[Interpreter] Handles legacy constants in strict mode.

Function bindings are the only variables in LEGACY_CONST mode.
(https://codereview.chromium.org/1819123002/). Since these variables
can also be accessed in strict mode functions we should support
handling such variables. Assigning to a legacy constant throws
a TypeError in strict mode. Also fixes hydrogen.cc to throw a
TypeError for legacy constants.

BUG=v8:4280,chromium:599068
LOG=N
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1845223006

Cr-Commit-Position: refs/heads/master@{#35383}

src/crankshaft/hydrogen.cc

@@ -7154,7 +7154,11 @@ void HOptimizedGraphBuilder::HandleCompoundAssignment(Assignment* expr) {
           case CONST:
             return Bailout(kNonInitializerAssignmentToConst);
           case CONST_LEGACY:
+            if (is_strict(function_language_mode())) {
+              return Bailout(kNonInitializerAssignmentToConst);
+            } else {
               return ast_context()->ReturnValue(Pop());
+            }
           default:
             mode = HStoreContextSlot::kNoCheck;
         }
@@ -7222,7 +7226,9 @@ void HOptimizedGraphBuilder::VisitAssignment(Assignment* expr) {
         return Bailout(kNonInitializerAssignmentToConst);
       }
     } else if (var->mode() == CONST_LEGACY) {
-      if (expr->op() != Token::INIT) {
+      if (expr->op() != Token::INIT && is_strict(function_language_mode())) {
+        return Bailout(kNonInitializerAssignmentToConst);
+      } else if (expr->op() != Token::INIT) {
         CHECK_ALIVE(VisitForValue(expr->value()));
         return ast_context()->ReturnValue(Pop());
       }

src/interpreter/bytecode-generator.cc

@@ -1970,11 +1970,15 @@ void BytecodeGenerator::VisitVariableAssignment(Variable* variable,
           // Break here because the value should not be stored unconditionally.
           break;
         } else if (mode == CONST_LEGACY && op != Token::INIT) {
-          DCHECK(!is_strict(language_mode()));
+          if (is_strict(language_mode())) {
+            builder()->CallRuntime(Runtime::kThrowConstAssignError, Register(),
+                                   0);
+          } else {
             // Ensure accumulator is in the correct state.
             builder()->LoadAccumulatorWithRegister(value_temp);
-          // Break here, non-initializing assignments to legacy constants are
-          // ignored.
+          }
+          // Non-initializing assignments to legacy constants are ignored
+          // in sloppy mode. Break here to avoid storing into variable.
           break;
         } else {
           BuildHoleCheckForVariableAssignment(variable, op);
@@ -2037,11 +2041,15 @@ void BytecodeGenerator::VisitVariableAssignment(Variable* variable,
           // The above code performs the store conditionally.
           break;
         } else if (mode == CONST_LEGACY && op != Token::INIT) {
-          DCHECK(!is_strict(language_mode()));
+          if (is_strict(language_mode())) {
+            builder()->CallRuntime(Runtime::kThrowConstAssignError, Register(),
+                                   0);
+          } else {
             // Ensure accumulator is in the correct state.
             builder()->LoadAccumulatorWithRegister(value_temp);
-          // Break here, non-initializing assignments to legacy constants are
-          // ignored.
+          }
+          // Non-initializing assignments to legacy constants are ignored
+          // in sloppy mode. Break here to avoid storing into variable.
           break;
         } else {
           BuildHoleCheckForVariableAssignment(variable, op);
@@ -2068,9 +2076,6 @@ void BytecodeGenerator::VisitVariableAssignment(Variable* variable,
             .LoadLiteral(variable->name())
             .StoreAccumulatorInRegister(name)
             .CallRuntime(Runtime::kInitializeLegacyConstLookupSlot, value, 3);
-      } else if (mode == CONST_LEGACY && op != Token::INIT) {
-        // Non-intializing assignments to legacy constants are ignored.
-        DCHECK(!is_strict(language_mode()));
       } else {
         builder()->StoreLookupSlot(variable->name(), language_mode());
       }

test/mjsunit/regress/regress-599068-func-bindings.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests function bindings are correctly handled in ignition.
+(function f() {
+  function assignSloppy() {
+    f = 0;
+  }
+  assertDoesNotThrow(assignSloppy);
+
+  function assignStrict() {
+    'use strict';
+    f = 0;
+  }
+  assertThrows(assignStrict, TypeError);
+
+  function assignStrictLookup() {
+    eval("'use strict'; f = 1;");
+  }
+  assertThrows(assignStrictLookup, TypeError);
+})();
+
+// Tests for compound assignments which are handled differently
+// in crankshaft.
+(function f() {
+  function assignSloppy() {
+    f += "x";
+  }
+  assertDoesNotThrow(assignSloppy);
+  assertDoesNotThrow(assignSloppy);
+  %OptimizeFunctionOnNextCall(assignSloppy);
+  assertDoesNotThrow(assignSloppy);
+
+  function assignStrict() {
+    'use strict';
+    f += "x";
+  }
+  assertThrows(assignStrict, TypeError);
+  assertThrows(assignStrict, TypeError);
+  %OptimizeFunctionOnNextCall(assignStrict);
+  assertThrows(assignStrict, TypeError);
+})();