[parser] Restore reparenting of temporaries

Now that we have no more do-expressions, we don't need to reparent variables
and declarations anymore. However, it's still possible that temporaries were
implicitly allocated. We still need to move those.

Bug: chromium:904255
Change-Id: Ia8a90eb822b9db123ffb0bad58e4b720c1452d9f
Reviewed-on: https://chromium-review.googlesource.com/c/1329685Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57424}

src/ast/scopes.cc

@@ -880,6 +880,17 @@ void Scope::Snapshot::Reparent(DeclarationScope* new_parent) const {
     outer_scope_->unresolved_list_.ReinitializeHead(top_unresolved_);
   }
 
+  // Move temporaries allocated for complex parameter initializers.
+  DeclarationScope* outer_closure = outer_scope_->GetClosureScope();
+  new_parent->locals_.MoveTail(outer_closure->locals(), top_local_);
+  for (Variable* local : new_parent->locals_) {
+    DCHECK_EQ(VariableMode::kTemporary, local->mode());
+    DCHECK_EQ(local->scope(), local->scope()->GetClosureScope());
+    DCHECK_NE(local->scope(), new_parent);
+    local->set_scope(new_parent);
+  }
+  outer_closure->locals_.Rewind(top_local_);
+
   // Move eval calls since Snapshot's creation into new_parent.
   if (outer_scope_->scope_calls_eval_) {
     new_parent->scope_calls_eval_ = true;

src/ast/scopes.h

@@ -122,13 +122,7 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
 
   class Snapshot final {
    public:
-    explicit Snapshot(Scope* scope)
-        : outer_scope_and_calls_eval_(scope, scope->scope_calls_eval_),
-          top_inner_scope_(scope->inner_scope_),
-          top_unresolved_(scope->unresolved_list_.first()) {
-      // Reset in order to record eval calls during this Snapshot's lifetime.
-      outer_scope_and_calls_eval_.GetPointer()->scope_calls_eval_ = false;
-    }
+    inline explicit Snapshot(Scope* scope);
     ~Snapshot() {
       // Restore previous calls_eval bit if needed.
       if (outer_scope_and_calls_eval_.GetPayload()) {
@@ -142,6 +136,7 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
     PointerWithPayload<Scope, bool, 1> outer_scope_and_calls_eval_;
     Scope* top_inner_scope_;
     VariableProxy* top_unresolved_;
+    base::ThreadedList<Variable>::Iterator top_local_;
   };
 
   enum class DeserializationMode { kIncludingVariables, kScopesOnly };
@@ -1049,6 +1044,15 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
   RareData* rare_data_ = nullptr;
 };
 
+Scope::Snapshot::Snapshot(Scope* scope)
+    : outer_scope_and_calls_eval_(scope, scope->scope_calls_eval_),
+      top_inner_scope_(scope->inner_scope_),
+      top_unresolved_(scope->unresolved_list_.first()),
+      top_local_(scope->GetClosureScope()->locals_.end()) {
+  // Reset in order to record eval calls during this Snapshot's lifetime.
+  outer_scope_and_calls_eval_.GetPointer()->scope_calls_eval_ = false;
+}
+
 class ModuleScope final : public DeclarationScope {
  public:
   ModuleScope(DeclarationScope* script_scope,

test/mjsunit/regress/regress-904255.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("((__v_0 = __v_0.replace(...new Array(), '0').slice(...new Int32Array(), '0')) => print())()", ReferenceError);