Rollup Version

4.53.0

Operating System (or Browser)

macOS, Linux

Node Version (if applicable)

No response

Link To Reproduction

https://rollupjs.org/repl/?version=4.53.0&shareable=eyJleGFtcGxlIjpudWxsLCJtb2R1bGVzIjpbeyJjb2RlIjoidmFyIG1vZHVsZXMgPSB7XG4gICdmb28nOiAodW51c2VkLCBleHBvcnRzKSA9PiB7XG4gICAgY29uc29sZS5sb2coZXhwb3J0cy5iYXIpXG4gICAgZXZhbCgnZXhwb3J0cy5iYXIgPSAxJyk7XG4gIH1cbn07XG5leHBvcnQgZGVmYXVsdCBtb2R1bGVzOyIsImlzRW50cnkiOnRydWUsIm5hbWUiOiJtYWluLmpzIn1dLCJvcHRpb25zIjp7fX0=

Expected Behaviour

See the expected value in the 4.52.5 repl of the same code

Expect

var modules = {
  'foo': (unused, exports) => {
    console.log(exports.bar);
    eval('exports.bar = 1');
  }
};

export { modules as default };

Note the eval and the how the exports parameter isn't modified

Actual Behaviour

This was caused by #5947

here the output in 4.53 version of repl is

var modules = {
  'foo': (unused, exports$1) => {
    console.log(exports$1.bar);
    eval('exports.bar = 1');
  }
};

export { modules as default };

Note how the input parameter exports is re-written to exports$1. While the console.log gets the rewrite, the exports in the eval breaks because of the input parameter rewrite.

The eval is here to mimic a use case where we somehow have webpack development code bundled through rollup. The development mode code in webpack in our example was using eval to execute the bundled code.

It is over-deconflicting a legal nested binding that should have been left untouched.
eval is what makes the bug obvious and breaking, but the rename itself is already conceptually wrong for this kind of nested function parameter.