Attachment 249961 Details for Bug 142944 – WIP

[patch] WIP

ternary-backup.diff (text/plain), 57.68 KB, created by Saam Barati on 2015-04-01 21:44:31 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2015-04-01 21:44:31 PDT

Size: 57.68 KB

patch

obsolete

>Index: Source/JavaScriptCore/bytecode/BytecodeList.json
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeList.json	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/BytecodeList.json	(working copy)
>@@ -111,6 +111,7 @@
>             { "name" : "op_push_with_scope", "length" : 3 },
>             { "name" : "op_pop_scope", "length" : 2 },
>             { "name" : "op_push_name_scope", "length" : 5 },
>+            { "name" : "op_push_lexical_scope", "length" : 4 },
>             { "name" : "op_catch", "length" : 2 },
>             { "name" : "op_throw", "length" : 2 },
>             { "name" : "op_throw_static_error", "length" : 3 },
>Index: Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(working copy)
>@@ -121,6 +121,7 @@ void computeUsesForBytecodeOffset(
>     case op_init_global_const:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope: // FIXME: should we report that we use the scope?
>     case op_resolve_scope:
>     case op_get_from_scope:
>     case op_to_primitive:
>@@ -297,6 +298,7 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_pop_scope:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_strcat:
>     case op_to_primitive:
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -1435,6 +1435,14 @@ void CodeBlock::dumpBytecode(
>             out.printf("%s, %s, %s, %s", registerName(dst).data(), registerName(r1).data(), constantName(k0).data(), (scopeType == JSNameScope::FunctionNameScope) ? "functionScope" : ((scopeType == JSNameScope::CatchScope) ? "catchScope" : "unknownScopeType"));
>             break;
>         }
>+        case op_push_lexical_scope: {
>+            int dst = (++it)->u.operand;
>+            int scope = (++it)->u.operand;
>+            int symbolTable = (++it)->u.operand;
>+            printLocationAndOp(out, exec, location, it, "push_lexical_scope");
>+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(scope).data(), registerName(symbolTable).data());
>+            break;
>+        }
>         case op_catch: {
>             int r0 = (++it)->u.operand;
>             printLocationOpAndRegisterOperand(out, exec, location, it, "catch", r0);
>@@ -1819,6 +1827,12 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>     UnlinkedInstructionStream::Reader instructionReader(unlinkedCodeBlock->instructions());
> 
>     Vector<Instruction, 0, UnsafeVectorOverflow> instructions(instructionCount);
>+
>+    Vector<SymbolTable*> symbolTableStack;
>+
>+    if (!!m_symbolTable)
>+        symbolTableStack.append(symbolTable());
>+
>     for (unsigned i = 0; !instructionReader.atEnd(); ) {
>         const UnlinkedInstruction* pc = instructionReader.next();
> 
>@@ -1923,12 +1937,26 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             break;
>         }
> 
>+        case op_push_lexical_scope: {
>+            SymbolTable* unlinkedTable = jsCast<SymbolTable*>(getConstant(pc[3].u.operand));
>+            RELEASE_ASSERT(unlinkedTable->scopeSize());
>+            SymbolTable* linkedTable = unlinkedTable->cloneScopePart(*m_vm);
>+            m_constantRegisters[pc[3].u.operand - FirstConstantRegisterIndex].set(m_globalObject->vm(), m_ownerExecutable.get(), linkedTable);
>+            symbolTableStack.append(linkedTable);
>+            break;
>+        }
>+
>+        case op_pop_scope: {
>+            symbolTableStack.removeLast();
>+            break;
>+        }
>+
>         case op_resolve_scope: {
>             const Identifier& ident = identifier(pc[3].u.operand);
>             ResolveType type = static_cast<ResolveType>(pc[4].u.operand);
>             RELEASE_ASSERT(type != LocalClosureVar);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, type);
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, type);
>             instructions[i + 4].u.operand = op.type;
>             instructions[i + 5].u.operand = op.depth;
>             if (op.lexicalEnvironment)
>@@ -1952,7 +1980,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[3].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -1970,14 +1998,21 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             if (modeAndType.type() == LocalClosureVar) {
>                 // Only do watching if the property we're putting to is not anonymous.
>                 if (static_cast<unsigned>(pc[2].u.operand) != UINT_MAX) {
>-                    RELEASE_ASSERT(didCloneSymbolTable);
>                     const Identifier& ident = identifier(pc[2].u.operand);
>                     StringImpl* uid = ident.impl();
>-                    ConcurrentJITLocker locker(m_symbolTable->m_lock);
>-                    SymbolTable::Map::iterator iter = m_symbolTable->find(locker, uid);
>-                    ASSERT(iter != m_symbolTable->end(locker));
>-                    iter->value.prepareToWatch(symbolTable());
>-                    instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                    bool found = false;
>+                    for (unsigned stackIdx = symbolTableStack.size(); stackIdx--; ) {
>+                        SymbolTable* symbolTable = symbolTableStack[stackIdx];
>+                        ConcurrentJITLocker locker(symbolTable->m_lock);
>+                        SymbolTable::Map::iterator iter = symbolTable->find(locker, uid);
>+                        if (iter != symbolTable->end(locker)) {
>+                            iter->value.prepareToWatch(symbolTable); // FIXME: what to do here.
>+                            instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                            found = true;
>+                            break;
>+                        }
>+                    }
>+                    RELEASE_ASSERT(found);
>                 } else
>                     instructions[i + 5].u.watchpointSet = nullptr;
>                 break;
>@@ -1985,7 +2020,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[2].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Put, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Put, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -2017,7 +2052,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             case ProfileTypeBytecodeGetFromScope: {
>                 const Identifier& ident = identifier(pc[4].u.operand);
>                 ResolveType type = static_cast<ResolveType>(pc[5].u.operand);
>-                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
>+                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
> 
>                 // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
>                 // https://bugs.webkit.org/show_bug.cgi?id=135184
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
>@@ -196,7 +196,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>     bool shouldCaptureSomeOfTheThings = m_shouldEmitDebugHooks || m_codeBlock->needsFullScopeChain();
>     bool shouldCaptureAllOfTheThings = m_shouldEmitDebugHooks || codeBlock->usesEval();
>     bool needsArguments = functionNode->usesArguments() || codeBlock->usesEval();
>-    
>+
>     auto captures = [&] (StringImpl* uid) -> bool {
>         if (shouldCaptureAllOfTheThings)
>             return true;
>@@ -371,7 +371,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         emitOpcode(op_create_out_of_band_arguments);
>         instructions().append(m_argumentsRegister->index());
>     }
>-    
>+
>     // Now declare all variables.
>     for (const Identifier& ident : boundParameterProperties)
>         createVariable(ident, varKind(ident.impl()), IsVariable);
>@@ -380,6 +380,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         createVariable(ident, varKind(ident.impl()), IsVariable);
>         m_functionsToInitialize.append(function);
>     }
>+
>     for (auto& entry : functionNode->varStack()) {
>         ConstantMode constantMode = modeForIsConstant(entry.second & DeclarationStacks::IsConstant);
>         // Variables named "arguments" are never const.
>@@ -485,6 +486,8 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         instructions().append(0);
>         instructions().append(0);
>     }
>+
>+    m_symbolTableStack.append(SymbolTableStackEntry(m_symbolTable, m_lexicalEnvironmentRegister));
> }
> 
> BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>@@ -1188,6 +1191,76 @@ RegisterID* BytecodeGenerator::emitLoadG
>     return m_globalObjectRegister;
> }
> 
>+void BytecodeGenerator::pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTable* symbolTable = SymbolTable::create(*m_vm);
>+    ConcurrentJITLocker locker(symbolTable->m_lock);
>+    for (auto ident : vars) {
>+        SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+        if (!entry.isNull()) // FIXME: consider what to do here.
>+            continue;
>+
>+        VarKind varKind = capturedVars.contains(ident) ? VarKind::Scope : VarKind::Stack;
>+        VarOffset varOffset;
>+        if (varKind == VarKind::Scope)
>+            varOffset = VarOffset(symbolTable->takeNextScopeOffset(locker));
>+        else {
>+            ASSERT(varKind == VarKind::Stack);
>+            RegisterID* local = newTemporary();
>+            local->ref();
>+            varOffset = VarOffset(local->virtualRegister());
>+        }
>+        SymbolTableEntry newEntry(varOffset, 0/*constantMode == IsConstant ? ReadOnly : 0*/);
>+        symbolTable->add(locker, ident.get(), newEntry);
>+    }
>+    
>+    RegisterID* newScope = nullptr;
>+    if (capturedVars.size()) {
>+        newScope = newTemporary();
>+        newScope->ref();
>+
>+        emitOpcode(op_push_lexical_scope);
>+        instructions().append(newScope->index());
>+        instructions().append(scopeRegister()->index());
>+        instructions().append(addConstantValue(symbolTable->cloneScopePart(*m_vm))->index());
>+
>+        emitMove(scopeRegister(), newScope);
>+    }
>+
>+    m_symbolTableStack.append(SymbolTableStackEntry(symbolTable, newScope));
>+}
>+
>+void BytecodeGenerator::popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTableStackEntry entry = m_symbolTableStack.takeLast();
>+    SymbolTable* symbolTable = entry.first;
>+    ConcurrentJITLocker locker(symbolTable->m_lock);
>+    for (auto ident : vars) {
>+        if (capturedVars.contains(ident))
>+            continue;
>+        SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+        ASSERT(!entry.isNull());
>+        VarOffset offset = entry.varOffset();
>+        ASSERT(offset.isStack());
>+        RegisterID* local = &registerFor(offset.stackOffset());
>+        local->deref();
>+    }
>+
>+    if (capturedVars.size()) {
>+
>+        RELEASE_ASSERT(entry.second);
>+        entry.second->deref();
>+        emitOpcode(op_pop_scope);
>+        instructions().append(scopeRegister()->index());
>+    }
>+}
>+
> Variable BytecodeGenerator::variable(const Identifier& property)
> {
>     if (property == propertyNames().thisIdentifier) {
>@@ -1198,18 +1271,23 @@ Variable BytecodeGenerator::variable(con
>     
>     if (!shouldOptimizeLocals())
>         return Variable(property);
>-    
>-    SymbolTableEntry entry = symbolTable().get(property.impl());
>-    if (entry.isNull())
>-        return Variable(property);
>-    
>-    if (entry.varOffset().isScope() && m_localScopeDepth) {
>-        // FIXME: We should be able to statically resolve through our local scopes.
>-        // https://bugs.webkit.org/show_bug.cgi?id=141885
>-        return Variable(property);
>+
>+    for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+        SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+        SymbolTableEntry entry = symbolTable.get(property.impl());
>+        if (entry.isNull())
>+            continue;
>+        
>+        if (entry.varOffset().isScope() && m_localScopeDepth) {
>+            // FIXME: We should be able to statically resolve through our local scopes.
>+            // https://bugs.webkit.org/show_bug.cgi?id=141885
>+            return Variable(property);
>+        }
>+        
>+        return variableForLocalEntry(property, entry);
>     }
>-    
>-    return variableForLocalEntry(property, entry);
>+
>+    return Variable(property);
> }
> 
> Variable BytecodeGenerator::variablePerSymbolTable(const Identifier& property)
>@@ -1240,9 +1318,9 @@ void BytecodeGenerator::createVariable(
>     ExistingVariableMode existingVariableMode)
> {
>     ASSERT(property != propertyNames().thisIdentifier);
>-    
>-    ConcurrentJITLocker locker(symbolTable().m_lock);
>-    SymbolTableEntry entry = symbolTable().get(locker, property.impl());
>+    SymbolTable& symbolTable = *m_symbolTable;
>+    ConcurrentJITLocker locker(symbolTable.m_lock);
>+    SymbolTableEntry entry = symbolTable.get(locker, property.impl());
>     
>     if (!entry.isNull()) {
>         if (existingVariableMode == IgnoreExisting)
>@@ -1266,13 +1344,13 @@ void BytecodeGenerator::createVariable(
>     
>     VarOffset varOffset;
>     if (varKind == VarKind::Scope)
>-        varOffset = VarOffset(symbolTable().takeNextScopeOffset(locker));
>+        varOffset = VarOffset(symbolTable.takeNextScopeOffset(locker));
>     else {
>         ASSERT(varKind == VarKind::Stack);
>         varOffset = VarOffset(virtualRegisterForLocal(m_calleeRegisters.size()));
>     }
>     SymbolTableEntry newEntry(varOffset, constantMode == IsConstant ? ReadOnly : 0);
>-    symbolTable().add(locker, property.impl(), newEntry);
>+    symbolTable.add(locker, property.impl(), newEntry);
>     
>     if (varKind == VarKind::Stack) {
>         RegisterID* local = addVar();
>@@ -1317,7 +1395,19 @@ RegisterID* BytecodeGenerator::emitResol
>         // don't do that already is that m_lexicalEnvironment is required by ConstDeclNode. ConstDeclNode
>         // requires weird things because it is a shameful pile of nonsense, but block scoping would make
>         // that code sensible and obviate the need for us to do bad things.
>-        return m_lexicalEnvironmentRegister;
>+        for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+            SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+            SymbolTableEntry entry = symbolTable.get(variable.ident().impl());
>+            if (entry.isNull())
>+                continue;
>+            
>+            RegisterID* scope = m_symbolTableStack[i].second; 
>+            RELEASE_ASSERT(scope);
>+            return scope;
>+        }
>+
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return nullptr;
>         
>     case VarKind::Invalid:
>         // Indicates non-local resolution.
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
>@@ -580,6 +580,9 @@ namespace JSC {
> 
>         OpcodeID lastOpcodeID() const { return m_lastOpcodeID; }
> 
>+        void pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+        void popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+
>     private:
>         Variable variableForLocalEntry(const Identifier&, const SymbolTableEntry&);
> 
>@@ -666,8 +669,9 @@ namespace JSC {
> 
>         bool shouldOptimizeLocals()
>         {
>-            if (m_codeType != FunctionCode)
>-                return false;
>+            // FIXME: won't always be true w/ lexical scoping. We will sometimes be able to optimize.
>+            //if (m_codeType != FunctionCode)
>+            //    return false;
> 
>             if (m_localScopeDepth)
>                 return false;
>@@ -698,6 +702,8 @@ namespace JSC {
>         bool m_shouldEmitProfileHooks;
> 
>         SymbolTable* m_symbolTable { nullptr };
>+        typedef std::pair<SymbolTable*, RegisterID*> SymbolTableStackEntry;
>+        Vector<SymbolTableStackEntry> m_symbolTableStack;
> 
>         ScopeNode* const m_scopeNode;
>         Strong<UnlinkedCodeBlock> m_codeBlock;
>Index: Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(working copy)
>@@ -1829,7 +1829,9 @@ void BlockNode::emitBytecode(BytecodeGen
> {
>     if (!m_statements)
>         return;
>+    generator.pushLexicalScope(m_declaredVariables, m_capturedVariables);
>     m_statements->emitBytecode(generator, dst);
>+    generator.popLexicalScope(m_declaredVariables, m_capturedVariables);
> }
> 
> // ------------------------------ EmptyStatementNode ---------------------------
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -266,6 +266,7 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_profile_control_flow)
>         DEFINE_OP(op_push_name_scope)
>         DEFINE_OP(op_push_with_scope)
>+        DEFINE_OP(op_push_lexical_scope)
>         case op_put_by_id_out_of_line:
>         case op_put_by_id_transition_direct:
>         case op_put_by_id_transition_normal:
>Index: Source/JavaScriptCore/jit/JIT.h
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JIT.h	(working copy)
>@@ -535,6 +535,7 @@ namespace JSC {
>         void emit_op_profile_control_flow(Instruction*);
>         void emit_op_push_name_scope(Instruction*);
>         void emit_op_push_with_scope(Instruction*);
>+        void emit_op_push_lexical_scope(Instruction*);
>         void emit_op_put_by_id(Instruction*);
>         void emit_op_put_by_index(Instruction*);
>         void emit_op_put_by_val(Instruction*);
>@@ -716,6 +717,7 @@ namespace JSC {
>         MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EPc, int, Instruction*);
>         MacroAssembler::Call callOperation(J_JITOperation_EZ, int, int32_t);
>         MacroAssembler::Call callOperation(J_JITOperation_EZZ, int, int32_t, int32_t);
>+        MacroAssembler::Call callOperation(J_JITOperation_ESymtabZ, int, SymbolTable*, int32_t);
>         MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, size_t);
>         MacroAssembler::Call callOperation(S_JITOperation_ECC, RegisterID, RegisterID);
>         MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID);
>Index: Source/JavaScriptCore/jit/JITInlines.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlines.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITInlines.h	(working copy)
>@@ -295,6 +295,12 @@ ALWAYS_INLINE MacroAssembler::Call JIT::
>     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
> }
> 
>+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESymtabZ operation, int dst, SymbolTable* symbolTable, int32_t arg2)
>+{
>+    setupArgumentsWithExecState(TrustedImmPtr(symbolTable), TrustedImm32(arg2));
>+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
>+}
>+
> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_ECC operation, RegisterID regOp1, RegisterID regOp2)
> {
>     setupArgumentsWithExecState(regOp1, regOp2);
>Index: Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(working copy)
>@@ -815,6 +815,13 @@ void JIT::emit_op_catch(Instruction* cur
>     emitStore(exception, regT1, regT0);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand;
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOpcodes.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOpcodes.cpp	(working copy)
>@@ -520,6 +520,14 @@ void JIT::emit_op_catch(Instruction* cur
>     emitPutVirtualRegister(currentInstruction[1].u.operand);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand; 
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+    return;
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -1306,6 +1306,17 @@ void JIT_OPERATION operationPushWithScop
>     exec->uncheckedR(dst) = JSWithScope::create(exec, o, currentScope);
> }
> 
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState* exec, SymbolTable* symbolTable, int32_t scopeReg)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+
>+    return JSValue::encode(newScope);
>+}
>+
> void JIT_OPERATION operationPopScope(ExecState* exec, int32_t scopeReg)
> {
>     VM& vm = exec->vm();
>Index: Source/JavaScriptCore/jit/JITOperations.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOperations.h	(working copy)
>@@ -122,6 +122,7 @@ typedef EncodedJSValue JIT_OPERATION (*J
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZ)(ExecState*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZIcfZ)(ExecState*, int32_t, InlineCallFrame*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZZ)(ExecState*, int32_t, int32_t);
>+typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_ESymtabZ)(ExecState*, SymbolTable*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_E)(ExecState*);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EZ)(ExecState*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EC)(ExecState*, JSCell*);
>@@ -296,6 +297,7 @@ void JIT_OPERATION operationPutGetterSet
> void JIT_OPERATION operationPushCatchScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushFunctionNameScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushWithScope(ExecState*, int32_t, EncodedJSValue) WTF_INTERNAL;
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState*, SymbolTable*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationPopScope(ExecState*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationProfileDidCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationProfileWillCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 182114)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -1272,6 +1272,16 @@ LLINT_SLOW_PATH_DECL(slow_path_push_name
>     LLINT_END();
> }
> 
>+LLINT_SLOW_PATH_DECL(slow_path_push_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[2].u.operand;
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    SymbolTable* symbolTable = jsCast<SymbolTable*>(LLINT_OP_C(3).jsValue());
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+    LLINT_RETURN(newScope);
>+}
>+
> LLINT_SLOW_PATH_DECL(slow_path_throw)
> {
>     LLINT_BEGIN();
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.h	(revision 182114)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.h	(working copy)
>@@ -108,6 +108,7 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_name_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_lexical_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_handle_watchdog_timer);
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 182114)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -1287,6 +1287,12 @@ _llint_op_push_name_scope:
>     dispatch(5)
> 
> 
>+_llint_op_push_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_push_lexical_scope)
>+    dispatch(4)
>+
>+
> _llint_op_throw:
>     traceExecution()
>     callSlowPath(_llint_slow_path_throw)
>Index: Source/JavaScriptCore/parser/ASTBuilder.h
>===================================================================
>--- Source/JavaScriptCore/parser/ASTBuilder.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/ASTBuilder.h	(working copy)
>@@ -386,9 +386,9 @@ public:
>     }
> #endif
> 
>-    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine)
>+    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine, IdentifierSet& lexicalVariables, IdentifierSet lexicallyCapturedVariables)
>     {
>-        BlockNode* block = new (m_parserArena) BlockNode(location, elements);
>+        BlockNode* block = new (m_parserArena) BlockNode(location, elements, lexicalVariables, lexicallyCapturedVariables);
>         block->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return block;
>     }
>@@ -457,6 +457,12 @@ public:
>         return result;
>     }
> 
>+    StatementNode* createLetStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
>+    {
>+        // FIXME: better name for 'VarStatementNode'.
>+        return createVarStatement(location, expr, start, end);
>+    }
>+
>     ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier)
>     {
>         return new (m_parserArena) EmptyVarExpression(location, identifier);
>Index: Source/JavaScriptCore/parser/Keywords.table
>===================================================================
>--- Source/JavaScriptCore/parser/Keywords.table	(revision 182114)
>+++ Source/JavaScriptCore/parser/Keywords.table	(working copy)
>@@ -2,56 +2,56 @@
> @begin mainTable 47
> 
> # Types.
>-null		NULLTOKEN
>-true		TRUETOKEN
>-false		FALSETOKEN
>+null         NULLTOKEN
>+true         TRUETOKEN
>+false        FALSETOKEN
> 
> # Keywords.
>-break		BREAK
>-case		CASE
>-catch		CATCH
>-class		CLASSTOKEN
>-const		CONSTTOKEN
>-default		DEFAULT
>-extends	EXTENDS
>-finally		FINALLY
>-for		FOR
>-instanceof	INSTANCEOF
>-new		NEW
>-var		VAR
>-continue	CONTINUE
>-function	FUNCTION
>-return		RETURN
>-void		VOIDTOKEN
>-delete		DELETETOKEN
>-if		IF
>-this		THISTOKEN
>-do		DO
>-while		WHILE
>-else		ELSE
>-in		INTOKEN
>-super		SUPER
>-switch		SWITCH
>-throw		THROW
>-try		TRY
>-typeof		TYPEOF
>-with		WITH
>-debugger	DEBUGGER
>+break        BREAK
>+case         CASE
>+catch        CATCH
>+class        CLASSTOKEN
>+const        CONSTTOKEN
>+default      DEFAULT
>+extends      EXTENDS
>+finally      FINALLY
>+for          FOR
>+instanceof   INSTANCEOF
>+new          NEW
>+var          VAR
>+let          LET
>+continue     CONTINUE
>+function     FUNCTION
>+return       RETURN
>+void         VOIDTOKEN
>+delete       DELETETOKEN
>+if           IF
>+this         THISTOKEN
>+do           DO
>+while        WHILE
>+else         ELSE
>+in           INTOKEN
>+super        SUPER
>+switch       SWITCH
>+throw        THROW
>+try          TRY
>+typeof       TYPEOF
>+with         WITH
>+debugger     DEBUGGER
> 
> # Reserved for future use.
>-enum            RESERVED
>-export          RESERVED
>-import          RESERVED
>+enum         RESERVED
>+export       RESERVED
>+import       RESERVED
> 
> # Reserved for future use in strict code.
>-implements      RESERVED_IF_STRICT
>-interface       RESERVED_IF_STRICT
>-let             RESERVED_IF_STRICT
>-package         RESERVED_IF_STRICT
>-private         RESERVED_IF_STRICT
>-protected       RESERVED_IF_STRICT
>-public          RESERVED_IF_STRICT
>-static          RESERVED_IF_STRICT
>-yield           RESERVED_IF_STRICT
>+implements   RESERVED_IF_STRICT
>+interface    RESERVED_IF_STRICT
>+package      RESERVED_IF_STRICT
>+private      RESERVED_IF_STRICT
>+protected    RESERVED_IF_STRICT
>+public       RESERVED_IF_STRICT
>+static       RESERVED_IF_STRICT
>+yield        RESERVED_IF_STRICT
> 
> @end
>Index: Source/JavaScriptCore/parser/NodeConstructors.h
>===================================================================
>--- Source/JavaScriptCore/parser/NodeConstructors.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/NodeConstructors.h	(working copy)
>@@ -846,8 +846,9 @@ namespace JSC {
>     {
>     }
> 
>-    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements)
>+    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements, IdentifierSet& lexicalVariables, IdentifierSet lexicallyCapturedVariables)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicallyCapturedVariables)
>         , m_statements(statements)
>     {
>     }
>Index: Source/JavaScriptCore/parser/Nodes.h
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/Nodes.h	(working copy)
>@@ -47,6 +47,7 @@ namespace JSC {
>     class RegisterID;
>     class JSScope;
>     class ScopeNode;
>+    class LexicalNode;
> 
>     enum Operator {
>         OpEqual,
>@@ -202,6 +203,21 @@ namespace JSC {
>         int m_lastLine;
>     };
> 
>+    class LexicalNode {
>+    public:
>+        LexicalNode(IdentifierSet& declaredVariables, IdentifierSet capturedVariables)
>+            : m_declaredVariables(declaredVariables)
>+            , m_capturedVariables(capturedVariables)
>+        {
>+        }
>+
>+        bool captures(StringImpl* uid) { return m_capturedVariables.contains(uid); }
>+
>+    protected:
>+        IdentifierSet m_declaredVariables;
>+        IdentifierSet m_capturedVariables;
>+    };
>+
>     class ConstantNode : public ExpressionNode {
>     public:
>         ConstantNode(const JSTokenLocation&, ResultType);
>@@ -1190,9 +1206,9 @@ namespace JSC {
>         StatementNode* m_tail;
>     };
> 
>-    class BlockNode : public StatementNode {
>+    class BlockNode : public StatementNode, public LexicalNode {
>     public:
>-        BlockNode(const JSTokenLocation&, SourceElements* = 0);
>+        BlockNode(const JSTokenLocation&, SourceElements*, IdentifierSet&, IdentifierSet);
> 
>         StatementNode* singleStatement() const;
>         StatementNode* lastStatement() const;
>Index: Source/JavaScriptCore/parser/Parser.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.cpp	(revision 182114)
>+++ Source/JavaScriptCore/parser/Parser.cpp	(working copy)
>@@ -263,6 +263,9 @@ String Parser<LexerType>::parseInner()
>     if (m_lexer->isReparsing())
>         m_statementDepth--;
>     ScopeRef scope = currentScope();
>+    if (!currentScope()->isFunction())
>+        currentScope()->setIsLexicalScope(); // FIXME: maybe push another scope on top.
>+
>     SourceElements* sourceElements = parseSourceElements(context, CheckForStrictMode);
>     if (!sourceElements || !consume(EOFTOK)) {
>         if (hasError())
>@@ -373,9 +376,9 @@ template <class TreeBuilder> TreeSourceE
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVarDeclaration(TreeBuilder& context)
>+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVariableDeclaration(TreeBuilder& context, DeclarationType type)
> {
>-    ASSERT(match(VAR));
>+    ASSERT(match(VAR) || match(LET));
>     JSTokenLocation location(tokenLocation());
>     int start = tokenLine();
>     int end = 0;
>@@ -383,11 +386,14 @@ template <class TreeBuilder> TreeStateme
>     TreeDeconstructionPattern scratch1 = 0;
>     TreeExpression scratch2 = 0;
>     JSTextPosition scratch3;
>-    TreeExpression varDecls = parseVarDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext);
>+    TreeExpression decls = parseVarDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext, type);
>     propagateError();
>     failIfFalse(autoSemiColon(), "Expected ';' after var declaration");
>     
>-    return context.createVarStatement(location, varDecls, start, end);
>+    if (type == VarDeclaration)
>+        return context.createVarStatement(location, decls, start, end);
>+    else 
>+        return context.createLetStatement(location, decls, start, end);
> }
> 
> template <typename LexerType>
>@@ -452,7 +458,7 @@ template <class TreeBuilder> TreeStateme
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext)
>+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext, DeclarationType type)
> {
>     TreeExpression head = 0;
>     TreeExpression tail = 0;
>@@ -475,7 +481,7 @@ template <class TreeBuilder> TreeExpress
>             lastIdentToken = m_token;
>             next();
>             hasInitializer = match(EQUAL);
>-            failIfFalseIfStrict(declareVariable(name), "Cannot declare a variable named ", name->impl(), " in strict mode");
>+            failIfFalseIfStrict(declareVariable(name, type), "Cannot declare a variable named ", name->impl(), " in strict mode");
>             context.addVar(name, (hasInitializer || (!m_allowsIn && (match(INTOKEN) || isofToken()))) ? DeclarationStacks::HasInitializer : 0);
>             if (hasInitializer) {
>                 JSTextPosition varDivot = tokenStartPosition() + 1;
>@@ -512,8 +518,10 @@ template <class TreeBuilder> TreeExpress
>         } else
>             tail = context.appendToCommaExpr(location, head, tail, node);
>     } while (match(COMMA));
>+    // FIXME: consider that this causes the last variable in each declaration list to be declared twice.
>     if (lastIdent)
>         lastPattern = createBindingPattern(context, DeconstructToVariables, *lastIdent, 0, lastIdentToken);
>+
>     return head;
> }
> 
>@@ -734,7 +742,7 @@ template <class TreeBuilder> TreeStateme
>     JSTextPosition declsEnd;
>     TreeExpression decls = 0;
>     TreeDeconstructionPattern pattern = 0;
>-    if (match(VAR)) {
>+    if (match(VAR)) { // FIXME: handle LET
>         /*
>          for (var IDENT in expression) statement
>          for (var varDeclarationList; expressionOpt; expressionOpt)
>@@ -744,7 +752,7 @@ template <class TreeBuilder> TreeStateme
>         m_allowsIn = false;
>         JSTextPosition initStart;
>         JSTextPosition initEnd;
>-        decls = parseVarDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext);
>+        decls = parseVarDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext, VarDeclaration);
>         m_allowsIn = true;
>         propagateError();
> 
>@@ -1084,7 +1092,7 @@ template <class TreeBuilder> TreeStateme
>         next();
>         AutoPopScopeRef catchScope(this, pushScope());
>         failIfFalseIfStrict(declareVariable(ident), "Cannot declare a catch variable named '", ident->impl(), "' in strict mode");
>-        catchScope->preventNewDecls();
>+        catchScope->preventAllVariableDeclarations();
>         handleProductionOrFail(CLOSEPAREN, ")", "end", "'catch' target");
>         matchOrFail(OPENBRACE, "Expected exception handler to be a block statement");
>         catchBlock = parseBlockStatement(context);
>@@ -1120,6 +1128,9 @@ template <typename LexerType>
> template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBlockStatement(TreeBuilder& context)
> {
>     ASSERT(match(OPENBRACE));
>+    AutoPopScopeRef blockScope(this, pushScope());
>+    blockScope->setIsLexicalScope();
>+    blockScope->preventVarDeclarations();
>     JSTokenLocation location(tokenLocation());
>     int startOffset = m_token.m_data.offset;
>     int start = tokenLine();
>@@ -1127,9 +1138,10 @@ template <class TreeBuilder> TreeStateme
>     if (match(CLOSEBRACE)) {
>         int endOffset = m_token.m_data.offset;
>         next();
>-        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line);
>+        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line, blockScope->lexicallyDeclaredVariables(), blockScope->lexicallyCapturedVariables());
>         context.setStartOffset(result, startOffset);
>         context.setEndOffset(result, endOffset);
>+        failIfFalse(popScope(blockScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>         return result;
>     }
>     TreeSourceElements subtree = parseSourceElements(context, DontCheckForStrictMode);
>@@ -1137,9 +1149,10 @@ template <class TreeBuilder> TreeStateme
>     matchOrFail(CLOSEBRACE, "Expected a closing '}' at the end of a block statement");
>     int endOffset = m_token.m_data.offset;
>     next();
>-    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line);
>+    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line, blockScope->lexicallyDeclaredVariables(), blockScope->lexicallyCapturedVariables());
>     context.setStartOffset(result, startOffset);
>     context.setEndOffset(result, endOffset);
>+    failIfFalse(popScope(blockScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>     return result;
> }
> 
>@@ -1159,7 +1172,11 @@ template <class TreeBuilder> TreeStateme
>         shouldSetEndOffset = false;
>         break;
>     case VAR:
>-        result = parseVarDeclaration(context);
>+        result = parseVariableDeclaration(context, VarDeclaration);
>+        break;
>+    case LET:
>+        failIfFalse(strictMode(), "'let' declarations are only allowed in strict mode.");
>+        result = parseVariableDeclaration(context, LetDeclaration);
>         break;
>     case CONSTTOKEN:
>         result = parseConstDeclaration(context);
>@@ -1397,6 +1414,10 @@ template <class TreeBuilder> bool Parser
>         info.bodyEndLine = m_lastTokenEndPosition.line;
>         return true;
>     }
>+    //AutoPopScopeRef blockScope(this, pushScope());
>+    //blockScope->setIsLexicalScope();
>+    //blockScope->preventVarDeclarations();
>+
>     m_lastFunctionName = lastFunctionName;
>     ParserState oldState = saveState();
>     info.body = parseFunctionBody(context, functionKeywordStart, functionNameStart, parametersStart, constructorKind);
>@@ -1435,6 +1456,7 @@ template <class TreeBuilder> bool Parser
> 
>     }
>     
>+    //failIfFalse(popScope(blockScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>     failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>     matchOrFail(CLOSEBRACE, "Expected a closing '}' after a ", stringForFunctionMode(mode), " body");
>     
>Index: Source/JavaScriptCore/parser/Parser.h
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/Parser.h	(working copy)
>@@ -115,9 +115,11 @@ struct Scope {
>         , m_needsFullActivation(false)
>         , m_hasDirectSuper(false)
>         , m_needsSuperBinding(false)
>-        , m_allowsNewDecls(true)
>+        , m_allowsVarDecls(true)
>+        , m_allowsLetDecls(true)
>         , m_strictMode(strictMode)
>         , m_isFunction(isFunction)
>+        , m_isLexicalScope(false)
>         , m_isFunctionBoundary(false)
>         , m_isValidStrictMode(true)
>         , m_loopDepth(0)
>@@ -132,9 +134,11 @@ struct Scope {
>         , m_needsFullActivation(rhs.m_needsFullActivation)
>         , m_hasDirectSuper(rhs.m_hasDirectSuper)
>         , m_needsSuperBinding(rhs.m_needsSuperBinding)
>-        , m_allowsNewDecls(rhs.m_allowsNewDecls)
>+        , m_allowsVarDecls(rhs.m_allowsVarDecls)
>+        , m_allowsLetDecls(rhs.m_allowsLetDecls)
>         , m_strictMode(rhs.m_strictMode)
>         , m_isFunction(rhs.m_isFunction)
>+        , m_isLexicalScope(rhs.m_isLexicalScope)
>         , m_isFunctionBoundary(rhs.m_isFunctionBoundary)
>         , m_isValidStrictMode(rhs.m_isValidStrictMode)
>         , m_loopDepth(rhs.m_loopDepth)
>@@ -187,9 +191,24 @@ struct Scope {
>     {
>         m_isFunction = true;
>         m_isFunctionBoundary = true;
>+        setIsLexicalScope();
>+    }
>+    bool isFunction() const { return m_isFunction; }
>+    bool isFunctionBoundary() const { return m_isFunctionBoundary; }
>+
>+    void setIsLexicalScope() { m_isLexicalScope = true; }
>+    IdentifierSet& lexicallyDeclaredVariables() { return m_lexicallyDeclaredVariables; }
>+    IdentifierSet lexicallyCapturedVariables()
>+    {
>+        IdentifierSet result;
>+        IdentifierSet::iterator end = m_lexicallyDeclaredVariables.end();
>+        for (IdentifierSet::iterator ptr = m_lexicallyDeclaredVariables.begin(); ptr != end; ++ptr) {
>+            if (m_closedVariables.contains(*ptr))
>+                result.add(*ptr);
>+        }
>+
>+        return result; 
>     }
>-    bool isFunction() { return m_isFunction; }
>-    bool isFunctionBoundary() { return m_isFunctionBoundary; }
> 
>     void declareCallee(const Identifier* ident)
>     {
>@@ -204,6 +223,16 @@ struct Scope {
>         return isValidStrictMode;
>     }
> 
>+    bool declareLexicalVariable(const Identifier* ident)
>+    {
>+        // FIXME: need to make Global code a lexical scope and make this work with that, too.
>+        // Currently, we only make lexical scopes for block statements.
>+        bool isValidStrictMode = m_vm->propertyNames->eval != *ident && m_vm->propertyNames->arguments != *ident;
>+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
>+        m_lexicallyDeclaredVariables.add(ident->string().impl());
>+        return isValidStrictMode;
>+    }
>+
>     bool hasDeclaredVariable(const Identifier& ident)
>     {
>         return m_declaredVariables.contains(ident.impl());
>@@ -220,8 +249,14 @@ struct Scope {
>         m_writtenVariables.add(ident->impl());
>     }
> 
>-    void preventNewDecls() { m_allowsNewDecls = false; }
>-    bool allowsNewDecls() const { return m_allowsNewDecls; }
>+    void preventAllVariableDeclarations()
>+    {
>+        m_allowsVarDecls = false; 
>+        m_allowsLetDecls = false;
>+    }
>+    void preventVarDeclarations() { m_allowsVarDecls = false; }
>+    bool allowsNewDecls() const { return m_allowsVarDecls; }
>+    bool allowsLexicalDeclarations() const { return m_allowsLetDecls; }
> 
>     bool declareParameter(const Identifier* ident)
>     {
>@@ -287,16 +322,29 @@ struct Scope {
>             m_usesEval = true;
>         IdentifierSet::iterator end = nestedScope->m_usedVariables.end();
>         for (IdentifierSet::iterator ptr = nestedScope->m_usedVariables.begin(); ptr != end; ++ptr) {
>-            if (nestedScope->m_declaredVariables.contains(*ptr))
>+            if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                 continue;
>             m_usedVariables.add(*ptr);
>-            if (shouldTrackClosedVariables)
>+            // FIXME: This isn't so intuitive and we should have better names here. Let's call a
>+            // "pure" lexical scope a scope that allows 'let' variables but not 'var' variables.
>+            // So, if a "pure" lexical scope uses our variable, it doesn't imply it's captured.
>+            // Blocks are an example of "pure" lexical scopes, where functions are examples of
>+            // scopes that allow both 'let' and 'var' declarations.
>+            if (shouldTrackClosedVariables && nestedScope->m_allowsVarDecls)
>                 m_closedVariables.add(*ptr);
>         }
>+
>+        if (!nestedScope->m_isFunctionBoundary) {
>+            end = nestedScope->m_closedVariables.end();
>+            for (IdentifierSet::iterator ptr = nestedScope->m_closedVariables.begin(); ptr != end; ++ptr)
>+                m_closedVariables.add(*ptr);
>+        }
>+
>         if (nestedScope->m_writtenVariables.size()) {
>             IdentifierSet::iterator end = nestedScope->m_writtenVariables.end();
>             for (IdentifierSet::iterator ptr = nestedScope->m_writtenVariables.begin(); ptr != end; ++ptr) {
>-                if (nestedScope->m_declaredVariables.contains(*ptr))
>+                // FIXME: make sure this is correct here.
>+                if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                     continue;
>                 m_writtenVariables.add(*ptr);
>             }
>@@ -376,9 +424,11 @@ private:
>     bool m_needsFullActivation : 1;
>     bool m_hasDirectSuper : 1;
>     bool m_needsSuperBinding : 1;
>-    bool m_allowsNewDecls : 1;
>+    bool m_allowsVarDecls : 1;
>+    bool m_allowsLetDecls : 1;
>     bool m_strictMode : 1;
>     bool m_isFunction : 1;
>+    bool m_isLexicalScope : 1;
>     bool m_isFunctionBoundary : 1;
>     bool m_isValidStrictMode : 1;
>     int m_loopDepth;
>@@ -388,6 +438,7 @@ private:
>     std::unique_ptr<LabelStack> m_labels;
>     IdentifierSet m_declaredParameters;
>     IdentifierSet m_declaredVariables;
>+    IdentifierSet m_lexicallyDeclaredVariables;
>     IdentifierSet m_usedVariables;
>     IdentifierSet m_closedVariables;
>     IdentifierSet m_writtenVariables;
>@@ -437,6 +488,7 @@ public:
> 
>     JSTextPosition positionBeforeLastNewline() const { return m_lexer->positionBeforeLastNewline(); }
>     Vector<RefPtr<StringImpl>>&& closedVariables() { return WTF::move(m_closedVariables); }
>+    enum DeclarationType { VarDeclaration, LetDeclaration };
> 
> private:
>     struct AllowInOverride {
>@@ -513,15 +565,27 @@ private:
>         return popScopeInternal(scope, shouldTrackClosedVariables);
>     }
>     
>-    bool declareVariable(const Identifier* ident)
>+    bool declareVariable(const Identifier* ident, Parser::DeclarationType type = VarDeclaration)
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+
>+        if (type == VarDeclaration) {
>+            while (!m_scopeStack[i].allowsNewDecls()) {
>+                i--;
>+                ASSERT(i < m_scopeStack.size());
>+            }
>+
>+            return m_scopeStack[i].declareVariable(ident);
>+        }
>+
>+        ASSERT(type == LetDeclaration);
>+        while (!m_scopeStack[i].allowsLexicalDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>-        return m_scopeStack[i].declareVariable(ident);
>+
>+        return m_scopeStack[i].declareLexicalVariable(ident);
>     }
>     
>     NEVER_INLINE bool hasDeclaredVariable(const Identifier& ident)
>@@ -562,8 +626,8 @@ private:
>     Parser();
>     String parseInner();
> 
>-    void didFinishParsing(SourceElements*, DeclarationStacks::VarStack&, 
>-        DeclarationStacks::FunctionStack&, CodeFeatures, int, IdentifierSet&, const Vector<RefPtr<StringImpl>>&&);
>+    void didFinishParsing(SourceElements*, DeclarationStacks::VarStack&, DeclarationStacks::FunctionStack&, 
>+        CodeFeatures, int, IdentifierSet&, const Vector<RefPtr<StringImpl>>&&);
> 
>     // Used to determine type of error to report.
>     bool isFunctionBodyNode(ScopeNode*) { return false; }
>@@ -728,7 +792,7 @@ private:
>     template <class TreeBuilder> TreeStatement parseClassDeclaration(TreeBuilder&);
> #endif
>     template <class TreeBuilder> TreeStatement parseFunctionDeclaration(TreeBuilder&);
>-    template <class TreeBuilder> TreeStatement parseVarDeclaration(TreeBuilder&);
>+    template <class TreeBuilder> TreeStatement parseVariableDeclaration(TreeBuilder&, DeclarationType);
>     template <class TreeBuilder> TreeStatement parseConstDeclaration(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseDoWhileStatement(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseWhileStatement(TreeBuilder&);
>@@ -765,7 +829,7 @@ private:
>     template <class TreeBuilder> ALWAYS_INLINE TreeFunctionBody parseFunctionBody(TreeBuilder&, int functionKeywordStart, int functionNameStart, int parametersStart, ConstructorKind);
>     template <class TreeBuilder> ALWAYS_INLINE TreeFormalParameterList parseFormalParameters(TreeBuilder&);
>     enum VarDeclarationListContext { ForLoopContext, VarDeclarationContext };
>-    template <class TreeBuilder> TreeExpression parseVarDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext);
>+    template <class TreeBuilder> TreeExpression parseVarDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext, DeclarationType);
>     template <class TreeBuilder> NEVER_INLINE TreeConstDeclList parseConstDeclarationList(TreeBuilder&);
> 
>     template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern createBindingPattern(TreeBuilder&, DeconstructionKind, const Identifier&, int depth, JSToken);
>@@ -851,9 +915,7 @@ private:
>         m_assignmentCount = state.assignmentCount;
>         m_nonLHSCount = state.nonLHSCount;
>         m_nonTrivialExpressionCount = state.nonTrivialExpressionCount;
>-        
>     }
>-    
> 
>     VM* m_vm;
>     const SourceCode* m_source;
>Index: Source/JavaScriptCore/parser/ParserTokens.h
>===================================================================
>--- Source/JavaScriptCore/parser/ParserTokens.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/ParserTokens.h	(working copy)
>@@ -57,6 +57,7 @@ enum JSTokenType {
>     FOR,
>     NEW,
>     VAR,
>+    LET,
>     CONSTTOKEN,
>     CONTINUE,
>     FUNCTION,
>Index: Source/JavaScriptCore/parser/SyntaxChecker.h
>===================================================================
>--- Source/JavaScriptCore/parser/SyntaxChecker.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/SyntaxChecker.h	(working copy)
>@@ -206,7 +206,7 @@ public:
>     int createClassDeclStatement(const JSTokenLocation&, ClassExpression,
>         const JSTextPosition&, const JSTextPosition&, int, int) { return StatementResult; }
> #endif
>-    int createBlockStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createBlockStatement(const JSTokenLocation&, int, int, int, IdentifierSet&, IdentifierSet) { return StatementResult; }
>     int createExprStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int, int) { return StatementResult; }
>@@ -215,6 +215,7 @@ public:
>     int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>     int createEmptyStatement(const JSTokenLocation&) { return StatementResult; }
>     int createVarStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createLetStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createReturnStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
>Index: Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(working copy)
>@@ -64,6 +64,12 @@ public:
>         SymbolTable* symbolTable = codeBlock->symbolTable();
>         return create(vm, structure, currentScope, symbolTable);
>     }
>+
>+    static JSLexicalEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable)
>+    {
>+        Structure* structure = globalObject->activationStructure();
>+        return create(vm, structure, currentScope, symbolTable);
>+    }
>         
>     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
>     static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
>Index: Source/JavaScriptCore/runtime/JSNameScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSNameScope.cpp	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSNameScope.cpp	(working copy)
>@@ -42,6 +42,8 @@ JSNameScope* JSNameScope::create(VM& vm,
>         return JSCatchScope::create(vm, globalObject, currentScope, symbolTable, value);
>     case FunctionNameScope:
>         return JSFunctionNameScope::create(vm, globalObject, currentScope, symbolTable, value);
>+    default:
>+        RELEASE_ASSERT_NOT_REACHED();
>     }
>     RELEASE_ASSERT_NOT_REACHED();
>     return nullptr;
>Index: Source/JavaScriptCore/runtime/JSNameScope.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSNameScope.h	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSNameScope.h	(working copy)
>@@ -38,7 +38,8 @@ public:
> 
>     enum Type {
>         CatchScope,
>-        FunctionNameScope
>+        FunctionNameScope,
>+        LexicalScope
>     };
> 
>     template<typename T>
>Index: Source/JavaScriptCore/runtime/JSScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.cpp	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSScope.cpp	(working copy)
>@@ -148,20 +148,21 @@ JSValue JSScope::resolve(ExecState* exec
>     }
> }
> 
>-ResolveOp JSScope::abstractResolve(ExecState* exec, bool hasTopActivation, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
>+ResolveOp JSScope::abstractResolve(ExecState* exec, unsigned depthOffset, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
> {
>     ResolveOp op(Dynamic, 0, 0, 0, 0, 0);
>     if (unlinkedType == Dynamic)
>         return op;
> 
>-    size_t depth = hasTopActivation ? 1 : 0;
>     bool needsVarInjectionChecks = JSC::needsVarInjectionChecks(unlinkedType);
>+    size_t depth = depthOffset;
>     for (; scope; scope = scope->next()) {
>         if (abstractAccess(exec, scope, ident, getOrPut, depth, needsVarInjectionChecks, op))
>-            break;
>+            goto done;
>         ++depth;
>     }
> 
>+done:
>     return op;
> }
> 
>Index: Source/JavaScriptCore/runtime/JSScope.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.h	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSScope.h	(working copy)
>@@ -31,6 +31,7 @@
> namespace JSC {
> 
> class ScopeChainIterator;
>+class SymbolTable;
> class VariableWatchpointSet;
> 
> enum ResolveMode {
>@@ -156,7 +157,7 @@ public:
>     static JSObject* objectAtScope(JSScope*);
> 
>     static JSValue resolve(ExecState*, JSScope*, const Identifier&);
>-    static ResolveOp abstractResolve(ExecState*, bool hasTopActivation, JSScope*, const Identifier&, GetOrPut, ResolveType);
>+    static ResolveOp abstractResolve(ExecState*, unsigned depthOffset, JSScope*, const Identifier&, GetOrPut, ResolveType);
> 
>     static void visitChildren(JSCell*, SlotVisitor&);
>

Actions: View | Formatted Diff | Diff

Attachments on bug 142944: 249945 | 249961 | 250169 | 250230 | 250533 | 250684 | 250714 | 250715 | 251081 | 251130 | 251133 | 251136 | 251409 | 251653 | 251913 | 252074 | 253066 | 253070 | 253115 | 253794 | 255536 | 255614 | 255622 | 255804 | 255806 | 255807 | 255830 | 255834 | 255835 | 255871 | 256033 | 256036 | 256226 | 256232 | 256233 | 256257 | 256264 | 256267 | 256433 | 256438 | 256445 | 256450 | 256465 | 256481 | 256658 | 256860