Correctness issue when shadowing parameters which are mutated

[bakkot]

This is in the "extremely obscure JS trivia" category of bug, not something anyone will ever run into if they're not looking for it. That said, if you do fix this and discover in the process that there's not a test262 test for it, let me know so I can file one.

Anyway, the bug:

function f(x = 0, read = () => x) {
  var x = 1;

  print('param x =', read());
  print('body x =', x);
}
f();

evaluated:

$ eshost -s weird-js/param-shadowing.js
#### Chakra, JavaScriptCore, node, SpiderMonkey, V8, V8 --harmony
param x = 0
body x = 1

#### XS
param x = 1
body x = 1

XS doesn't match the spec. This falls out of FunctionDeclarationInstantiation 28.f.i.2-5. Basically, the parameter named x and var declaration for x create two distinct variables, with the declaration in the body not being visible to expressions in the parameter lists; the variable in the body is initialized with the value of the parameter after execution of the parameter list ends, but should not reflect subsequent changes to it. In XS it seems there's only one variable created.

---

Another almost equivalent test, for completeness:

function f(x = 0, read = () => x, write = val => { x = val; }) {
  var x;

  write(1);
  print('param x =', read());
  print('body x =', x);
}
f();

evaluated

$ eshost -s weird-js/param-shadowing-2.js
#### Chakra, JavaScriptCore, node, SpiderMonkey, V8, V8 --harmony
param x = 1
body x = 0

#### XS
param x = 1
body x = 1