sukyoung / safe

Scalable Analysis Framework for ECMAScript
Other
118 stars 37 forks source link

Failed to conform to ES5.1, Section 10.2.1.1.3 SetMutableBinding (N,V,S), Step 4 #3

Closed daejunpark closed 9 years ago

daejunpark commented 9 years ago

It seems to me that SAFE does not conform to ES5.1, Section 10.2.1.1.3 SetMutableBinding (N,V,S), Step 4.

For the following test program:

// 10.2.1.1.3 SetMutableBinding (N,V,S), Step 4, if-condition is true

// 4. Else this must be an attempt to change the value of an immutable binding so if S if true throw a TypeError exception.

// In a strict mode, assigning an immutable binding throws TypeError.

// There are only two ways to create an immutable binding:
//   1. 'arguments' is an immutable binding in a strict mode function.
//   2. name of a recursive function expression (it should be a function 'expression', not a function 'declaration') is an immutable binding of the function body's environment.
// In the first case, assigning such binding raises a syntax error, in advance, in a strict mode code, thus it cannot reach here.
// Thus, assigning the second kind of binding is the only case that can reach here, and the below example represents this case.

// In the example below, 'g' is a name of recursive function expression, thus inside the function body, 'g' is a immutable binding.
// Note that 'g' is not visible outside of the function body, that is, it is not visible in a global scope.

"use strict";
var f = function g() {
  g = 0;
};
f(); // TypeError

SAFE failed to throw a TypeError exception:

$ ./bin/jsaf interpret 09.js
Normal(undefined)

Is there anything that I'm missing?

sukyoung commented 9 years ago

Thank you for the report. Currently, SAFE focuses on static analysis of JavaScript programs rather than interpretation of them. While the SAFE bug detector using static analysis results partially supports the strict mode, it does not support this particular case due to limited manpower.