Parent: #498; related: #465, #491.
Executed on 27d58465 using its saved production binary:
function leaf(arguments) { return arguments[0]; }
leaf(3)Node and forced tree-walker execution return undefined; required bytecode returns 3.
function leaf(arguments, other) { return arguments[0] + arguments[1]; }
leaf(2, 3)Node and tree-walker return NaN; required bytecode returns 5. Ordinary and duplicate-parameter controls without an arguments formal return 5 in all three executions.
compileQuickArgumentsLeaf treats every accepted arguments[index] AST read as an incoming argument. Its current simple-parameter guard does not establish that the identifier resolves to the function's arguments object. FunctionDeclarationInstantiation instead uses the formal parameter binding when the formal list binds arguments.
Required change:
- Decline arguments-object scalar replacement when a formal parameter binds
arguments; use ordinary parameter and identifier semantics. - Retain bounded specialization for genuine arguments-object reads and ordinary duplicate parameters.
- Preserve live property access/coercion, exact steps, checkpoints, hooks, GC roots, and no-GIL behavior.
Definition of done:
- Executed shadowed-formal regressions match Node in forced tree and required-bytecode modes.
- Positive controls still reach the arguments-leaf fast path; rejected shadowed forms do not.
- Focused Debug, ReleaseSafe, unsuppressed TSan, real-GC, and no-GIL coverage passes.
- Before/after affected Test262 path sets are compared with a nonzero denominator; the quickening inventory describes the binding guard.