DebugEvaluate::Local previously permitted writes to variables still in
their temporal dead zone (TDZ) because ValueUnavailable used
ReconfigureToDataProperty as its setter callback. When evaluating an
assignment to an uninitialized lexical variable while paused, the
accessor was overwritten with a data property instead of throwing.
This patch adds ValueUnavailableSetter to throw a ReferenceError when
assigning to unavailable variables from the debugger. In addition,
ScopeIterator::ScopeObject now defines properties via
JSReceiver::CreateDataProperty so that creating or overwriting
properties on the scope object does not trigger accessors.
Furthermore, ScopeIterator::VisitLocalScope only sets
arguments_optimized_out when closure_scope has an unallocated
var named arguments, preventing shadowed arguments parameters or
lexical variables from incorrectly materializing an arguments object.
Fixed: 576721160, 576722814
Change-Id: I4c3156fa8dc8969e3b242faa42708bf8b673e8b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8669307
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#111235}
Benedikt Meurer
16c1b93a62