Attachment 250169 Details for Bug 142944 – work in progress

[patch] work in progress

ternary-backup.diff (text/plain), 76.61 KB, created by Saam Barati on 2015-04-05 14:51:25 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2015-04-05 14:51:25 PDT

Size: 76.61 KB

patch

obsolete

>Index: Source/JavaScriptCore/bytecode/BytecodeList.json
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeList.json	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/BytecodeList.json	(working copy)
>@@ -111,6 +111,7 @@
>             { "name" : "op_push_with_scope", "length" : 3 },
>             { "name" : "op_pop_scope", "length" : 2 },
>             { "name" : "op_push_name_scope", "length" : 5 },
>+            { "name" : "op_push_lexical_scope", "length" : 4 },
>             { "name" : "op_catch", "length" : 2 },
>             { "name" : "op_throw", "length" : 2 },
>             { "name" : "op_throw_static_error", "length" : 3 },
>Index: Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(working copy)
>@@ -121,6 +121,7 @@ void computeUsesForBytecodeOffset(
>     case op_init_global_const:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope: // FIXME: should we report that we use the scope?
>     case op_resolve_scope:
>     case op_get_from_scope:
>     case op_to_primitive:
>@@ -297,6 +298,7 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_pop_scope:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_strcat:
>     case op_to_primitive:
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -1435,6 +1435,14 @@ void CodeBlock::dumpBytecode(
>             out.printf("%s, %s, %s, %s", registerName(dst).data(), registerName(r1).data(), constantName(k0).data(), (scopeType == JSNameScope::FunctionNameScope) ? "functionScope" : ((scopeType == JSNameScope::CatchScope) ? "catchScope" : "unknownScopeType"));
>             break;
>         }
>+        case op_push_lexical_scope: {
>+            int dst = (++it)->u.operand;
>+            int scope = (++it)->u.operand;
>+            int symbolTable = (++it)->u.operand;
>+            printLocationAndOp(out, exec, location, it, "push_lexical_scope");
>+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(scope).data(), registerName(symbolTable).data());
>+            break;
>+        }
>         case op_catch: {
>             int r0 = (++it)->u.operand;
>             printLocationOpAndRegisterOperand(out, exec, location, it, "catch", r0);
>@@ -1819,6 +1827,9 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>     UnlinkedInstructionStream::Reader instructionReader(unlinkedCodeBlock->instructions());
> 
>     Vector<Instruction, 0, UnsafeVectorOverflow> instructions(instructionCount);
>+
>+    Vector<SymbolTable*> symbolTableStack;
>+
>     for (unsigned i = 0; !instructionReader.atEnd(); ) {
>         const UnlinkedInstruction* pc = instructionReader.next();
> 
>@@ -1923,12 +1934,32 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             break;
>         }
> 
>+        case op_push_lexical_scope: {
>+            SymbolTable* unlinkedTable = jsCast<SymbolTable*>(getConstant(pc[3].u.operand));
>+            RELEASE_ASSERT(unlinkedTable->scopeSize());
>+            SymbolTable* linkedTable = unlinkedTable->cloneScopePart(*m_vm);
>+            m_constantRegisters[pc[3].u.operand - FirstConstantRegisterIndex].set(m_globalObject->vm(), m_ownerExecutable.get(), linkedTable);
>+            symbolTableStack.append(linkedTable);
>+            break;
>+        }
>+
>+        case op_create_lexical_environment: {
>+            symbolTableStack.append(symbolTable());
>+            RELEASE_ASSERT(didCloneSymbolTable);
>+            break;
>+        }
>+
>+        case op_pop_scope: {
>+            symbolTableStack.removeLast();
>+            break;
>+        }
>+
>         case op_resolve_scope: {
>             const Identifier& ident = identifier(pc[3].u.operand);
>             ResolveType type = static_cast<ResolveType>(pc[4].u.operand);
>             RELEASE_ASSERT(type != LocalClosureVar);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, type);
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, type);
>             instructions[i + 4].u.operand = op.type;
>             instructions[i + 5].u.operand = op.depth;
>             if (op.lexicalEnvironment)
>@@ -1952,7 +1983,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[3].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -1970,14 +2001,21 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             if (modeAndType.type() == LocalClosureVar) {
>                 // Only do watching if the property we're putting to is not anonymous.
>                 if (static_cast<unsigned>(pc[2].u.operand) != UINT_MAX) {
>-                    RELEASE_ASSERT(didCloneSymbolTable);
>                     const Identifier& ident = identifier(pc[2].u.operand);
>                     StringImpl* uid = ident.impl();
>-                    ConcurrentJITLocker locker(m_symbolTable->m_lock);
>-                    SymbolTable::Map::iterator iter = m_symbolTable->find(locker, uid);
>-                    ASSERT(iter != m_symbolTable->end(locker));
>-                    iter->value.prepareToWatch(symbolTable());
>-                    instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                    bool found = false;
>+                    for (unsigned stackIdx = symbolTableStack.size(); stackIdx--; ) {
>+                        SymbolTable* symbolTable = symbolTableStack[stackIdx];
>+                        ConcurrentJITLocker locker(symbolTable->m_lock);
>+                        SymbolTable::Map::iterator iter = symbolTable->find(locker, uid);
>+                        if (iter != symbolTable->end(locker)) {
>+                            iter->value.prepareToWatch(symbolTable); // FIXME: what to do here.
>+                            instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                            found = true;
>+                            break;
>+                        }
>+                    }
>+                    RELEASE_ASSERT(found);
>                 } else
>                     instructions[i + 5].u.watchpointSet = nullptr;
>                 break;
>@@ -1985,7 +2023,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[2].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Put, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Put, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -2017,7 +2055,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             case ProfileTypeBytecodeGetFromScope: {
>                 const Identifier& ident = identifier(pc[4].u.operand);
>                 ResolveType type = static_cast<ResolveType>(pc[5].u.operand);
>-                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
>+                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
> 
>                 // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
>                 // https://bugs.webkit.org/show_bug.cgi?id=135184
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
>@@ -87,6 +87,10 @@ ParserError BytecodeGenerator::generate(
>     if (!callingClassConstructor)
>         m_scopeNode->emitBytecode(*this);
> 
>+    if (m_codeType == GlobalCode)
>+        popLexicalScope(m_scopeNode->lexicalVariables(), m_scopeNode->lexicalCaptures());
>+
>+
>     m_staticPropertyAnalyzer.kill();
> 
>     for (unsigned i = 0; i < m_tryRanges.size(); ++i) {
>@@ -167,6 +171,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>     for (size_t i = 0; i < varStack.size(); ++i)
>         codeBlock->addVariableDeclaration(varStack[i].first, !!(varStack[i].second & DeclarationStacks::IsConstant));
> 
>+    pushLexicalScope(m_scopeNode->lexicalVariables(), m_scopeNode->lexicalCaptures());
> }
> 
> BytecodeGenerator::BytecodeGenerator(VM& vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>@@ -196,7 +201,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>     bool shouldCaptureSomeOfTheThings = m_shouldEmitDebugHooks || m_codeBlock->needsFullScopeChain();
>     bool shouldCaptureAllOfTheThings = m_shouldEmitDebugHooks || codeBlock->usesEval();
>     bool needsArguments = functionNode->usesArguments() || codeBlock->usesEval();
>-    
>+
>     auto captures = [&] (StringImpl* uid) -> bool {
>         if (shouldCaptureAllOfTheThings)
>             return true;
>@@ -371,7 +376,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         emitOpcode(op_create_out_of_band_arguments);
>         instructions().append(m_argumentsRegister->index());
>     }
>-    
>+
>     // Now declare all variables.
>     for (const Identifier& ident : boundParameterProperties)
>         createVariable(ident, varKind(ident.impl()), IsVariable);
>@@ -380,6 +385,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         createVariable(ident, varKind(ident.impl()), IsVariable);
>         m_functionsToInitialize.append(function);
>     }
>+
>     for (auto& entry : functionNode->varStack()) {
>         ConstantMode constantMode = modeForIsConstant(entry.second & DeclarationStacks::IsConstant);
>         // Variables named "arguments" are never const.
>@@ -485,6 +491,10 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         instructions().append(0);
>         instructions().append(0);
>     }
>+
>+    // FIXME: make a way for this symbol table to be the same as the lexical symbol table for
>+    // lexical variables defined at the base level of functions.
>+    m_symbolTableStack.append(SymbolTableStackEntry(m_symbolTable, m_lexicalEnvironmentRegister)); 
> }
> 
> BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>@@ -551,12 +561,25 @@ RegisterID* BytecodeGenerator::newRegist
>     return &m_calleeRegisters.last();
> }
> 
>-RegisterID* BytecodeGenerator::newTemporary()
>+void BytecodeGenerator::reclaimUnusedRegisters()
> {
>-    // Reclaim free register IDs.
>     while (m_calleeRegisters.size() && !m_calleeRegisters.last().refCount())
>         m_calleeRegisters.removeLast();
>-        
>+}
>+
>+RegisterID* BytecodeGenerator::newLexicalVariable()
>+{
>+    // Reclaim free register IDs.
>+    reclaimUnusedRegisters();
>+
>+    return newRegister();
>+}
>+
>+RegisterID* BytecodeGenerator::newTemporary()
>+{
>+    // Reclaim free register IDs.
>+    reclaimUnusedRegisters();
>+
>     RegisterID* result = newRegister();
>     result->setTemporary();
>     return result;
>@@ -1188,6 +1211,76 @@ RegisterID* BytecodeGenerator::emitLoadG
>     return m_globalObjectRegister;
> }
> 
>+void BytecodeGenerator::pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTable* symbolTable = SymbolTable::create(*m_vm);
>+    ConcurrentJITLocker locker(symbolTable->m_lock);
>+    // FIXME: pre-fill variables with empty JSValue to implement TDZ.
>+    for (auto ident : vars) {
>+        SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+        if (!entry.isNull()) // FIXME: consider what to do here.
>+            continue;
>+
>+        VarKind varKind = capturedVars.contains(ident) ? VarKind::Scope : VarKind::Stack;
>+        VarOffset varOffset;
>+        if (varKind == VarKind::Scope)
>+            varOffset = VarOffset(symbolTable->takeNextScopeOffset(locker));
>+        else {
>+            ASSERT(varKind == VarKind::Stack);
>+            RegisterID* local = newLexicalVariable();
>+            local->ref();
>+            varOffset = VarOffset(local->virtualRegister());
>+        }
>+        SymbolTableEntry newEntry(varOffset, 0/*constantMode == IsConstant ? ReadOnly : 0*/);
>+        symbolTable->add(locker, ident.get(), newEntry);
>+    }
>+    
>+    RegisterID* newScope = nullptr;
>+    if (capturedVars.size()) {
>+        newScope = newLexicalVariable();
>+        newScope->ref();
>+
>+        emitOpcode(op_push_lexical_scope);
>+        instructions().append(newScope->index());
>+        instructions().append(scopeRegister()->index());
>+        instructions().append(addConstantValue(symbolTable->cloneScopePart(*m_vm))->index());
>+
>+        emitMove(scopeRegister(), newScope);
>+    }
>+
>+    m_symbolTableStack.append(SymbolTableStackEntry(symbolTable, newScope));
>+}
>+
>+void BytecodeGenerator::popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTableStackEntry entry = m_symbolTableStack.takeLast();
>+    SymbolTable* symbolTable = entry.first;
>+    ConcurrentJITLocker locker(symbolTable->m_lock);
>+    for (auto ident : vars) {
>+        if (capturedVars.contains(ident))
>+            continue;
>+        SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+        ASSERT(!entry.isNull());
>+        VarOffset offset = entry.varOffset();
>+        ASSERT(offset.isStack());
>+        RegisterID* local = &registerFor(offset.stackOffset());
>+        local->deref();
>+    }
>+
>+    if (capturedVars.size()) {
>+        RELEASE_ASSERT(entry.second);
>+        entry.second->deref();
>+        emitOpcode(op_pop_scope);
>+        instructions().append(scopeRegister()->index());
>+    }
>+}
>+
> Variable BytecodeGenerator::variable(const Identifier& property)
> {
>     if (property == propertyNames().thisIdentifier) {
>@@ -1198,18 +1291,23 @@ Variable BytecodeGenerator::variable(con
>     
>     if (!shouldOptimizeLocals())
>         return Variable(property);
>-    
>-    SymbolTableEntry entry = symbolTable().get(property.impl());
>-    if (entry.isNull())
>-        return Variable(property);
>-    
>-    if (entry.varOffset().isScope() && m_localScopeDepth) {
>-        // FIXME: We should be able to statically resolve through our local scopes.
>-        // https://bugs.webkit.org/show_bug.cgi?id=141885
>-        return Variable(property);
>+
>+    for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+        SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+        SymbolTableEntry entry = symbolTable.get(property.impl());
>+        if (entry.isNull())
>+            continue;
>+        
>+        if (entry.varOffset().isScope() && m_localScopeDepth) {
>+            // FIXME: We should be able to statically resolve through our local scopes.
>+            // https://bugs.webkit.org/show_bug.cgi?id=141885
>+            return Variable(property);
>+        }
>+        
>+        return variableForLocalEntry(property, entry);
>     }
>-    
>-    return variableForLocalEntry(property, entry);
>+
>+    return Variable(property);
> }
> 
> Variable BytecodeGenerator::variablePerSymbolTable(const Identifier& property)
>@@ -1240,9 +1338,9 @@ void BytecodeGenerator::createVariable(
>     ExistingVariableMode existingVariableMode)
> {
>     ASSERT(property != propertyNames().thisIdentifier);
>-    
>-    ConcurrentJITLocker locker(symbolTable().m_lock);
>-    SymbolTableEntry entry = symbolTable().get(locker, property.impl());
>+    SymbolTable& symbolTable = *m_symbolTable;
>+    ConcurrentJITLocker locker(symbolTable.m_lock);
>+    SymbolTableEntry entry = symbolTable.get(locker, property.impl());
>     
>     if (!entry.isNull()) {
>         if (existingVariableMode == IgnoreExisting)
>@@ -1266,13 +1364,13 @@ void BytecodeGenerator::createVariable(
>     
>     VarOffset varOffset;
>     if (varKind == VarKind::Scope)
>-        varOffset = VarOffset(symbolTable().takeNextScopeOffset(locker));
>+        varOffset = VarOffset(symbolTable.takeNextScopeOffset(locker));
>     else {
>         ASSERT(varKind == VarKind::Stack);
>         varOffset = VarOffset(virtualRegisterForLocal(m_calleeRegisters.size()));
>     }
>     SymbolTableEntry newEntry(varOffset, constantMode == IsConstant ? ReadOnly : 0);
>-    symbolTable().add(locker, property.impl(), newEntry);
>+    symbolTable.add(locker, property.impl(), newEntry);
>     
>     if (varKind == VarKind::Stack) {
>         RegisterID* local = addVar();
>@@ -1317,7 +1415,19 @@ RegisterID* BytecodeGenerator::emitResol
>         // don't do that already is that m_lexicalEnvironment is required by ConstDeclNode. ConstDeclNode
>         // requires weird things because it is a shameful pile of nonsense, but block scoping would make
>         // that code sensible and obviate the need for us to do bad things.
>-        return m_lexicalEnvironmentRegister;
>+        for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+            SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+            SymbolTableEntry entry = symbolTable.get(variable.ident().impl());
>+            if (entry.isNull())
>+                continue;
>+            
>+            RegisterID* scope = m_symbolTableStack[i].second; 
>+            RELEASE_ASSERT(scope);
>+            return scope;
>+        }
>+
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return nullptr;
>         
>     case VarKind::Invalid:
>         // Indicates non-local resolution.
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
>@@ -307,6 +307,11 @@ namespace JSC {
> 
>         RegisterID* ignoredResult() { return &m_ignoredResultRegister; }
> 
>+        // This will be allocated in the temporary region of registers, but it
>+        // will not be marked as a temporary. This will ensure that finalDestination()
>+        // does not overwrite a lexical variable that it mistakes as a temporary.
>+        RegisterID* newLexicalVariable();
>+
>         // Returns a place to write intermediate values of an operation
>         // which reuses dst if it is safe to do so.
>         RegisterID* tempDestination(RegisterID* dst)
>@@ -580,7 +585,11 @@ namespace JSC {
> 
>         OpcodeID lastOpcodeID() const { return m_lastOpcodeID; }
> 
>+        void pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+        void popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+
>     private:
>+        void reclaimUnusedRegisters();
>         Variable variableForLocalEntry(const Identifier&, const SymbolTableEntry&);
> 
>         void emitOpcode(OpcodeID);
>@@ -666,8 +675,9 @@ namespace JSC {
> 
>         bool shouldOptimizeLocals()
>         {
>-            if (m_codeType != FunctionCode)
>-                return false;
>+            // FIXME: won't always be true w/ lexical scoping. We will sometimes be able to optimize.
>+            //if (m_codeType != FunctionCode)
>+            //    return false;
> 
>             if (m_localScopeDepth)
>                 return false;
>@@ -698,6 +708,8 @@ namespace JSC {
>         bool m_shouldEmitProfileHooks;
> 
>         SymbolTable* m_symbolTable { nullptr };
>+        typedef std::pair<SymbolTable*, RegisterID*> SymbolTableStackEntry;
>+        Vector<SymbolTableStackEntry> m_symbolTableStack;
> 
>         ScopeNode* const m_scopeNode;
>         Strong<UnlinkedCodeBlock> m_codeBlock;
>Index: Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(working copy)
>@@ -1829,7 +1829,9 @@ void BlockNode::emitBytecode(BytecodeGen
> {
>     if (!m_statements)
>         return;
>+    generator.pushLexicalScope(m_declaredVariables, m_capturedVariables);
>     m_statements->emitBytecode(generator, dst);
>+    generator.popLexicalScope(m_declaredVariables, m_capturedVariables);
> }
> 
> // ------------------------------ EmptyStatementNode ---------------------------
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -3375,14 +3375,15 @@ bool ByteCodeParser::parseBlock(unsigned
>             case LocalClosureVar:
>             case ClosureVar:
>             case ClosureVarWithVarInjectionChecks: {
>-                JSLexicalEnvironment* lexicalEnvironment = currentInstruction[6].u.lexicalEnvironment.get();
>-                if (lexicalEnvironment
>-                    && lexicalEnvironment->symbolTable()->m_functionEnteredOnce.isStillValid()) {
>-                    m_graph.watchpoints().addLazily(lexicalEnvironment->symbolTable()->m_functionEnteredOnce);
>-                    addToGraph(Phantom, getDirect(m_inlineStackTop->remapOperand(VirtualRegister(currentInstruction[2].u.operand))));
>-                    set(VirtualRegister(dst), weakJSConstant(lexicalEnvironment));
>-                    break;
>-                }
>+                // FIXME: rebase with trunk when https://bugs.webkit.org/show_bug.cgi?id=143232 lands.
>+                //JSLexicalEnvironment* lexicalEnvironment = currentInstruction[6].u.lexicalEnvironment.get();
>+                //if (lexicalEnvironment
>+                //    && lexicalEnvironment->symbolTable()->m_functionEnteredOnce.isStillValid()) {
>+                //    m_graph.watchpoints().addLazily(lexicalEnvironment->symbolTable()->m_functionEnteredOnce);
>+                //    addToGraph(Phantom, getDirect(m_inlineStackTop->remapOperand(VirtualRegister(currentInstruction[2].u.operand))));
>+                //    set(VirtualRegister(dst), weakJSConstant(lexicalEnvironment));
>+                //    break;
>+                //}
>                 set(VirtualRegister(dst), getScope(VirtualRegister(currentInstruction[2].u.operand), depth));
>                 if (inlineCallFrame())
>                     addToGraph(Phantom, getDirect(m_inlineStackTop->remapOperand(VirtualRegister(currentInstruction[2].u.operand))));
>@@ -3590,6 +3591,19 @@ bool ByteCodeParser::parseBlock(unsigned
>             set(VirtualRegister(currentInstruction[2].u.operand), lexicalEnvironment);
>             NEXT_OPCODE(op_create_lexical_environment);
>         }
>+
>+        case op_push_lexical_scope: {
>+            Node* lexicalEnvironment = addToGraph(CreateActivation, get(VirtualRegister(currentInstruction[2].u.operand)), get(VirtualRegister(currentInstruction[3].u.operand)));
>+            set(VirtualRegister(currentInstruction[1].u.operand), lexicalEnvironment);
>+            //set(VirtualRegister(currentInstruction[2].u.operand), lexicalEnvironment);
>+            NEXT_OPCODE(op_push_lexical_scope);
>+        }
>+
>+        case op_pop_scope: {
>+            Node* poppedScope = addToGraph(SkipScope, get(VirtualRegister(currentInstruction[1].u.operand)));
>+            set(VirtualRegister(currentInstruction[1].u.operand), poppedScope);
>+            NEXT_OPCODE(op_pop_scope);
>+        }
>             
>         case op_get_scope: {
>             // Help the later stages a bit by doing some small constant folding here. Note that this
>Index: Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(working copy)
>@@ -208,6 +208,8 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_new_func:
>     case op_new_func_exp:
>     case op_create_lexical_environment:
>+    case op_push_lexical_scope:
>+    case op_pop_scope:
>         return CanCompileAndInline;
> 
>     case op_put_to_scope: {
>Index: Source/JavaScriptCore/dfg/DFGClobberize.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGClobberize.h	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGClobberize.h	(working copy)
>@@ -317,7 +317,7 @@ void clobberize(Graph& graph, Node* node
>         read(HeapObjectCount);
>         write(HeapObjectCount);
>         return;
>-        
>+
>     case CreateDirectArguments:
>     case CreateScopedArguments:
>     case CreateClonedArguments:
>Index: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(working copy)
>@@ -1179,11 +1179,16 @@ private:
>         }
> 
>         case CreateScopedArguments:
>-        case CreateActivation:
>         case NewFunction: {
>             fixEdge<CellUse>(node->child1());
>             break;
>         }
>+        case CreateActivation: {
>+            fixEdge<CellUse>(node->child1());
>+            if (node->child2())
>+                fixEdge<KnownCellUse>(node->child2());
>+            break;
>+        }
>             
> #if !ASSERT_DISABLED
>         // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
>Index: Source/JavaScriptCore/dfg/DFGNodeType.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGNodeType.h	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGNodeType.h	(working copy)
>@@ -185,7 +185,7 @@ namespace JSC { namespace DFG {
>     macro(GetArrayLength, NodeResultInt32) \
>     macro(GetTypedArrayByteOffset, NodeResultInt32) \
>     macro(GetScope, NodeResultJS) \
>-    macro(SkipScope, NodeResultJS) \
>+    macro(SkipScope, NodeResultJS | NodeMustGenerate) \
>     macro(GetClosureVar, NodeResultJS) \
>     macro(PutClosureVar, NodeMustGenerate) \
>     macro(GetGlobalVar, NodeResultJS) \
>@@ -267,7 +267,7 @@ namespace JSC { namespace DFG {
>     macro(ProfileType, NodeMustGenerate) \
>     macro(ProfileControlFlow, NodeMustGenerate) \
>     \
>-    macro(CreateActivation, NodeResultJS) \
>+    macro(CreateActivation, NodeResultJS | NodeMustGenerate) \
>     \
>     macro(CreateDirectArguments, NodeResultJS) \
>     macro(PhantomDirectArguments, NodeResultJS) \
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp	(working copy)
>@@ -4311,7 +4311,7 @@ void SpeculativeJIT::compile(Node* node)
>         compileCreateActivation(node);
>         break;
>     }
>-        
>+
>     case CreateDirectArguments: {
>         compileCreateDirectArguments(node);
>         break;
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -4443,7 +4443,11 @@ void SpeculativeJIT::compileCreateActiva
>     GPRReg scratch1GPR = scratch1.gpr();
>     GPRReg scratch2GPR = scratch2.gpr();
>         
>-    SymbolTable* table = m_jit.graph().symbolTableFor(node->origin.semantic);
>+    SymbolTable* table = nullptr;
>+    if (node->child2())
>+        table = node->child2()->castConstant<SymbolTable*>();
>+    else
>+        table = m_jit.graph().symbolTableFor(node->origin.semantic);
>     Structure* structure = m_jit.graph().globalObjectFor(
>         node->origin.semantic)->activationStructure();
>         
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -266,6 +266,7 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_profile_control_flow)
>         DEFINE_OP(op_push_name_scope)
>         DEFINE_OP(op_push_with_scope)
>+        DEFINE_OP(op_push_lexical_scope)
>         case op_put_by_id_out_of_line:
>         case op_put_by_id_transition_direct:
>         case op_put_by_id_transition_normal:
>Index: Source/JavaScriptCore/jit/JIT.h
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JIT.h	(working copy)
>@@ -535,6 +535,7 @@ namespace JSC {
>         void emit_op_profile_control_flow(Instruction*);
>         void emit_op_push_name_scope(Instruction*);
>         void emit_op_push_with_scope(Instruction*);
>+        void emit_op_push_lexical_scope(Instruction*);
>         void emit_op_put_by_id(Instruction*);
>         void emit_op_put_by_index(Instruction*);
>         void emit_op_put_by_val(Instruction*);
>@@ -716,6 +717,7 @@ namespace JSC {
>         MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EPc, int, Instruction*);
>         MacroAssembler::Call callOperation(J_JITOperation_EZ, int, int32_t);
>         MacroAssembler::Call callOperation(J_JITOperation_EZZ, int, int32_t, int32_t);
>+        MacroAssembler::Call callOperation(J_JITOperation_ESymtabZ, int, SymbolTable*, int32_t);
>         MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, size_t);
>         MacroAssembler::Call callOperation(S_JITOperation_ECC, RegisterID, RegisterID);
>         MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID);
>Index: Source/JavaScriptCore/jit/JITInlines.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlines.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITInlines.h	(working copy)
>@@ -295,6 +295,12 @@ ALWAYS_INLINE MacroAssembler::Call JIT::
>     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
> }
> 
>+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESymtabZ operation, int dst, SymbolTable* symbolTable, int32_t arg2)
>+{
>+    setupArgumentsWithExecState(TrustedImmPtr(symbolTable), TrustedImm32(arg2));
>+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
>+}
>+
> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_ECC operation, RegisterID regOp1, RegisterID regOp2)
> {
>     setupArgumentsWithExecState(regOp1, regOp2);
>Index: Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(working copy)
>@@ -815,6 +815,13 @@ void JIT::emit_op_catch(Instruction* cur
>     emitStore(exception, regT1, regT0);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand;
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOpcodes.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOpcodes.cpp	(working copy)
>@@ -520,6 +520,14 @@ void JIT::emit_op_catch(Instruction* cur
>     emitPutVirtualRegister(currentInstruction[1].u.operand);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand; 
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+    return;
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -1306,6 +1306,17 @@ void JIT_OPERATION operationPushWithScop
>     exec->uncheckedR(dst) = JSWithScope::create(exec, o, currentScope);
> }
> 
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState* exec, SymbolTable* symbolTable, int32_t scopeReg)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+
>+    return JSValue::encode(newScope);
>+}
>+
> void JIT_OPERATION operationPopScope(ExecState* exec, int32_t scopeReg)
> {
>     VM& vm = exec->vm();
>Index: Source/JavaScriptCore/jit/JITOperations.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOperations.h	(working copy)
>@@ -122,6 +122,7 @@ typedef EncodedJSValue JIT_OPERATION (*J
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZ)(ExecState*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZIcfZ)(ExecState*, int32_t, InlineCallFrame*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZZ)(ExecState*, int32_t, int32_t);
>+typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_ESymtabZ)(ExecState*, SymbolTable*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_E)(ExecState*);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EZ)(ExecState*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EC)(ExecState*, JSCell*);
>@@ -296,6 +297,7 @@ void JIT_OPERATION operationPutGetterSet
> void JIT_OPERATION operationPushCatchScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushFunctionNameScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushWithScope(ExecState*, int32_t, EncodedJSValue) WTF_INTERNAL;
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState*, SymbolTable*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationPopScope(ExecState*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationProfileDidCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationProfileWillCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 182114)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -1272,6 +1272,16 @@ LLINT_SLOW_PATH_DECL(slow_path_push_name
>     LLINT_END();
> }
> 
>+LLINT_SLOW_PATH_DECL(slow_path_push_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[2].u.operand;
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    SymbolTable* symbolTable = jsCast<SymbolTable*>(LLINT_OP_C(3).jsValue());
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+    LLINT_RETURN(newScope);
>+}
>+
> LLINT_SLOW_PATH_DECL(slow_path_throw)
> {
>     LLINT_BEGIN();
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.h	(revision 182114)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.h	(working copy)
>@@ -108,6 +108,7 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_name_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_lexical_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_handle_watchdog_timer);
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 182114)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -1287,6 +1287,12 @@ _llint_op_push_name_scope:
>     dispatch(5)
> 
> 
>+_llint_op_push_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_push_lexical_scope)
>+    dispatch(4)
>+
>+
> _llint_op_throw:
>     traceExecution()
>     callSlowPath(_llint_slow_path_throw)
>Index: Source/JavaScriptCore/parser/ASTBuilder.h
>===================================================================
>--- Source/JavaScriptCore/parser/ASTBuilder.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/ASTBuilder.h	(working copy)
>@@ -386,9 +386,9 @@ public:
>     }
> #endif
> 
>-    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine)
>+    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine, IdentifierSet& lexicalVariables, IdentifierSet lexicallyCapturedVariables)
>     {
>-        BlockNode* block = new (m_parserArena) BlockNode(location, elements);
>+        BlockNode* block = new (m_parserArena) BlockNode(location, elements, lexicalVariables, lexicallyCapturedVariables);
>         block->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return block;
>     }
>@@ -457,6 +457,12 @@ public:
>         return result;
>     }
> 
>+    StatementNode* createLetStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
>+    {
>+        // FIXME: better name for 'VarStatementNode'.
>+        return createVarStatement(location, expr, start, end);
>+    }
>+
>     ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier)
>     {
>         return new (m_parserArena) EmptyVarExpression(location, identifier);
>Index: Source/JavaScriptCore/parser/Keywords.table
>===================================================================
>--- Source/JavaScriptCore/parser/Keywords.table	(revision 182114)
>+++ Source/JavaScriptCore/parser/Keywords.table	(working copy)
>@@ -2,56 +2,56 @@
> @begin mainTable 47
> 
> # Types.
>-null		NULLTOKEN
>-true		TRUETOKEN
>-false		FALSETOKEN
>+null         NULLTOKEN
>+true         TRUETOKEN
>+false        FALSETOKEN
> 
> # Keywords.
>-break		BREAK
>-case		CASE
>-catch		CATCH
>-class		CLASSTOKEN
>-const		CONSTTOKEN
>-default		DEFAULT
>-extends	EXTENDS
>-finally		FINALLY
>-for		FOR
>-instanceof	INSTANCEOF
>-new		NEW
>-var		VAR
>-continue	CONTINUE
>-function	FUNCTION
>-return		RETURN
>-void		VOIDTOKEN
>-delete		DELETETOKEN
>-if		IF
>-this		THISTOKEN
>-do		DO
>-while		WHILE
>-else		ELSE
>-in		INTOKEN
>-super		SUPER
>-switch		SWITCH
>-throw		THROW
>-try		TRY
>-typeof		TYPEOF
>-with		WITH
>-debugger	DEBUGGER
>+break        BREAK
>+case         CASE
>+catch        CATCH
>+class        CLASSTOKEN
>+const        CONSTTOKEN
>+default      DEFAULT
>+extends      EXTENDS
>+finally      FINALLY
>+for          FOR
>+instanceof   INSTANCEOF
>+new          NEW
>+var          VAR
>+let          LET
>+continue     CONTINUE
>+function     FUNCTION
>+return       RETURN
>+void         VOIDTOKEN
>+delete       DELETETOKEN
>+if           IF
>+this         THISTOKEN
>+do           DO
>+while        WHILE
>+else         ELSE
>+in           INTOKEN
>+super        SUPER
>+switch       SWITCH
>+throw        THROW
>+try          TRY
>+typeof       TYPEOF
>+with         WITH
>+debugger     DEBUGGER
> 
> # Reserved for future use.
>-enum            RESERVED
>-export          RESERVED
>-import          RESERVED
>+enum         RESERVED
>+export       RESERVED
>+import       RESERVED
> 
> # Reserved for future use in strict code.
>-implements      RESERVED_IF_STRICT
>-interface       RESERVED_IF_STRICT
>-let             RESERVED_IF_STRICT
>-package         RESERVED_IF_STRICT
>-private         RESERVED_IF_STRICT
>-protected       RESERVED_IF_STRICT
>-public          RESERVED_IF_STRICT
>-static          RESERVED_IF_STRICT
>-yield           RESERVED_IF_STRICT
>+implements   RESERVED_IF_STRICT
>+interface    RESERVED_IF_STRICT
>+package      RESERVED_IF_STRICT
>+private      RESERVED_IF_STRICT
>+protected    RESERVED_IF_STRICT
>+public       RESERVED_IF_STRICT
>+static       RESERVED_IF_STRICT
>+yield        RESERVED_IF_STRICT
> 
> @end
>Index: Source/JavaScriptCore/parser/NodeConstructors.h
>===================================================================
>--- Source/JavaScriptCore/parser/NodeConstructors.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/NodeConstructors.h	(working copy)
>@@ -846,8 +846,9 @@ namespace JSC {
>     {
>     }
> 
>-    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements)
>+    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements, IdentifierSet& lexicalVariables, IdentifierSet lexicallyCapturedVariables)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicallyCapturedVariables)
>         , m_statements(statements)
>     {
>     }
>Index: Source/JavaScriptCore/parser/Nodes.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.cpp	(revision 182114)
>+++ Source/JavaScriptCore/parser/Nodes.cpp	(working copy)
>@@ -94,12 +94,14 @@ ScopeNode::ScopeNode(ParserArena& parser
> {
> }
> 
>-ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, CodeFeatures features, int numConstants)
>+ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet lexicalCaptures, CodeFeatures features, int numConstants)
>     : StatementNode(endLocation)
>     , ParserArenaRoot(parserArena)
>     , m_startLineNumber(startLocation.line)
>     , m_startStartOffset(startLocation.startOffset)
>     , m_startLineStartOffset(startLocation.lineStartOffset)
>+    , m_lexicalVariables(lexicalVariables)
>+    , m_lexicalCaptures(lexicalCaptures)
>     , m_features(features)
>     , m_source(source)
>     , m_numConstants(numConstants)
>@@ -117,8 +119,8 @@ StatementNode* ScopeNode::singleStatemen
> 
> // ------------------------------ ProgramNode -----------------------------
> 
>-ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet lexicalCaptures, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>@@ -131,8 +133,8 @@ void ProgramNode::setClosedVariables(Vec
> 
> // ------------------------------ EvalNode -----------------------------
> 
>-EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet lexicalCaptures, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_endColumn(endColumn)
> {
> }
>@@ -201,8 +203,8 @@ void FunctionBodyNode::setEndPosition(JS
> 
> // ------------------------------ FunctionNode -----------------------------
> 
>-FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, features, numConstants)
>+FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet lexicalCaptures, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>Index: Source/JavaScriptCore/parser/Nodes.h
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/Nodes.h	(working copy)
>@@ -47,6 +47,7 @@ namespace JSC {
>     class RegisterID;
>     class JSScope;
>     class ScopeNode;
>+    class LexicalNode;
> 
>     enum Operator {
>         OpEqual,
>@@ -202,6 +203,21 @@ namespace JSC {
>         int m_lastLine;
>     };
> 
>+    class LexicalNode {
>+    public:
>+        LexicalNode(IdentifierSet& declaredVariables, IdentifierSet capturedVariables)
>+            : m_declaredVariables(declaredVariables)
>+            , m_capturedVariables(capturedVariables)
>+        {
>+        }
>+
>+        bool captures(StringImpl* uid) { return m_capturedVariables.contains(uid); }
>+
>+    protected:
>+        IdentifierSet m_declaredVariables;
>+        IdentifierSet m_capturedVariables;
>+    };
>+
>     class ConstantNode : public ExpressionNode {
>     public:
>         ConstantNode(const JSTokenLocation&, ResultType);
>@@ -1190,9 +1206,9 @@ namespace JSC {
>         StatementNode* m_tail;
>     };
> 
>-    class BlockNode : public StatementNode {
>+    class BlockNode : public StatementNode, public LexicalNode {
>     public:
>-        BlockNode(const JSTokenLocation&, SourceElements* = 0);
>+        BlockNode(const JSTokenLocation&, SourceElements*, IdentifierSet&, IdentifierSet);
> 
>         StatementNode* singleStatement() const;
>         StatementNode* lastStatement() const;
>@@ -1442,7 +1458,7 @@ namespace JSC {
>         typedef DeclarationStacks::FunctionStack FunctionStack;
> 
>         ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, bool inStrictContext);
>-        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, CodeFeatures, int numConstants);
>+        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet, CodeFeatures, int numConstants);
> 
>         using ParserArenaRoot::operator new;
> 
>@@ -1469,6 +1485,8 @@ namespace JSC {
>         bool hasCapturedVariables() const { return !!m_capturedVariables.size(); }
>         size_t capturedVariableCount() const { return m_capturedVariables.size(); }
>         const IdentifierSet& capturedVariables() const { return m_capturedVariables; }
>+        const IdentifierSet& lexicalVariables() const { return m_lexicalVariables; }
>+        const IdentifierSet& lexicalCaptures() const { return m_lexicalCaptures; }
>         bool captures(StringImpl* uid) { return m_capturedVariables.contains(uid); }
>         bool captures(const Identifier& ident) { return captures(ident.impl()); }
> 
>@@ -1492,6 +1510,8 @@ namespace JSC {
>         int m_startLineNumber;
>         unsigned m_startStartOffset;
>         unsigned m_startLineStartOffset;
>+        IdentifierSet m_lexicalVariables;
>+        IdentifierSet m_lexicalCaptures;
> 
>     private:
>         CodeFeatures m_features;
>@@ -1505,7 +1525,7 @@ namespace JSC {
> 
>     class ProgramNode : public ScopeNode {
>     public:
>-        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet, const SourceCode&, CodeFeatures, int numConstants);
> 
>         unsigned startColumn() const { return m_startColumn; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1524,7 +1544,7 @@ namespace JSC {
> 
>     class EvalNode : public ScopeNode {
>     public:
>-        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet, const SourceCode&, CodeFeatures, int numConstants);
> 
>         ALWAYS_INLINE unsigned startColumn() const { return 0; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1611,7 +1631,7 @@ namespace JSC {
> 
>     class FunctionNode final : public ScopeNode {
>     public:
>-        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet, const SourceCode&, CodeFeatures, int numConstants);
> 
>         FunctionParameters* parameters() const { return m_parameters.get(); }
> 
>Index: Source/JavaScriptCore/parser/Parser.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.cpp	(revision 182114)
>+++ Source/JavaScriptCore/parser/Parser.cpp	(working copy)
>@@ -263,6 +263,9 @@ String Parser<LexerType>::parseInner()
>     if (m_lexer->isReparsing())
>         m_statementDepth--;
>     ScopeRef scope = currentScope();
>+    if (!scope->isFunction())
>+        scope->setIsLexicalScope(); // FIXME: maybe push another scope on top.
>+
>     SourceElements* sourceElements = parseSourceElements(context, CheckForStrictMode);
>     if (!sourceElements || !consume(EOFTOK)) {
>         if (hasError())
>@@ -373,9 +376,9 @@ template <class TreeBuilder> TreeSourceE
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVarDeclaration(TreeBuilder& context)
>+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVariableDeclaration(TreeBuilder& context, DeclarationType type)
> {
>-    ASSERT(match(VAR));
>+    ASSERT(match(VAR) || match(LET));
>     JSTokenLocation location(tokenLocation());
>     int start = tokenLine();
>     int end = 0;
>@@ -383,11 +386,14 @@ template <class TreeBuilder> TreeStateme
>     TreeDeconstructionPattern scratch1 = 0;
>     TreeExpression scratch2 = 0;
>     JSTextPosition scratch3;
>-    TreeExpression varDecls = parseVarDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext);
>+    TreeExpression decls = parseVarDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext, type);
>     propagateError();
>     failIfFalse(autoSemiColon(), "Expected ';' after var declaration");
>     
>-    return context.createVarStatement(location, varDecls, start, end);
>+    if (type == VarDeclaration)
>+        return context.createVarStatement(location, decls, start, end);
>+    else 
>+        return context.createLetStatement(location, decls, start, end);
> }
> 
> template <typename LexerType>
>@@ -452,7 +458,7 @@ template <class TreeBuilder> TreeStateme
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext)
>+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext, DeclarationType type)
> {
>     TreeExpression head = 0;
>     TreeExpression tail = 0;
>@@ -475,7 +481,7 @@ template <class TreeBuilder> TreeExpress
>             lastIdentToken = m_token;
>             next();
>             hasInitializer = match(EQUAL);
>-            failIfFalseIfStrict(declareVariable(name), "Cannot declare a variable named ", name->impl(), " in strict mode");
>+            failIfFalseIfStrict(declareVariable(name, type), "Cannot declare a variable named ", name->impl(), " in strict mode");
>             context.addVar(name, (hasInitializer || (!m_allowsIn && (match(INTOKEN) || isofToken()))) ? DeclarationStacks::HasInitializer : 0);
>             if (hasInitializer) {
>                 JSTextPosition varDivot = tokenStartPosition() + 1;
>@@ -512,8 +518,10 @@ template <class TreeBuilder> TreeExpress
>         } else
>             tail = context.appendToCommaExpr(location, head, tail, node);
>     } while (match(COMMA));
>+    // FIXME: consider that this causes the last variable in each declaration list to be declared twice.
>     if (lastIdent)
>         lastPattern = createBindingPattern(context, DeconstructToVariables, *lastIdent, 0, lastIdentToken);
>+
>     return head;
> }
> 
>@@ -734,7 +742,7 @@ template <class TreeBuilder> TreeStateme
>     JSTextPosition declsEnd;
>     TreeExpression decls = 0;
>     TreeDeconstructionPattern pattern = 0;
>-    if (match(VAR)) {
>+    if (match(VAR)) { // FIXME: handle LET
>         /*
>          for (var IDENT in expression) statement
>          for (var varDeclarationList; expressionOpt; expressionOpt)
>@@ -744,7 +752,7 @@ template <class TreeBuilder> TreeStateme
>         m_allowsIn = false;
>         JSTextPosition initStart;
>         JSTextPosition initEnd;
>-        decls = parseVarDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext);
>+        decls = parseVarDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext, VarDeclaration);
>         m_allowsIn = true;
>         propagateError();
> 
>@@ -1084,7 +1092,7 @@ template <class TreeBuilder> TreeStateme
>         next();
>         AutoPopScopeRef catchScope(this, pushScope());
>         failIfFalseIfStrict(declareVariable(ident), "Cannot declare a catch variable named '", ident->impl(), "' in strict mode");
>-        catchScope->preventNewDecls();
>+        catchScope->preventAllVariableDeclarations();
>         handleProductionOrFail(CLOSEPAREN, ")", "end", "'catch' target");
>         matchOrFail(OPENBRACE, "Expected exception handler to be a block statement");
>         catchBlock = parseBlockStatement(context);
>@@ -1120,6 +1128,9 @@ template <typename LexerType>
> template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBlockStatement(TreeBuilder& context)
> {
>     ASSERT(match(OPENBRACE));
>+    AutoPopScopeRef blockScope(this, pushScope());
>+    blockScope->setIsLexicalScope();
>+    blockScope->preventVarDeclarations();
>     JSTokenLocation location(tokenLocation());
>     int startOffset = m_token.m_data.offset;
>     int start = tokenLine();
>@@ -1127,9 +1138,10 @@ template <class TreeBuilder> TreeStateme
>     if (match(CLOSEBRACE)) {
>         int endOffset = m_token.m_data.offset;
>         next();
>-        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line);
>+        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line, blockScope->lexicallyDeclaredVariables(), blockScope->lexicallyCapturedVariables());
>         context.setStartOffset(result, startOffset);
>         context.setEndOffset(result, endOffset);
>+        failIfFalse(popScope(blockScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>         return result;
>     }
>     TreeSourceElements subtree = parseSourceElements(context, DontCheckForStrictMode);
>@@ -1137,9 +1149,10 @@ template <class TreeBuilder> TreeStateme
>     matchOrFail(CLOSEBRACE, "Expected a closing '}' at the end of a block statement");
>     int endOffset = m_token.m_data.offset;
>     next();
>-    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line);
>+    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line, blockScope->lexicallyDeclaredVariables(), blockScope->lexicallyCapturedVariables());
>     context.setStartOffset(result, startOffset);
>     context.setEndOffset(result, endOffset);
>+    failIfFalse(popScope(blockScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>     return result;
> }
> 
>@@ -1159,7 +1172,12 @@ template <class TreeBuilder> TreeStateme
>         shouldSetEndOffset = false;
>         break;
>     case VAR:
>-        result = parseVarDeclaration(context);
>+        result = parseVariableDeclaration(context, VarDeclaration);
>+        break;
>+    case LET:
>+        // FIXME: this should be thought of as an identifier in non strict mode code.
>+        failIfFalse(strictMode(), "'let' declarations are only allowed in strict mode.");
>+        result = parseVariableDeclaration(context, LetDeclaration);
>         break;
>     case CONSTTOKEN:
>         result = parseConstDeclaration(context);
>@@ -1397,6 +1415,7 @@ template <class TreeBuilder> bool Parser
>         info.bodyEndLine = m_lastTokenEndPosition.line;
>         return true;
>     }
>+
>     m_lastFunctionName = lastFunctionName;
>     ParserState oldState = saveState();
>     info.body = parseFunctionBody(context, functionKeywordStart, functionNameStart, parametersStart, constructorKind);
>Index: Source/JavaScriptCore/parser/Parser.h
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/Parser.h	(working copy)
>@@ -115,9 +115,11 @@ struct Scope {
>         , m_needsFullActivation(false)
>         , m_hasDirectSuper(false)
>         , m_needsSuperBinding(false)
>-        , m_allowsNewDecls(true)
>+        , m_allowsVarDecls(true)
>+        , m_allowsLetDecls(true)
>         , m_strictMode(strictMode)
>         , m_isFunction(isFunction)
>+        , m_isLexicalScope(false)
>         , m_isFunctionBoundary(false)
>         , m_isValidStrictMode(true)
>         , m_loopDepth(0)
>@@ -132,9 +134,11 @@ struct Scope {
>         , m_needsFullActivation(rhs.m_needsFullActivation)
>         , m_hasDirectSuper(rhs.m_hasDirectSuper)
>         , m_needsSuperBinding(rhs.m_needsSuperBinding)
>-        , m_allowsNewDecls(rhs.m_allowsNewDecls)
>+        , m_allowsVarDecls(rhs.m_allowsVarDecls)
>+        , m_allowsLetDecls(rhs.m_allowsLetDecls)
>         , m_strictMode(rhs.m_strictMode)
>         , m_isFunction(rhs.m_isFunction)
>+        , m_isLexicalScope(rhs.m_isLexicalScope)
>         , m_isFunctionBoundary(rhs.m_isFunctionBoundary)
>         , m_isValidStrictMode(rhs.m_isValidStrictMode)
>         , m_loopDepth(rhs.m_loopDepth)
>@@ -187,9 +191,33 @@ struct Scope {
>     {
>         m_isFunction = true;
>         m_isFunctionBoundary = true;
>+        setIsLexicalScope();
>+    }
>+    bool isFunction() const { return m_isFunction; }
>+    bool isFunctionBoundary() const { return m_isFunctionBoundary; }
>+
>+    void setIsLexicalScope() { m_isLexicalScope = true; }
>+    IdentifierSet& lexicallyDeclaredVariables() { return m_lexicallyDeclaredVariables; }
>+    IdentifierSet lexicallyCapturedVariables()
>+    {
>+        IdentifierSet result;
>+        IdentifierSet::iterator end = m_lexicallyDeclaredVariables.end();
>+        for (IdentifierSet::iterator ptr = m_lexicallyDeclaredVariables.begin(); ptr != end; ++ptr) {
>+            if (m_closedVariables.contains(*ptr))
>+                result.add(*ptr);
>+        }
>+
>+        return result; 
>+    }
>+
>+    void dumpLexicalVariables()
>+    {
>+        IdentifierSet lexicalCaptures = lexicallyCapturedVariables();
>+        IdentifierSet::iterator end = m_lexicallyDeclaredVariables.end();
>+        for (IdentifierSet::iterator ptr = m_lexicallyDeclaredVariables.begin(); ptr != end; ++ptr) {
>+            printf("lexical variable: '%s' is captured: %d\n", String(*ptr).ascii().data(), lexicalCaptures.contains(*ptr));
>+        }
>     }
>-    bool isFunction() { return m_isFunction; }
>-    bool isFunctionBoundary() { return m_isFunctionBoundary; }
> 
>     void declareCallee(const Identifier* ident)
>     {
>@@ -204,6 +232,14 @@ struct Scope {
>         return isValidStrictMode;
>     }
> 
>+    bool declareLexicalVariable(const Identifier* ident)
>+    {
>+        bool isValidStrictMode = m_vm->propertyNames->eval != *ident && m_vm->propertyNames->arguments != *ident;
>+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
>+        m_lexicallyDeclaredVariables.add(ident->string().impl());
>+        return isValidStrictMode;
>+    }
>+
>     bool hasDeclaredVariable(const Identifier& ident)
>     {
>         return m_declaredVariables.contains(ident.impl());
>@@ -220,8 +256,14 @@ struct Scope {
>         m_writtenVariables.add(ident->impl());
>     }
> 
>-    void preventNewDecls() { m_allowsNewDecls = false; }
>-    bool allowsNewDecls() const { return m_allowsNewDecls; }
>+    void preventAllVariableDeclarations()
>+    {
>+        m_allowsVarDecls = false; 
>+        m_allowsLetDecls = false;
>+    }
>+    void preventVarDeclarations() { m_allowsVarDecls = false; }
>+    bool allowsNewDecls() const { return m_allowsVarDecls; }
>+    bool allowsLexicalDeclarations() const { return m_allowsLetDecls; }
> 
>     bool declareParameter(const Identifier* ident)
>     {
>@@ -287,16 +329,29 @@ struct Scope {
>             m_usesEval = true;
>         IdentifierSet::iterator end = nestedScope->m_usedVariables.end();
>         for (IdentifierSet::iterator ptr = nestedScope->m_usedVariables.begin(); ptr != end; ++ptr) {
>-            if (nestedScope->m_declaredVariables.contains(*ptr))
>+            if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                 continue;
>             m_usedVariables.add(*ptr);
>-            if (shouldTrackClosedVariables)
>+            // FIXME: This isn't so intuitive and we should have better names here. Basically, we don't
>+            // want a declared variable that is used in an inner scope to be thought of as captured if
>+            // that inner scope is both a lexical scope and not a function. Only inner functions
>+            // can capture variables.
>+            if (shouldTrackClosedVariables && nestedScope->m_isFunctionBoundary)
>+                m_closedVariables.add(*ptr);
>+        }
>+
>+        if (nestedScope->m_isLexicalScope && !nestedScope->m_isFunctionBoundary) {
>+            // Propagate closed variables downwards from nested block scopes within the same function/global code.
>+            IdentifierSet::iterator end = nestedScope->m_closedVariables.end();
>+            for (IdentifierSet::iterator ptr = nestedScope->m_closedVariables.begin(); ptr != end; ++ptr)
>                 m_closedVariables.add(*ptr);
>         }
>+
>         if (nestedScope->m_writtenVariables.size()) {
>             IdentifierSet::iterator end = nestedScope->m_writtenVariables.end();
>             for (IdentifierSet::iterator ptr = nestedScope->m_writtenVariables.begin(); ptr != end; ++ptr) {
>-                if (nestedScope->m_declaredVariables.contains(*ptr))
>+                // FIXME: make sure this is correct here.
>+                if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                     continue;
>                 m_writtenVariables.add(*ptr);
>             }
>@@ -376,9 +431,11 @@ private:
>     bool m_needsFullActivation : 1;
>     bool m_hasDirectSuper : 1;
>     bool m_needsSuperBinding : 1;
>-    bool m_allowsNewDecls : 1;
>+    bool m_allowsVarDecls : 1;
>+    bool m_allowsLetDecls : 1;
>     bool m_strictMode : 1;
>     bool m_isFunction : 1;
>+    bool m_isLexicalScope : 1;
>     bool m_isFunctionBoundary : 1;
>     bool m_isValidStrictMode : 1;
>     int m_loopDepth;
>@@ -388,6 +445,7 @@ private:
>     std::unique_ptr<LabelStack> m_labels;
>     IdentifierSet m_declaredParameters;
>     IdentifierSet m_declaredVariables;
>+    IdentifierSet m_lexicallyDeclaredVariables;
>     IdentifierSet m_usedVariables;
>     IdentifierSet m_closedVariables;
>     IdentifierSet m_writtenVariables;
>@@ -437,6 +495,7 @@ public:
> 
>     JSTextPosition positionBeforeLastNewline() const { return m_lexer->positionBeforeLastNewline(); }
>     Vector<RefPtr<StringImpl>>&& closedVariables() { return WTF::move(m_closedVariables); }
>+    enum DeclarationType { VarDeclaration, LetDeclaration };
> 
> private:
>     struct AllowInOverride {
>@@ -513,15 +572,27 @@ private:
>         return popScopeInternal(scope, shouldTrackClosedVariables);
>     }
>     
>-    bool declareVariable(const Identifier* ident)
>+    bool declareVariable(const Identifier* ident, Parser::DeclarationType type = VarDeclaration)
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+
>+        if (type == VarDeclaration) {
>+            while (!m_scopeStack[i].allowsNewDecls()) {
>+                i--;
>+                ASSERT(i < m_scopeStack.size());
>+            }
>+
>+            return m_scopeStack[i].declareVariable(ident);
>+        }
>+
>+        ASSERT(type == LetDeclaration);
>+        while (!m_scopeStack[i].allowsLexicalDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>-        return m_scopeStack[i].declareVariable(ident);
>+
>+        return m_scopeStack[i].declareLexicalVariable(ident);
>     }
>     
>     NEVER_INLINE bool hasDeclaredVariable(const Identifier& ident)
>@@ -562,8 +633,8 @@ private:
>     Parser();
>     String parseInner();
> 
>-    void didFinishParsing(SourceElements*, DeclarationStacks::VarStack&, 
>-        DeclarationStacks::FunctionStack&, CodeFeatures, int, IdentifierSet&, const Vector<RefPtr<StringImpl>>&&);
>+    void didFinishParsing(SourceElements*, DeclarationStacks::VarStack&, DeclarationStacks::FunctionStack&, 
>+        CodeFeatures, int, IdentifierSet&, const Vector<RefPtr<StringImpl>>&&);
> 
>     // Used to determine type of error to report.
>     bool isFunctionBodyNode(ScopeNode*) { return false; }
>@@ -728,7 +799,7 @@ private:
>     template <class TreeBuilder> TreeStatement parseClassDeclaration(TreeBuilder&);
> #endif
>     template <class TreeBuilder> TreeStatement parseFunctionDeclaration(TreeBuilder&);
>-    template <class TreeBuilder> TreeStatement parseVarDeclaration(TreeBuilder&);
>+    template <class TreeBuilder> TreeStatement parseVariableDeclaration(TreeBuilder&, DeclarationType);
>     template <class TreeBuilder> TreeStatement parseConstDeclaration(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseDoWhileStatement(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseWhileStatement(TreeBuilder&);
>@@ -765,7 +836,7 @@ private:
>     template <class TreeBuilder> ALWAYS_INLINE TreeFunctionBody parseFunctionBody(TreeBuilder&, int functionKeywordStart, int functionNameStart, int parametersStart, ConstructorKind);
>     template <class TreeBuilder> ALWAYS_INLINE TreeFormalParameterList parseFormalParameters(TreeBuilder&);
>     enum VarDeclarationListContext { ForLoopContext, VarDeclarationContext };
>-    template <class TreeBuilder> TreeExpression parseVarDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext);
>+    template <class TreeBuilder> TreeExpression parseVarDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext, DeclarationType);
>     template <class TreeBuilder> NEVER_INLINE TreeConstDeclList parseConstDeclarationList(TreeBuilder&);
> 
>     template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern createBindingPattern(TreeBuilder&, DeconstructionKind, const Identifier&, int depth, JSToken);
>@@ -851,9 +922,7 @@ private:
>         m_assignmentCount = state.assignmentCount;
>         m_nonLHSCount = state.nonLHSCount;
>         m_nonTrivialExpressionCount = state.nonTrivialExpressionCount;
>-        
>     }
>-    
> 
>     VM* m_vm;
>     const SourceCode* m_source;
>@@ -951,6 +1020,8 @@ std::unique_ptr<ParsedNode> Parser<Lexer
>                                     m_varDeclarations,
>                                     m_funcDeclarations,
>                                     m_capturedVariables,
>+                                    currentScope()->lexicallyDeclaredVariables(),
>+                                    currentScope()->lexicallyCapturedVariables(),
>                                     *m_source,
>                                     m_features,
>                                     m_numConstants);
>Index: Source/JavaScriptCore/parser/ParserTokens.h
>===================================================================
>--- Source/JavaScriptCore/parser/ParserTokens.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/ParserTokens.h	(working copy)
>@@ -57,6 +57,7 @@ enum JSTokenType {
>     FOR,
>     NEW,
>     VAR,
>+    LET,
>     CONSTTOKEN,
>     CONTINUE,
>     FUNCTION,
>Index: Source/JavaScriptCore/parser/SyntaxChecker.h
>===================================================================
>--- Source/JavaScriptCore/parser/SyntaxChecker.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/SyntaxChecker.h	(working copy)
>@@ -206,7 +206,7 @@ public:
>     int createClassDeclStatement(const JSTokenLocation&, ClassExpression,
>         const JSTextPosition&, const JSTextPosition&, int, int) { return StatementResult; }
> #endif
>-    int createBlockStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createBlockStatement(const JSTokenLocation&, int, int, int, IdentifierSet&, IdentifierSet) { return StatementResult; }
>     int createExprStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int, int) { return StatementResult; }
>@@ -215,6 +215,7 @@ public:
>     int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>     int createEmptyStatement(const JSTokenLocation&) { return StatementResult; }
>     int createVarStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createLetStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createReturnStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
>Index: Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(working copy)
>@@ -64,6 +64,12 @@ public:
>         SymbolTable* symbolTable = codeBlock->symbolTable();
>         return create(vm, structure, currentScope, symbolTable);
>     }
>+
>+    static JSLexicalEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable)
>+    {
>+        Structure* structure = globalObject->activationStructure();
>+        return create(vm, structure, currentScope, symbolTable);
>+    }
>         
>     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
>     static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
>Index: Source/JavaScriptCore/runtime/JSNameScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSNameScope.cpp	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSNameScope.cpp	(working copy)
>@@ -42,6 +42,8 @@ JSNameScope* JSNameScope::create(VM& vm,
>         return JSCatchScope::create(vm, globalObject, currentScope, symbolTable, value);
>     case FunctionNameScope:
>         return JSFunctionNameScope::create(vm, globalObject, currentScope, symbolTable, value);
>+    default:
>+        RELEASE_ASSERT_NOT_REACHED();
>     }
>     RELEASE_ASSERT_NOT_REACHED();
>     return nullptr;
>Index: Source/JavaScriptCore/runtime/JSNameScope.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSNameScope.h	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSNameScope.h	(working copy)
>@@ -38,7 +38,8 @@ public:
> 
>     enum Type {
>         CatchScope,
>-        FunctionNameScope
>+        FunctionNameScope,
>+        LexicalScope
>     };
> 
>     template<typename T>
>Index: Source/JavaScriptCore/runtime/JSScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.cpp	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSScope.cpp	(working copy)
>@@ -148,20 +148,21 @@ JSValue JSScope::resolve(ExecState* exec
>     }
> }
> 
>-ResolveOp JSScope::abstractResolve(ExecState* exec, bool hasTopActivation, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
>+ResolveOp JSScope::abstractResolve(ExecState* exec, unsigned depthOffset, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
> {
>     ResolveOp op(Dynamic, 0, 0, 0, 0, 0);
>     if (unlinkedType == Dynamic)
>         return op;
> 
>-    size_t depth = hasTopActivation ? 1 : 0;
>     bool needsVarInjectionChecks = JSC::needsVarInjectionChecks(unlinkedType);
>+    size_t depth = depthOffset;
>     for (; scope; scope = scope->next()) {
>         if (abstractAccess(exec, scope, ident, getOrPut, depth, needsVarInjectionChecks, op))
>-            break;
>+            goto done;
>         ++depth;
>     }
> 
>+done:
>     return op;
> }
> 
>Index: Source/JavaScriptCore/runtime/JSScope.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.h	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSScope.h	(working copy)
>@@ -31,6 +31,7 @@
> namespace JSC {
> 
> class ScopeChainIterator;
>+class SymbolTable;
> class VariableWatchpointSet;
> 
> enum ResolveMode {
>@@ -156,7 +157,7 @@ public:
>     static JSObject* objectAtScope(JSScope*);
> 
>     static JSValue resolve(ExecState*, JSScope*, const Identifier&);
>-    static ResolveOp abstractResolve(ExecState*, bool hasTopActivation, JSScope*, const Identifier&, GetOrPut, ResolveType);
>+    static ResolveOp abstractResolve(ExecState*, unsigned depthOffset, JSScope*, const Identifier&, GetOrPut, ResolveType);
> 
>     static void visitChildren(JSCell*, SlotVisitor&);
>

Actions: View | Formatted Diff | Diff

Attachments on bug 142944: 249945 | 249961 | 250169 | 250230 | 250533 | 250684 | 250714 | 250715 | 251081 | 251130 | 251133 | 251136 | 251409 | 251653 | 251913 | 252074 | 253066 | 253070 | 253115 | 253794 | 255536 | 255614 | 255622 | 255804 | 255806 | 255807 | 255830 | 255834 | 255835 | 255871 | 256033 | 256036 | 256226 | 256232 | 256233 | 256257 | 256264 | 256267 | 256433 | 256438 | 256445 | 256450 | 256465 | 256481 | 256658 | 256860