From b650d11dd323c602a22ef64acd4c8f55dac6804a Mon Sep 17 00:00:00 2001
From: Andreas Kling <kling@serenityos.org>
Date: Fri, 25 Jun 2021 20:14:17 +0200
Subject: [PATCH] LibJS: FunctionEnvironment.[[FunctionObject]] is the
 *invoked* function

We were setting the wrong [[FunctionObject]] on the environment when
going through ProxyObject and BoundFunction.
---
 Userland/Libraries/LibJS/Runtime/BoundFunction.cpp  | 4 ++--
 Userland/Libraries/LibJS/Runtime/BoundFunction.h    | 2 +-
 Userland/Libraries/LibJS/Runtime/Function.h         | 2 +-
 Userland/Libraries/LibJS/Runtime/NativeFunction.cpp | 2 +-
 Userland/Libraries/LibJS/Runtime/NativeFunction.h   | 2 +-
 Userland/Libraries/LibJS/Runtime/ProxyObject.cpp    | 4 ++--
 Userland/Libraries/LibJS/Runtime/ProxyObject.h      | 2 +-
 Userland/Libraries/LibJS/Runtime/ScriptFunction.cpp | 4 ++--
 Userland/Libraries/LibJS/Runtime/ScriptFunction.h   | 2 +-
 Userland/Libraries/LibJS/Runtime/VM.cpp             | 4 ++--
 10 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/Userland/Libraries/LibJS/Runtime/BoundFunction.cpp b/Userland/Libraries/LibJS/Runtime/BoundFunction.cpp
index 73f7751f1c..2f7bf2d114 100644
--- a/Userland/Libraries/LibJS/Runtime/BoundFunction.cpp
+++ b/Userland/Libraries/LibJS/Runtime/BoundFunction.cpp
@@ -44,9 +44,9 @@ Value BoundFunction::construct(Function& new_target)
     return m_target_function->construct(new_target);
 }
 
-FunctionEnvironmentRecord* BoundFunction::create_environment_record()
+FunctionEnvironmentRecord* BoundFunction::create_environment_record(Function& function_being_invoked)
 {
-    return m_target_function->create_environment_record();
+    return m_target_function->create_environment_record(function_being_invoked);
 }
 
 void BoundFunction::visit_edges(Visitor& visitor)
diff --git a/Userland/Libraries/LibJS/Runtime/BoundFunction.h b/Userland/Libraries/LibJS/Runtime/BoundFunction.h
index bdee8f5195..15f597b54e 100644
--- a/Userland/Libraries/LibJS/Runtime/BoundFunction.h
+++ b/Userland/Libraries/LibJS/Runtime/BoundFunction.h
@@ -22,7 +22,7 @@ public:
 
     virtual Value construct(Function& new_target) override;
 
-    virtual FunctionEnvironmentRecord* create_environment_record() override;
+    virtual FunctionEnvironmentRecord* create_environment_record(Function&) override;
 
     virtual void visit_edges(Visitor&) override;
 
diff --git a/Userland/Libraries/LibJS/Runtime/Function.h b/Userland/Libraries/LibJS/Runtime/Function.h
index aae2e11e79..f8298515bb 100644
--- a/Userland/Libraries/LibJS/Runtime/Function.h
+++ b/Userland/Libraries/LibJS/Runtime/Function.h
@@ -26,7 +26,7 @@ public:
     virtual Value call() = 0;
     virtual Value construct(Function& new_target) = 0;
     virtual const FlyString& name() const = 0;
-    virtual FunctionEnvironmentRecord* create_environment_record() = 0;
+    virtual FunctionEnvironmentRecord* create_environment_record(Function&) = 0;
 
     BoundFunction* bind(Value bound_this_value, Vector<Value> arguments);
 
diff --git a/Userland/Libraries/LibJS/Runtime/NativeFunction.cpp b/Userland/Libraries/LibJS/Runtime/NativeFunction.cpp
index f0e711fd9a..a507b4bdbe 100644
--- a/Userland/Libraries/LibJS/Runtime/NativeFunction.cpp
+++ b/Userland/Libraries/LibJS/Runtime/NativeFunction.cpp
@@ -47,7 +47,7 @@ Value NativeFunction::construct(Function&)
     return {};
 }
 
-FunctionEnvironmentRecord* NativeFunction::create_environment_record()
+FunctionEnvironmentRecord* NativeFunction::create_environment_record(Function&)
 {
     return nullptr;
 }
diff --git a/Userland/Libraries/LibJS/Runtime/NativeFunction.h b/Userland/Libraries/LibJS/Runtime/NativeFunction.h
index 41a5b6ac3e..5b288f0338 100644
--- a/Userland/Libraries/LibJS/Runtime/NativeFunction.h
+++ b/Userland/Libraries/LibJS/Runtime/NativeFunction.h
@@ -34,7 +34,7 @@ protected:
     explicit NativeFunction(Object& prototype);
 
 private:
-    virtual FunctionEnvironmentRecord* create_environment_record() override final;
+    virtual FunctionEnvironmentRecord* create_environment_record(Function&) override final;
     virtual bool is_native_function() const final { return true; }
 
     FlyString m_name;
diff --git a/Userland/Libraries/LibJS/Runtime/ProxyObject.cpp b/Userland/Libraries/LibJS/Runtime/ProxyObject.cpp
index c7ede2b30e..69e2d4894f 100644
--- a/Userland/Libraries/LibJS/Runtime/ProxyObject.cpp
+++ b/Userland/Libraries/LibJS/Runtime/ProxyObject.cpp
@@ -478,10 +478,10 @@ const FlyString& ProxyObject::name() const
     return static_cast<Function&>(m_target).name();
 }
 
-FunctionEnvironmentRecord* ProxyObject::create_environment_record()
+FunctionEnvironmentRecord* ProxyObject::create_environment_record(Function& function_being_invoked)
 {
     VERIFY(is_function());
-    return static_cast<Function&>(m_target).create_environment_record();
+    return static_cast<Function&>(m_target).create_environment_record(function_being_invoked);
 }
 
 }
diff --git a/Userland/Libraries/LibJS/Runtime/ProxyObject.h b/Userland/Libraries/LibJS/Runtime/ProxyObject.h
index cc6bccec12..9cda19504b 100644
--- a/Userland/Libraries/LibJS/Runtime/ProxyObject.h
+++ b/Userland/Libraries/LibJS/Runtime/ProxyObject.h
@@ -22,7 +22,7 @@ public:
     virtual Value call() override;
     virtual Value construct(Function& new_target) override;
     virtual const FlyString& name() const override;
-    virtual FunctionEnvironmentRecord* create_environment_record() override;
+    virtual FunctionEnvironmentRecord* create_environment_record(Function&) override;
 
     const Object& target() const { return m_target; }
     const Object& handler() const { return m_handler; }
diff --git a/Userland/Libraries/LibJS/Runtime/ScriptFunction.cpp b/Userland/Libraries/LibJS/Runtime/ScriptFunction.cpp
index bf315675a3..523b6cdbd3 100644
--- a/Userland/Libraries/LibJS/Runtime/ScriptFunction.cpp
+++ b/Userland/Libraries/LibJS/Runtime/ScriptFunction.cpp
@@ -94,7 +94,7 @@ void ScriptFunction::visit_edges(Visitor& visitor)
     visitor.visit(m_parent_scope);
 }
 
-FunctionEnvironmentRecord* ScriptFunction::create_environment_record()
+FunctionEnvironmentRecord* ScriptFunction::create_environment_record(Function& function_being_invoked)
 {
     HashMap<FlyString, Variable> variables;
     for (auto& parameter : m_parameters) {
@@ -124,7 +124,7 @@ FunctionEnvironmentRecord* ScriptFunction::create_environment_record()
     }
 
     auto* environment = heap().allocate<FunctionEnvironmentRecord>(global_object(), m_parent_scope, variables);
-    environment->set_function_object(*this);
+    environment->set_function_object(function_being_invoked);
     if (m_is_arrow_function) {
         if (is<FunctionEnvironmentRecord>(m_parent_scope))
             environment->set_new_target(static_cast<FunctionEnvironmentRecord*>(m_parent_scope)->new_target());
diff --git a/Userland/Libraries/LibJS/Runtime/ScriptFunction.h b/Userland/Libraries/LibJS/Runtime/ScriptFunction.h
index 8c409605f4..db33441031 100644
--- a/Userland/Libraries/LibJS/Runtime/ScriptFunction.h
+++ b/Userland/Libraries/LibJS/Runtime/ScriptFunction.h
@@ -41,7 +41,7 @@ protected:
     virtual bool is_strict_mode() const final { return m_is_strict; }
 
 private:
-    virtual FunctionEnvironmentRecord* create_environment_record() override;
+    virtual FunctionEnvironmentRecord* create_environment_record(Function&) override;
     virtual void visit_edges(Visitor&) override;
 
     Value execute_function_body();
diff --git a/Userland/Libraries/LibJS/Runtime/VM.cpp b/Userland/Libraries/LibJS/Runtime/VM.cpp
index c3a54da5e5..4ee43892f9 100644
--- a/Userland/Libraries/LibJS/Runtime/VM.cpp
+++ b/Userland/Libraries/LibJS/Runtime/VM.cpp
@@ -425,7 +425,7 @@ Value VM::construct(Function& function, Function& new_target, Optional<MarkedVal
     callee_context.arguments = function.bound_arguments();
     if (arguments.has_value())
         callee_context.arguments.extend(arguments.value().values());
-    auto* environment = function.create_environment_record();
+    auto* environment = function.create_environment_record(function);
     callee_context.lexical_environment = environment;
     callee_context.variable_environment = environment;
     if (environment)
@@ -529,7 +529,7 @@ Value VM::call_internal(Function& function, Value this_value, Optional<MarkedVal
     callee_context.arguments = function.bound_arguments();
     if (arguments.has_value())
         callee_context.arguments.extend(arguments.value().values());
-    auto* environment = function.create_environment_record();
+    auto* environment = function.create_environment_record(function);
     callee_context.lexical_environment = environment;
     callee_context.variable_environment = environment;