Deoptimize all parameters when losing track of a function (#5158)

src/ast/nodes/shared/FunctionBase.ts

@@ -74,8 +74,13 @@ export default abstract class FunctionBase extends NodeBase {
 		this.getObjectEntity().deoptimizePath(path);
 		if (path.length === 1 && path[0] === UnknownKey) {
 			// A reassignment of UNKNOWN_PATH is considered equivalent to having lost track
-			// which means the return expression needs to be reassigned
+			// which means the return expression and parameters need to be reassigned
 			this.scope.getReturnExpression().deoptimizePath(UNKNOWN_PATH);
+			for (const parameterList of this.scope.parameters) {
+				for (const parameter of parameterList) {
+					parameter.deoptimizePath(UNKNOWN_PATH);
+				}
+			}
 		}
 	}
 

test/function/samples/mutate-via-parameter/_config.js

@@ -0,0 +1,9 @@
+const assert = require('node:assert');
+
+module.exports = defineTest({
+	description:
+		'respects variable mutations via unknown parameter values if we lose track of a function',
+	exports({ test }) {
+		assert.ok(test(state => (state.modified = true)));
+	}
+});

test/function/samples/mutate-via-parameter/main.js

@@ -0,0 +1,8 @@
+export function test(callback) {
+	const state = {
+		modified: false
+	};
+	callback(state);
+	if (state.modified) return true;
+	return false;
+}