments