From 58257040dcf36de9958a6e4c52b8a20ef72e2f4a Mon Sep 17 00:00:00 2001
From: Robert Fancsik <frobert@inf.u-szeged.hu>
Date: Wed, 15 Apr 2020 18:08:58 +0200
Subject: [PATCH] Fix lexical binding set in VM_OC_COPY_TO_GLOBAL (#3653)

This patch fixes #3647.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
---
 jerry-core/vm/vm.c                            | 38 +++++++++++++------
 .../es2015/regression-test-issue-3647.js      | 19 ++++++++++
 2 files changed, 46 insertions(+), 11 deletions(-)
 create mode 100644 tests/jerry/es2015/regression-test-issue-3647.js

diff --git a/jerry-core/vm/vm.c b/jerry-core/vm/vm.c
index f887a82bc..84c97e7fb 100644
--- a/jerry-core/vm/vm.c
+++ b/jerry-core/vm/vm.c
@@ -1516,36 +1516,52 @@ vm_loop (vm_frame_ctx_t *frame_ctx_p) /**< frame context */
 
           while (lex_env_p->type_flags_refs & ECMA_OBJECT_FLAG_BLOCK)
           {
-#if ENABLED (JERRY_ES2015) && !(defined JERRY_NDEBUG)
+#ifndef JERRY_NDEBUG
             if (ecma_get_lex_env_type (lex_env_p) == ECMA_LEXICAL_ENVIRONMENT_DECLARATIVE)
             {
               ecma_property_t *property_p = ecma_find_named_property (lex_env_p, name_p);
 
               JERRY_ASSERT (property_p == NULL || !(*property_p & ECMA_PROPERTY_FLAG_ENUMERABLE));
             }
-#endif /* ENABLED (JERRY_ES2015) && !JERRY_NDEBUG */
+#endif /* !JERRY_NDEBUG */
 
             JERRY_ASSERT (lex_env_p->u2.outer_reference_cp != JMEM_CP_NULL);
             lex_env_p = ECMA_GET_NON_NULL_POINTER (ecma_object_t, lex_env_p->u2.outer_reference_cp);
           }
 
-#if ENABLED (JERRY_ES2015) && !(defined JERRY_NDEBUG)
           if (ecma_get_lex_env_type (lex_env_p) == ECMA_LEXICAL_ENVIRONMENT_DECLARATIVE)
           {
             ecma_property_t *property_p = ecma_find_named_property (lex_env_p, name_p);
+            ecma_property_value_t *prop_value_p;
 
-            JERRY_ASSERT (property_p == NULL || !(*property_p & ECMA_PROPERTY_FLAG_ENUMERABLE));
+            if (property_p == NULL)
+            {
+              prop_value_p = ecma_create_named_data_property (lex_env_p,
+                                                              name_p,
+                                                              ECMA_PROPERTY_FLAG_WRITABLE,
+                                                              NULL);
+            }
+            else
+            {
+#ifndef JERRY_NDEBUG
+              JERRY_ASSERT (!(*property_p & ECMA_PROPERTY_FLAG_ENUMERABLE));
+#endif /* !JERRY_NDEBUG */
+              prop_value_p = ECMA_PROPERTY_VALUE_PTR (property_p);
+            }
+
+            ecma_named_data_property_assign_value (lex_env_p, prop_value_p, left_value);
           }
-#endif /* ENABLED (JERRY_ES2015) && !JERRY_NDEBUG */
-
-          result = vm_set_var (lex_env_p, name_p, is_strict, left_value);
-
-          if (ECMA_IS_VALUE_ERROR (result))
+          else
           {
-            goto error;
+            result = ecma_op_set_mutable_binding (lex_env_p, name_p, left_value, is_strict);
+
+            if (ECMA_IS_VALUE_ERROR (result))
+            {
+              goto error;
+            }
           }
 
-          continue;
+          goto free_left_value;
         }
         case VM_OC_CLONE_CONTEXT:
         {
diff --git a/tests/jerry/es2015/regression-test-issue-3647.js b/tests/jerry/es2015/regression-test-issue-3647.js
new file mode 100644
index 000000000..d595591ca
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-3647.js
@@ -0,0 +1,19 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+f();
+let g;
+function f() {
+  assert(eval('function g() { return 5}; g')() === 5);
+}