Correctly handle named function expressions when saving ScopeInfo

Previous fix for a similar issue #6157 didn't handle the case of a function expression in which the param and function expression scopes are merged with the body scope. In that case, the function defined in the param scope needs to have access to the body scope of the enclosing function.

Fixes:
https://microsoft.visualstudio.com/OS/_workitems/edit/18926499/

Author: boingoing

lib/Runtime/ByteCode/ScopeInfo.cpp

@@ -162,23 +162,20 @@ namespace Js
         Scope* currentScope = byteCodeGenerator->GetCurrentScope();
         Assert(currentScope->GetFunc() == funcInfo);
 
-// Disable the below temporarily because of bad interaction with named function expressions
-#if 0
         if (funcInfo->root->IsDeclaredInParamScope()) {
             Assert(currentScope->GetScopeType() == ScopeType_FunctionBody);
             Assert(currentScope->GetEnclosingScope());
 
             FuncInfo* func = currentScope->GetEnclosingScope()->GetFunc();
             Assert(func);
 
-            if (func->IsBodyAndParamScopeMerged())
+            if (func->IsBodyAndParamScopeMerged() && !(func->funcExprScope && func->funcExprScope->GetCanMerge()))
             {
                 currentScope = func->GetParamScope();
                 Assert(currentScope->GetScopeType() == ScopeType_Parameter);
                 Assert(!currentScope->GetMustInstantiate());
             }
         }
-#endif
 
         while (currentScope->GetFunc() == funcInfo)
         {

test/Bugs/bug_OS18926499.js

@@ -23,3 +23,26 @@ try {
 } catch {
     console.log('pass');
 }
+
+var foo3 = function foo3a(a = (function foo3b() { foo3a; })()) {
+    a;
+};
+
+try {
+    foo3()
+    console.log('pass');
+} catch {
+    console.log('fail');
+}
+
+var foo4 = function foo4a(a = (function() { +x; })()) {
+    function bar() { eval(''); }
+    var x;
+};
+
+try {
+    foo4()
+    console.log('fail');
+} catch {
+    console.log('pass');
+}

test/Bugs/rlexe.xml

@@ -582,15 +582,12 @@
       <compile-flags>-args summary -endargs</compile-flags>
     </default>
   </test>
-<!--
-Re-enable after fixing ScopeInfo::SaveEnclosingScopeInfo to handle named function expressions
   <test>
     <default>
       <files>bug_OS18926499.js</files>
       <compile-flags>-force:deferparse</compile-flags>
     </default>
   </test>
--->
   <test>
     <default>
       <files>Bug19767482.js</files>