Panic while executing eval inside block inside function

[jedel1043]

Describe the bug
The interpreter panics while executing the following snippet:

(function(){
  {
    eval("var x;")
  }
})();

Additional context
While doing some preliminar investigation, I realized functions don't push a new environment:

-------------------------Compiled Output: ''--------------------------
Location  Count   Opcode                     Operands

000000    0000    RestParameterPop           
000001    0001    PushDeclarativeEnvironment 0, 0
000010    0002    GetName                    0000: 'eval'
000015    0003    PushUndefined              
000016    0004    Swap                       
000017    0005    PushLiteral                0
000022    0006    CallEval                   1
000027    0007    Pop                        
000028    0008    PopEnvironment             
000029    0009    PushUndefined              
000030    0010    Return                     

Literals:
    0000: <string> "var x;"

Bindings:
    0000: eval

Functions:
    <empty>           

Notice how the inner block pushes a declarative environment, but the function doesn't. However, if you define argument initializers, the function pushes a function environment, and this fixes the bug:

(function(y=5){
  {
    eval("var x;")
  }
})();

-------------------------Compiled Output: ''--------------------------
Location  Count   Opcode                     Operands

000000    0000    JumpIfNotUndefined         7
000005    0001    PushInt8                   5
000007    0002    DefInitArg                 0000: 'y'
000012    0003    RestParameterPop           
000013    0004    PushFunctionEnvironment    0, 1
000022    0005    PushDeclarativeEnvironment 0, 0
000031    0006    GetName                    0001: 'eval'
000036    0007    PushUndefined              
000037    0008    Swap                       
000038    0009    PushLiteral                0
000043    0010    CallEval                   1
000048    0011    Pop                        
000049    0012    PopEnvironment             
000050    0013    PushUndefined              
000051    0014    Return                     

Literals:
    0000: <string> "var x;"

Bindings:
    0000: y
    0001: eval

Functions:
    <empty>

cc @raskad and @HalidOdat which are the most familiar with the vm.

[veera-sivarajan]

Hi, can I work on this?

[jedel1043]

@veera-sivarajan Nice! I think this issue is a good candidate to use our newest debugging tool: Instruction flowgraphs. This should be pretty useful to determine exactly how the VM is pushing and popping the environments.

[veera-sivarajan]

I have narrowed down the issue to this part where a new function environment is pushed only when the parameters have an expression.

boa/boa_engine/src/bytecompiler/function.rs

Lines 170 to 178 in 620dfd6

	let env_label = if parameters.has_expressions() {
	compiler.code_block.num_bindings = compiler.context.get_binding_number();
	compiler.context.push_compile_time_environment(true);
	compiler.code_block.function_environment_push_location =
	compiler.next_opcode_location();
	Some(compiler.emit_opcode_with_two_operands(Opcode::PushFunctionEnvironment))
	} else {
	None
	};

However, based on NOTE 1, 10.2.11.27 and 10.2.11.28 in the spec, the compiler should push either

1. A declarative environment and a function environment when parameters have expressions.
2. Only a function environment when parameters don't have expressions.

I attempted to implement that by conditionally (if parameters have expression) pushing an environment before parameters gets binded and popping it after the function statements are compiled but it did not work as expected. Would appreciate hearing your thoughts on how my approach can be improved.

cc @raskad and @HalidOdat