Attachment 250533 Details for Bug 142944 – work in progres

[patch] work in progres

ternary-backup.diff (text/plain), 94.87 KB, created by Saam Barati on 2015-04-10 14:00:46 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2015-04-10 14:00:46 PDT

Size: 94.87 KB

patch

obsolete

>Index: Source/JavaScriptCore/bytecode/BytecodeList.json
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeList.json	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/BytecodeList.json	(working copy)
>@@ -111,6 +111,8 @@
>             { "name" : "op_push_with_scope", "length" : 3 },
>             { "name" : "op_pop_scope", "length" : 2 },
>             { "name" : "op_push_name_scope", "length" : 5 },
>+            { "name" : "op_push_lexical_scope", "length" : 4 },
>+            { "name" : "op_pop_lexical_scope", "length" : 2 },
>             { "name" : "op_catch", "length" : 2 },
>             { "name" : "op_throw", "length" : 2 },
>             { "name" : "op_throw_static_error", "length" : 3 },
>Index: Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(working copy)
>@@ -59,6 +59,7 @@ void computeUsesForBytecodeOffset(
>     case op_to_this:
>     case op_check_tdz:
>     case op_pop_scope:
>+    case op_pop_lexical_scope:
>     case op_profile_will_call:
>     case op_profile_did_call:
>     case op_profile_type:
>@@ -121,6 +122,7 @@ void computeUsesForBytecodeOffset(
>     case op_init_global_const:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_get_from_scope:
>     case op_to_primitive:
>@@ -295,8 +297,10 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_enumerator_structure_pname:
>     case op_enumerator_generic_pname:
>     case op_pop_scope:
>+    case op_pop_lexical_scope:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_strcat:
>     case op_to_primitive:
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -1426,6 +1426,11 @@ void CodeBlock::dumpBytecode(
>             printLocationOpAndRegisterOperand(out, exec, location, it, "pop_scope", r0);
>             break;
>         }
>+        case op_pop_lexical_scope: {
>+            int r0 = (++it)->u.operand;
>+            printLocationOpAndRegisterOperand(out, exec, location, it, "pop_lexical_scope", r0);
>+            break;
>+        }
>         case op_push_name_scope: {
>             int dst = (++it)->u.operand;
>             int r1 = (++it)->u.operand;
>@@ -1435,6 +1440,14 @@ void CodeBlock::dumpBytecode(
>             out.printf("%s, %s, %s, %s", registerName(dst).data(), registerName(r1).data(), constantName(k0).data(), (scopeType == JSNameScope::FunctionNameScope) ? "functionScope" : ((scopeType == JSNameScope::CatchScope) ? "catchScope" : "unknownScopeType"));
>             break;
>         }
>+        case op_push_lexical_scope: {
>+            int dst = (++it)->u.operand;
>+            int scope = (++it)->u.operand;
>+            int symbolTable = (++it)->u.operand;
>+            printLocationAndOp(out, exec, location, it, "push_lexical_scope");
>+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(scope).data(), registerName(symbolTable).data());
>+            break;
>+        }
>         case op_catch: {
>             int r0 = (++it)->u.operand;
>             printLocationOpAndRegisterOperand(out, exec, location, it, "catch", r0);
>@@ -1819,6 +1832,9 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>     UnlinkedInstructionStream::Reader instructionReader(unlinkedCodeBlock->instructions());
> 
>     Vector<Instruction, 0, UnsafeVectorOverflow> instructions(instructionCount);
>+
>+    Vector<SymbolTable*> symbolTableStack;
>+
>     for (unsigned i = 0; !instructionReader.atEnd(); ) {
>         const UnlinkedInstruction* pc = instructionReader.next();
> 
>@@ -1923,12 +1939,38 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             break;
>         }
> 
>+        case op_push_lexical_scope: {
>+            SymbolTable* unlinkedTable = jsCast<SymbolTable*>(getConstant(pc[3].u.operand));
>+            RELEASE_ASSERT(unlinkedTable->scopeSize());
>+            SymbolTable* linkedTable = unlinkedTable->cloneScopePart(*m_vm);
>+            {
>+                ConcurrentJITLocker locker(linkedTable->m_lock);
>+                for (auto iter = linkedTable->begin(locker), end = linkedTable->end(locker); iter != end; ++iter)
>+                    iter->value.disableWatching();
>+            }
>+            m_constantRegisters[pc[3].u.operand - FirstConstantRegisterIndex].set(m_globalObject->vm(), m_ownerExecutable.get(), linkedTable);
>+            symbolTableStack.append(linkedTable);
>+            break;
>+        }
>+
>+        case op_create_lexical_environment: {
>+            if (symbolTable()->scopeSize())
>+                RELEASE_ASSERT(didCloneSymbolTable);
>+            symbolTableStack.append(symbolTable());
>+            break;
>+        }
>+
>+        case op_pop_lexical_scope: {
>+            symbolTableStack.removeLast();
>+            break;
>+        }
>+
>         case op_resolve_scope: {
>             const Identifier& ident = identifier(pc[3].u.operand);
>             ResolveType type = static_cast<ResolveType>(pc[4].u.operand);
>             RELEASE_ASSERT(type != LocalClosureVar);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, type);
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, type);
>             instructions[i + 4].u.operand = op.type;
>             instructions[i + 5].u.operand = op.depth;
>             if (op.lexicalEnvironment)
>@@ -1952,7 +1994,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[3].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -1970,14 +2012,21 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             if (modeAndType.type() == LocalClosureVar) {
>                 // Only do watching if the property we're putting to is not anonymous.
>                 if (static_cast<unsigned>(pc[2].u.operand) != UINT_MAX) {
>-                    RELEASE_ASSERT(didCloneSymbolTable);
>                     const Identifier& ident = identifier(pc[2].u.operand);
>                     StringImpl* uid = ident.impl();
>-                    ConcurrentJITLocker locker(m_symbolTable->m_lock);
>-                    SymbolTable::Map::iterator iter = m_symbolTable->find(locker, uid);
>-                    ASSERT(iter != m_symbolTable->end(locker));
>-                    iter->value.prepareToWatch(symbolTable());
>-                    instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                    bool found = false;
>+                    for (unsigned stackIdx = symbolTableStack.size(); stackIdx--; ) {
>+                        SymbolTable* symbolTable = symbolTableStack[stackIdx];
>+                        ConcurrentJITLocker locker(symbolTable->m_lock);
>+                        SymbolTable::Map::iterator iter = symbolTable->find(locker, uid);
>+                        if (iter != symbolTable->end(locker)) {
>+                            iter->value.prepareToWatch(symbolTable); // FIXME: what to do here.
>+                            instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                            found = true;
>+                            break;
>+                        }
>+                    }
>+                    RELEASE_ASSERT(found);
>                 } else
>                     instructions[i + 5].u.watchpointSet = nullptr;
>                 break;
>@@ -1985,7 +2034,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[2].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Put, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Put, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -2017,7 +2066,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             case ProfileTypeBytecodeGetFromScope: {
>                 const Identifier& ident = identifier(pc[4].u.operand);
>                 ResolveType type = static_cast<ResolveType>(pc[5].u.operand);
>-                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
>+                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
> 
>                 // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
>                 // https://bugs.webkit.org/show_bug.cgi?id=135184
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
>@@ -75,6 +75,9 @@ ParserError BytecodeGenerator::generate(
>         entry.second->bindValue(*this, entry.first.get());
>     }
> 
>+    // Must come before functions.
>+    pushLexicalScope(m_scopeNode->lexicalVariables(), m_scopeNode->lexicalCaptures());
>+
>     {
>         RefPtr<RegisterID> temp = newTemporary();
>         for (FunctionBodyNode* functionBody : m_functionsToInitialize) {
>@@ -485,6 +488,10 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         instructions().append(0);
>         instructions().append(0);
>     }
>+
>+    // FIXME: make a way for this symbol table to be the same as the lexical symbol table for
>+    // lexical variables defined at the base level of functions.
>+    m_symbolTableStack.append(SymbolTableStackEntry(m_symbolTable, m_lexicalEnvironmentRegister));
> }
> 
> BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>@@ -551,12 +558,25 @@ RegisterID* BytecodeGenerator::newRegist
>     return &m_calleeRegisters.last();
> }
> 
>-RegisterID* BytecodeGenerator::newTemporary()
>+void BytecodeGenerator::reclaimUnusedRegisters()
> {
>-    // Reclaim free register IDs.
>     while (m_calleeRegisters.size() && !m_calleeRegisters.last().refCount())
>         m_calleeRegisters.removeLast();
>-        
>+}
>+
>+RegisterID* BytecodeGenerator::newLexicalVariable()
>+{
>+    // Reclaim free register IDs.
>+    reclaimUnusedRegisters();
>+
>+    return newRegister();
>+}
>+
>+RegisterID* BytecodeGenerator::newTemporary()
>+{
>+    // Reclaim free register IDs.
>+    reclaimUnusedRegisters();
>+
>     RegisterID* result = newRegister();
>     result->setTemporary();
>     return result;
>@@ -1188,6 +1208,107 @@ RegisterID* BytecodeGenerator::emitLoadG
>     return m_globalObjectRegister;
> }
> 
>+void BytecodeGenerator::pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTable* symbolTable = SymbolTable::create(*m_vm);
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto ident : vars) {
>+            SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+            if (!entry.isNull()) // FIXME: consider what to do here.
>+                continue;
>+
>+            VarKind varKind = capturedVars.contains(ident) ? VarKind::Scope : VarKind::Stack;
>+            VarOffset varOffset;
>+            if (varKind == VarKind::Scope)
>+                varOffset = VarOffset(symbolTable->takeNextScopeOffset(locker));
>+            else {
>+                ASSERT(varKind == VarKind::Stack);
>+                RegisterID* local = newLexicalVariable();
>+                local->ref();
>+                varOffset = VarOffset(local->virtualRegister());
>+            }
>+            SymbolTableEntry newEntry(varOffset, 0/*constantMode == IsConstant ? ReadOnly : 0*/);
>+            // FIXME: why does cloning symbol table not preserve disableWatching() for symbol table entries?
>+            // newEntry.disableWatching();
>+            symbolTable->add(locker, ident.get(), newEntry);
>+        }
>+    }
>+    
>+    RegisterID* newScope = nullptr;
>+    if (capturedVars.size()) {
>+        newScope = newLexicalVariable();
>+        newScope->ref();
>+
>+        emitOpcode(op_push_lexical_scope);
>+        instructions().append(newScope->index());
>+        instructions().append(scopeRegister()->index());
>+        instructions().append(addConstantValue(symbolTable->cloneScopePart(*m_vm))->index());
>+
>+        emitMove(scopeRegister(), newScope);
>+    }
>+
>+    m_symbolTableStack.append(SymbolTableStackEntry(symbolTable, newScope));
>+    m_TDZStack.append(&vars);
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        // Prefill slots with the empty value.
>+        for (auto ident : vars) {
>+            SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+            ASSERT(!entry.isNull());
>+            VarOffset offset = entry.varOffset();
>+            RefPtr<RegisterID> emptyValue = addConstantEmptyValue();
>+            if (offset.isStack())
>+                emitMoveEmptyValue(&registerFor(offset.stackOffset()));
>+            else {
>+                ASSERT(offset.isScope() && newScope);
>+                const Identifier* identifier; 
>+                // FIXME: might be worth making LexicalNode have a hash set of Identifiers instead of StringImpls.
>+                // Or just allocating an Identifier straight up here outside the identifierArena.
>+                if (ident.get()->is8Bit())
>+                    identifier = &parserArena().identifierArena().makeIdentifier(m_vm, ident.get()->characters8(), ident.get()->length());
>+                else
>+                    identifier = &parserArena().identifierArena().makeIdentifier(m_vm, ident.get()->characters16(), ident.get()->length());
>+
>+                emitPutToScope(newScope, variableForLocalEntry(*identifier, entry), emptyValue.get(), DoNotThrowIfNotFound);
>+            }
>+        }
>+    }
>+}
>+
>+void BytecodeGenerator::popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTableStackEntry stackEntry = m_symbolTableStack.takeLast();
>+    SymbolTable* symbolTable = stackEntry.first;
>+    ConcurrentJITLocker locker(symbolTable->m_lock);
>+    for (auto ident : vars) {
>+        if (capturedVars.contains(ident))
>+            continue;
>+        SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+        ASSERT(!entry.isNull());
>+        VarOffset offset = entry.varOffset();
>+        ASSERT(offset.isStack());
>+        RegisterID* local = &registerFor(offset.stackOffset());
>+        local->deref();
>+    }
>+
>+    if (capturedVars.size()) {
>+        RELEASE_ASSERT(stackEntry.second);
>+        stackEntry.second->deref();
>+        emitOpcode(op_pop_lexical_scope);
>+        instructions().append(scopeRegister()->index());
>+    }
>+
>+    RELEASE_ASSERT(m_TDZStack.last() == &vars);
>+    m_TDZStack.removeLast();
>+}
>+
> Variable BytecodeGenerator::variable(const Identifier& property)
> {
>     if (property == propertyNames().thisIdentifier) {
>@@ -1196,20 +1317,19 @@ Variable BytecodeGenerator::variable(con
>             ReadOnly, Variable::SpecialVariable);
>     }
>     
>-    if (!shouldOptimizeLocals())
>-        return Variable(property);
>-    
>-    SymbolTableEntry entry = symbolTable().get(property.impl());
>-    if (entry.isNull())
>-        return Variable(property);
>-    
>-    if (entry.varOffset().isScope() && m_localScopeDepth) {
>-        // FIXME: We should be able to statically resolve through our local scopes.
>-        // https://bugs.webkit.org/show_bug.cgi?id=141885
>+    if (m_localScopeDepth)
>         return Variable(property);
>+
>+    for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+        SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+        SymbolTableEntry entry = symbolTable.get(property.impl());
>+        if (entry.isNull())
>+            continue;
>+        
>+        return variableForLocalEntry(property, entry);
>     }
>-    
>-    return variableForLocalEntry(property, entry);
>+
>+    return Variable(property);
> }
> 
> Variable BytecodeGenerator::variablePerSymbolTable(const Identifier& property)
>@@ -1240,9 +1360,9 @@ void BytecodeGenerator::createVariable(
>     ExistingVariableMode existingVariableMode)
> {
>     ASSERT(property != propertyNames().thisIdentifier);
>-    
>-    ConcurrentJITLocker locker(symbolTable().m_lock);
>-    SymbolTableEntry entry = symbolTable().get(locker, property.impl());
>+    SymbolTable& symbolTable = *m_symbolTable;
>+    ConcurrentJITLocker locker(symbolTable.m_lock);
>+    SymbolTableEntry entry = symbolTable.get(locker, property.impl());
>     
>     if (!entry.isNull()) {
>         if (existingVariableMode == IgnoreExisting)
>@@ -1266,13 +1386,13 @@ void BytecodeGenerator::createVariable(
>     
>     VarOffset varOffset;
>     if (varKind == VarKind::Scope)
>-        varOffset = VarOffset(symbolTable().takeNextScopeOffset(locker));
>+        varOffset = VarOffset(symbolTable.takeNextScopeOffset(locker));
>     else {
>         ASSERT(varKind == VarKind::Stack);
>         varOffset = VarOffset(virtualRegisterForLocal(m_calleeRegisters.size()));
>     }
>     SymbolTableEntry newEntry(varOffset, constantMode == IsConstant ? ReadOnly : 0);
>-    symbolTable().add(locker, property.impl(), newEntry);
>+    symbolTable.add(locker, property.impl(), newEntry);
>     
>     if (varKind == VarKind::Stack) {
>         RegisterID* local = addVar();
>@@ -1317,7 +1437,19 @@ RegisterID* BytecodeGenerator::emitResol
>         // don't do that already is that m_lexicalEnvironment is required by ConstDeclNode. ConstDeclNode
>         // requires weird things because it is a shameful pile of nonsense, but block scoping would make
>         // that code sensible and obviate the need for us to do bad things.
>-        return m_lexicalEnvironmentRegister;
>+        for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+            SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+            SymbolTableEntry entry = symbolTable.get(variable.ident().impl());
>+            if (entry.isNull())
>+                continue;
>+            
>+            RegisterID* scope = m_symbolTableStack[i].second; 
>+            RELEASE_ASSERT(scope);
>+            return scope;
>+        }
>+
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return nullptr;
>         
>     case VarKind::Invalid:
>         // Indicates non-local resolution.
>@@ -1638,6 +1770,34 @@ void BytecodeGenerator::emitTDZCheck(Reg
>     instructions().append(target->index());
> }
> 
>+void BytecodeGenerator::emitTDZCheckIfNecessary(const Variable& variable, RegisterID* target, RegisterID* scope)
>+{
>+    // FIXME: this doesn't work for lexical variables outside the current function, i.e:
>+    // ```
>+    // function foo() {
>+    //     capture();
>+    //     let baz = 20;
>+    //     function capture() { return baz; }
>+    // }
>+    // ```
>+    // doesn't throw.
>+    for (unsigned i = m_TDZStack.size(); i-- > 0;) {
>+        const IdentifierSet* identifiers = m_TDZStack[i];
>+        if (identifiers->contains(variable.ident().impl())) {
>+            if (target)
>+                emitTDZCheck(target);
>+            else {
>+                RELEASE_ASSERT(!variable.isLocal() && scope);
>+                RefPtr<RegisterID> result = newTemporary();
>+                emitGetFromScope(result.get(), scope, variable, DoNotThrowIfNotFound);
>+                emitTDZCheck(result.get());
>+            }
>+
>+            break;
>+        }
>+    }
>+}
>+
> RegisterID* BytecodeGenerator::emitNewObject(RegisterID* dst)
> {
>     size_t begin = instructions().size();
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
>@@ -307,6 +307,11 @@ namespace JSC {
> 
>         RegisterID* ignoredResult() { return &m_ignoredResultRegister; }
> 
>+        // This will be allocated in the temporary region of registers, but it
>+        // will not be marked as a temporary. This will ensure that finalDestination()
>+        // does not overwrite a lexical variable that it mistakes as a temporary.
>+        RegisterID* newLexicalVariable();
>+
>         // Returns a place to write intermediate values of an operation
>         // which reuses dst if it is safe to do so.
>         RegisterID* tempDestination(RegisterID* dst)
>@@ -447,6 +452,7 @@ namespace JSC {
> 
>         RegisterID* emitCreateThis(RegisterID* dst);
>         void emitTDZCheck(RegisterID* target);
>+        void emitTDZCheckIfNecessary(const Variable&, RegisterID* target, RegisterID* scope);
>         RegisterID* emitNewObject(RegisterID* dst);
>         RegisterID* emitNewArray(RegisterID* dst, ElementNode*, unsigned length); // stops at first elision
> 
>@@ -580,7 +586,11 @@ namespace JSC {
> 
>         OpcodeID lastOpcodeID() const { return m_lastOpcodeID; }
> 
>+        void pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+        void popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+
>     private:
>+        void reclaimUnusedRegisters();
>         Variable variableForLocalEntry(const Identifier&, const SymbolTableEntry&);
> 
>         void emitOpcode(OpcodeID);
>@@ -664,31 +674,6 @@ namespace JSC {
> 
>         SymbolTable& symbolTable() { return *m_symbolTable; }
> 
>-        bool shouldOptimizeLocals()
>-        {
>-            if (m_codeType != FunctionCode)
>-                return false;
>-
>-            if (m_localScopeDepth)
>-                return false;
>-
>-            return true;
>-        }
>-
>-        bool canOptimizeNonLocals()
>-        {
>-            if (m_localScopeDepth)
>-                return false;
>-
>-            if (m_codeType == EvalCode)
>-                return false;
>-
>-            if (m_codeType == FunctionCode && m_codeBlock->usesEval())
>-                return false;
>-
>-            return true;
>-        }
>-
>         RegisterID* emitThrowExpressionTooDeepException();
> 
>     private:
>@@ -698,6 +683,9 @@ namespace JSC {
>         bool m_shouldEmitProfileHooks;
> 
>         SymbolTable* m_symbolTable { nullptr };
>+        typedef std::pair<SymbolTable*, RegisterID*> SymbolTableStackEntry;
>+        Vector<SymbolTableStackEntry> m_symbolTableStack;
>+        Vector<const IdentifierSet*> m_TDZStack;
> 
>         ScopeNode* const m_scopeNode;
>         Strong<UnlinkedCodeBlock> m_codeBlock;
>Index: Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(revision 182114)
>+++ Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(working copy)
>@@ -194,6 +194,7 @@ RegisterID* ResolveNode::emitBytecode(By
> {
>     Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (dst == generator.ignoredResult())
>             return nullptr;
>         if (generator.vm()->typeProfiler()) {
>@@ -208,6 +209,7 @@ RegisterID* ResolveNode::emitBytecode(By
>     RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
>     RegisterID* finalDest = generator.finalDestination(dst);
>     RegisterID* result = generator.emitGetFromScope(finalDest, scope.get(), var, ThrowIfNotFound);
>+    generator.emitTDZCheckIfNecessary(var, finalDest, scope.get());
>     if (generator.vm()->typeProfiler()) {
>         generator.emitProfileType(finalDest, var.isResolved() ? ProfileTypeBytecodeGetFromLocalScope : ProfileTypeBytecodeGetFromScope, &m_ident);
>         generator.emitTypeProfilerExpressionInfo(m_position, JSTextPosition(-1, m_position.offset + m_ident.length(), -1));
>@@ -1610,6 +1612,8 @@ RegisterID* AssignResolveNode::emitBytec
>             generator.emitReadOnlyExceptionIfNeeded();
>             return generator.emitNode(dst, m_right);
>         }
>+        if (!m_isInVariableDeclaration)
>+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (var.isSpecial() || generator.vm()->typeProfiler()) {
>             RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
>             generator.emitNode(tempDst.get(), m_right);
>@@ -1627,6 +1631,8 @@ RegisterID* AssignResolveNode::emitBytec
>     if (generator.isStrictMode())
>         generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>     RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>+    if (!m_isInVariableDeclaration)
>+        generator.emitTDZCheckIfNecessary(var, nullptr, scope.get());
>     if (dst == generator.ignoredResult())
>         dst = 0;
>     RefPtr<RegisterID> result = generator.emitNode(dst, m_right);
>@@ -1829,7 +1835,9 @@ void BlockNode::emitBytecode(BytecodeGen
> {
>     if (!m_statements)
>         return;
>+    generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>     m_statements->emitBytecode(generator, dst);
>+    generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
> }
> 
> // ------------------------------ EmptyStatementNode ---------------------------
>@@ -1868,21 +1876,37 @@ void VarStatementNode::emitBytecode(Byte
> 
> RegisterID* EmptyVarExpression::emitBytecode(BytecodeGenerator& generator, RegisterID*)
> {
>+    Variable var = generator.variable(m_ident);
>+    RefPtr<RegisterID> scope;
>+    RefPtr<RegisterID> value;
>+    // Lexical declarations like 'let' must move undefined into their variables so we don't
>+    // get TDZ errors for situations like this: `let x; x;`
>+    if (m_isInLexicalDeclaration) {
>+        if (RegisterID* local = var.local())
>+            generator.emitLoad(local, jsUndefined());
>+        else {
>+            scope = generator.emitResolveScope(nullptr, var);
>+            RefPtr<RegisterID> undefined = generator.emitLoad(nullptr, jsUndefined());
>+            generator.emitPutToScope(scope.get(), var, undefined.get(), generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound);
>+        }
>+    }
>+
>+    // It's safe to return null here because this node will always be a child node of VarStatementNode which ignores our return value.
>     if (!generator.vm()->typeProfiler())
>         return nullptr;
> 
>-    Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local())
>         generator.emitProfileType(local, ProfileTypeBytecodeHasGlobalID, nullptr);
>     else {
>-        RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>-        RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
>+        if (!m_isInLexicalDeclaration) {
>+            scope = generator.emitResolveScope(nullptr, var);
>+            value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
>+        }
>         generator.emitProfileType(value.get(), var.isResolved() ? ProfileTypeBytecodeGetFromLocalScope : ProfileTypeBytecodeGetFromScope, &m_ident);
>     }
> 
>     generator.emitTypeProfilerExpressionInfo(position(), JSTextPosition(-1, position().offset + m_ident.length(), -1));
> 
>-    // It's safe to return null here because this node will always be a child node of VarStatementNode which ignores our return value.
>     return nullptr;
> }
> 
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -3375,14 +3375,15 @@ bool ByteCodeParser::parseBlock(unsigned
>             case LocalClosureVar:
>             case ClosureVar:
>             case ClosureVarWithVarInjectionChecks: {
>-                JSLexicalEnvironment* lexicalEnvironment = currentInstruction[6].u.lexicalEnvironment.get();
>-                if (lexicalEnvironment
>-                    && lexicalEnvironment->symbolTable()->m_functionEnteredOnce.isStillValid()) {
>-                    m_graph.watchpoints().addLazily(lexicalEnvironment->symbolTable()->m_functionEnteredOnce);
>-                    addToGraph(Phantom, getDirect(m_inlineStackTop->remapOperand(VirtualRegister(currentInstruction[2].u.operand))));
>-                    set(VirtualRegister(dst), weakJSConstant(lexicalEnvironment));
>-                    break;
>-                }
>+                // FIXME: rebase with trunk when https://bugs.webkit.org/show_bug.cgi?id=143232 lands.
>+                //JSLexicalEnvironment* lexicalEnvironment = currentInstruction[6].u.lexicalEnvironment.get();
>+                //if (lexicalEnvironment
>+                //    && lexicalEnvironment->symbolTable()->m_functionEnteredOnce.isStillValid()) {
>+                //    m_graph.watchpoints().addLazily(lexicalEnvironment->symbolTable()->m_functionEnteredOnce);
>+                //    addToGraph(Phantom, getDirect(m_inlineStackTop->remapOperand(VirtualRegister(currentInstruction[2].u.operand))));
>+                //    set(VirtualRegister(dst), weakJSConstant(lexicalEnvironment));
>+                //    break;
>+                //}
>                 set(VirtualRegister(dst), getScope(VirtualRegister(currentInstruction[2].u.operand), depth));
>                 if (inlineCallFrame())
>                     addToGraph(Phantom, getDirect(m_inlineStackTop->remapOperand(VirtualRegister(currentInstruction[2].u.operand))));
>@@ -3590,6 +3591,18 @@ bool ByteCodeParser::parseBlock(unsigned
>             set(VirtualRegister(currentInstruction[2].u.operand), lexicalEnvironment);
>             NEXT_OPCODE(op_create_lexical_environment);
>         }
>+
>+        case op_push_lexical_scope: {
>+            Node* lexicalEnvironment = addToGraph(CreateActivation, get(VirtualRegister(currentInstruction[2].u.operand)), get(VirtualRegister(currentInstruction[3].u.operand)));
>+            set(VirtualRegister(currentInstruction[1].u.operand), lexicalEnvironment);
>+            NEXT_OPCODE(op_push_lexical_scope);
>+        }
>+
>+        case op_pop_lexical_scope: {
>+            Node* poppedScope = addToGraph(SkipScope, get(VirtualRegister(currentInstruction[1].u.operand)));
>+            set(VirtualRegister(currentInstruction[1].u.operand), poppedScope);
>+            NEXT_OPCODE(op_pop_lexical_scope);
>+        }
>             
>         case op_get_scope: {
>             // Help the later stages a bit by doing some small constant folding here. Note that this
>Index: Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(working copy)
>@@ -208,6 +208,8 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_new_func:
>     case op_new_func_exp:
>     case op_create_lexical_environment:
>+    case op_push_lexical_scope:
>+    case op_pop_lexical_scope:
>         return CanCompileAndInline;
> 
>     case op_put_to_scope: {
>Index: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(working copy)
>@@ -1179,11 +1179,16 @@ private:
>         }
> 
>         case CreateScopedArguments:
>-        case CreateActivation:
>         case NewFunction: {
>             fixEdge<CellUse>(node->child1());
>             break;
>         }
>+        case CreateActivation: {
>+            fixEdge<CellUse>(node->child1());
>+            if (node->child2())
>+                fixEdge<KnownCellUse>(node->child2());
>+            break;
>+        }
>             
> #if !ASSERT_DISABLED
>         // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 182114)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -4443,7 +4443,11 @@ void SpeculativeJIT::compileCreateActiva
>     GPRReg scratch1GPR = scratch1.gpr();
>     GPRReg scratch2GPR = scratch2.gpr();
>         
>-    SymbolTable* table = m_jit.graph().symbolTableFor(node->origin.semantic);
>+    SymbolTable* table = nullptr;
>+    if (node->child2())
>+        table = node->child2()->castConstant<SymbolTable*>();
>+    else
>+        table = m_jit.graph().symbolTableFor(node->origin.semantic);
>     Structure* structure = m_jit.graph().globalObjectFor(
>         node->origin.semantic)->activationStructure();
>         
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -266,6 +266,8 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_profile_control_flow)
>         DEFINE_OP(op_push_name_scope)
>         DEFINE_OP(op_push_with_scope)
>+        DEFINE_OP(op_push_lexical_scope)
>+        DEFINE_OP(op_pop_lexical_scope)
>         case op_put_by_id_out_of_line:
>         case op_put_by_id_transition_direct:
>         case op_put_by_id_transition_normal:
>Index: Source/JavaScriptCore/jit/JIT.h
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JIT.h	(working copy)
>@@ -535,6 +535,8 @@ namespace JSC {
>         void emit_op_profile_control_flow(Instruction*);
>         void emit_op_push_name_scope(Instruction*);
>         void emit_op_push_with_scope(Instruction*);
>+        void emit_op_push_lexical_scope(Instruction*);
>+        void emit_op_pop_lexical_scope(Instruction*);
>         void emit_op_put_by_id(Instruction*);
>         void emit_op_put_by_index(Instruction*);
>         void emit_op_put_by_val(Instruction*);
>@@ -716,6 +718,7 @@ namespace JSC {
>         MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EPc, int, Instruction*);
>         MacroAssembler::Call callOperation(J_JITOperation_EZ, int, int32_t);
>         MacroAssembler::Call callOperation(J_JITOperation_EZZ, int, int32_t, int32_t);
>+        MacroAssembler::Call callOperation(J_JITOperation_ESymtabZ, int, SymbolTable*, int32_t);
>         MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, size_t);
>         MacroAssembler::Call callOperation(S_JITOperation_ECC, RegisterID, RegisterID);
>         MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID);
>Index: Source/JavaScriptCore/jit/JITInlines.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlines.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITInlines.h	(working copy)
>@@ -295,6 +295,12 @@ ALWAYS_INLINE MacroAssembler::Call JIT::
>     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
> }
> 
>+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESymtabZ operation, int dst, SymbolTable* symbolTable, int32_t arg2)
>+{
>+    setupArgumentsWithExecState(TrustedImmPtr(symbolTable), TrustedImm32(arg2));
>+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
>+}
>+
> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_ECC operation, RegisterID regOp1, RegisterID regOp2)
> {
>     setupArgumentsWithExecState(regOp1, regOp2);
>Index: Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(working copy)
>@@ -815,6 +815,21 @@ void JIT::emit_op_catch(Instruction* cur
>     emitStore(exception, regT1, regT0);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand;
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+}
>+
>+void JIT::emit_op_pop_lexical_scope(Instruction* currentInstruction)
>+{
>+    int scopeSrcAndDst = currentInstruction[1].u.operand;
>+    emitLoadPayload(scopeSrcAndDst, regT0);
>+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
>+    emitStoreCell(scopeSrcAndDst, regT0);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOpcodes.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOpcodes.cpp	(working copy)
>@@ -520,6 +520,22 @@ void JIT::emit_op_catch(Instruction* cur
>     emitPutVirtualRegister(currentInstruction[1].u.operand);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand; 
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+    return;
>+}
>+
>+void JIT::emit_op_pop_lexical_scope(Instruction* currentInstruction)
>+{
>+    int scopeSrcAndDst = currentInstruction[1].u.operand;
>+    emitGetVirtualRegister(scopeSrcAndDst, regT0);
>+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
>+    emitStoreCell(scopeSrcAndDst, regT0);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -1306,6 +1306,17 @@ void JIT_OPERATION operationPushWithScop
>     exec->uncheckedR(dst) = JSWithScope::create(exec, o, currentScope);
> }
> 
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState* exec, SymbolTable* symbolTable, int32_t scopeReg)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+
>+    return JSValue::encode(newScope);
>+}
>+
> void JIT_OPERATION operationPopScope(ExecState* exec, int32_t scopeReg)
> {
>     VM& vm = exec->vm();
>Index: Source/JavaScriptCore/jit/JITOperations.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.h	(revision 182114)
>+++ Source/JavaScriptCore/jit/JITOperations.h	(working copy)
>@@ -122,6 +122,7 @@ typedef EncodedJSValue JIT_OPERATION (*J
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZ)(ExecState*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZIcfZ)(ExecState*, int32_t, InlineCallFrame*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZZ)(ExecState*, int32_t, int32_t);
>+typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_ESymtabZ)(ExecState*, SymbolTable*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_E)(ExecState*);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EZ)(ExecState*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EC)(ExecState*, JSCell*);
>@@ -296,6 +297,7 @@ void JIT_OPERATION operationPutGetterSet
> void JIT_OPERATION operationPushCatchScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushFunctionNameScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushWithScope(ExecState*, int32_t, EncodedJSValue) WTF_INTERNAL;
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState*, SymbolTable*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationPopScope(ExecState*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationProfileDidCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationProfileWillCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 182114)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -1272,6 +1272,25 @@ LLINT_SLOW_PATH_DECL(slow_path_push_name
>     LLINT_END();
> }
> 
>+LLINT_SLOW_PATH_DECL(slow_path_push_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[2].u.operand;
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    SymbolTable* symbolTable = jsCast<SymbolTable*>(LLINT_OP_C(3).jsValue());
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+    LLINT_RETURN(newScope);
>+}
>+
>+LLINT_SLOW_PATH_DECL(slow_path_pop_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[1].u.operand;
>+    JSScope* scope = exec->uncheckedR(scopeReg).Register::scope();
>+    exec->uncheckedR(scopeReg) = scope->next();
>+    LLINT_END();
>+}
>+
> LLINT_SLOW_PATH_DECL(slow_path_throw)
> {
>     LLINT_BEGIN();
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.h	(revision 182114)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.h	(working copy)
>@@ -108,6 +108,8 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_name_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_lexical_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_lexical_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_handle_watchdog_timer);
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(revision 182114)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(working copy)
>@@ -787,8 +787,9 @@ _llint_op_new_object:
> 
> _llint_op_check_tdz:
>     traceExecution()
>-    loadpFromInstruction(1, t0)
>-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opNotTDZ
>+    loadisFromInstruction(1, t0)
>+    loadConstantOrVariableTag(t0, t1)
>+    bineq TagOffset[cfr, t1, 8], EmptyValueTag, .opNotTDZ
>     callSlowPath(_slow_path_throw_tdz_error)
> 
> .opNotTDZ:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 182114)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -672,9 +672,9 @@ _llint_op_new_object:
> 
> _llint_op_check_tdz:
>     traceExecution()
>-    loadpFromInstruction(1, t0)
>-    loadq [cfr, t0, 8], t0
>-    bqneq t0, ValueEmpty, .opNotTDZ
>+    loadisFromInstruction(1, t0)
>+    loadConstantOrVariable(t0, t1)
>+    bqneq t1, ValueEmpty, .opNotTDZ
>     callSlowPath(_slow_path_throw_tdz_error)
> 
> .opNotTDZ:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 182114)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -1287,6 +1287,18 @@ _llint_op_push_name_scope:
>     dispatch(5)
> 
> 
>+_llint_op_push_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_push_lexical_scope)
>+    dispatch(4)
>+
>+
>+_llint_op_pop_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_pop_lexical_scope)
>+    dispatch(2)
>+
>+
> _llint_op_throw:
>     traceExecution()
>     callSlowPath(_llint_slow_path_throw)
>Index: Source/JavaScriptCore/parser/ASTBuilder.h
>===================================================================
>--- Source/JavaScriptCore/parser/ASTBuilder.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/ASTBuilder.h	(working copy)
>@@ -276,11 +276,11 @@ public:
>         return new (m_parserArena) ConditionalNode(location, condition, lhs, rhs);
>     }
> 
>-    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
>+    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end, bool isInVariableDeclaration)
>     {
>         if (rhs->isFuncExprNode())
>             static_cast<FuncExprNode*>(rhs)->body()->setInferredName(ident);
>-        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs);
>+        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs, isInVariableDeclaration);
>         setExceptionLocation(node, start, divot, end);
>         return node;
>     }
>@@ -379,16 +379,16 @@ public:
>         const JSTextPosition& classStart, const JSTextPosition& classEnd, unsigned startLine, unsigned endLine)
>     {
>         // FIXME: Use "let" declaration.
>-        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd);
>+        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd, false);
>         ClassDeclNode* decl = new (m_parserArena) ClassDeclNode(location, assign);
>         decl->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return decl;
>     }
> #endif
> 
>-    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine)
>+    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine, IdentifierSet& lexicalVariables, IdentifierSet& lexicallyCapturedVariables)
>     {
>-        BlockNode* block = new (m_parserArena) BlockNode(location, elements);
>+        BlockNode* block = new (m_parserArena) BlockNode(location, elements, lexicalVariables, lexicallyCapturedVariables);
>         block->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return block;
>     }
>@@ -457,9 +457,15 @@ public:
>         return result;
>     }
> 
>-    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier)
>+    StatementNode* createLetStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
>     {
>-        return new (m_parserArena) EmptyVarExpression(location, identifier);
>+        // FIXME: better name for 'VarStatementNode'.
>+        return createVarStatement(location, expr, start, end);
>+    }
>+
>+    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier, bool isLexicalDeclaration)
>+    {
>+        return new (m_parserArena) EmptyVarExpression(location, identifier, isLexicalDeclaration);
>     }
> 
>     StatementNode* createReturnStatement(const JSTokenLocation& location, ExpressionNode* expression, const JSTextPosition& start, const JSTextPosition& end)
>@@ -1091,7 +1097,7 @@ ExpressionNode* ASTBuilder::makeAssignNo
>         if (op == OpEqual) {
>             if (expr->isFuncExprNode())
>                 static_cast<FuncExprNode*>(expr)->body()->setInferredName(resolve->identifier());
>-            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr);
>+            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr, false);
>             setExceptionLocation(node, start, divot, end);
>             return node;
>         }
>Index: Source/JavaScriptCore/parser/Keywords.table
>===================================================================
>--- Source/JavaScriptCore/parser/Keywords.table	(revision 182114)
>+++ Source/JavaScriptCore/parser/Keywords.table	(working copy)
>@@ -2,56 +2,56 @@
> @begin mainTable 47
> 
> # Types.
>-null		NULLTOKEN
>-true		TRUETOKEN
>-false		FALSETOKEN
>+null         NULLTOKEN
>+true         TRUETOKEN
>+false        FALSETOKEN
> 
> # Keywords.
>-break		BREAK
>-case		CASE
>-catch		CATCH
>-class		CLASSTOKEN
>-const		CONSTTOKEN
>-default		DEFAULT
>-extends	EXTENDS
>-finally		FINALLY
>-for		FOR
>-instanceof	INSTANCEOF
>-new		NEW
>-var		VAR
>-continue	CONTINUE
>-function	FUNCTION
>-return		RETURN
>-void		VOIDTOKEN
>-delete		DELETETOKEN
>-if		IF
>-this		THISTOKEN
>-do		DO
>-while		WHILE
>-else		ELSE
>-in		INTOKEN
>-super		SUPER
>-switch		SWITCH
>-throw		THROW
>-try		TRY
>-typeof		TYPEOF
>-with		WITH
>-debugger	DEBUGGER
>+break        BREAK
>+case         CASE
>+catch        CATCH
>+class        CLASSTOKEN
>+const        CONSTTOKEN
>+default      DEFAULT
>+extends      EXTENDS
>+finally      FINALLY
>+for          FOR
>+instanceof   INSTANCEOF
>+new          NEW
>+var          VAR
>+let          LET
>+continue     CONTINUE
>+function     FUNCTION
>+return       RETURN
>+void         VOIDTOKEN
>+delete       DELETETOKEN
>+if           IF
>+this         THISTOKEN
>+do           DO
>+while        WHILE
>+else         ELSE
>+in           INTOKEN
>+super        SUPER
>+switch       SWITCH
>+throw        THROW
>+try          TRY
>+typeof       TYPEOF
>+with         WITH
>+debugger     DEBUGGER
> 
> # Reserved for future use.
>-enum            RESERVED
>-export          RESERVED
>-import          RESERVED
>+enum         RESERVED
>+export       RESERVED
>+import       RESERVED
> 
> # Reserved for future use in strict code.
>-implements      RESERVED_IF_STRICT
>-interface       RESERVED_IF_STRICT
>-let             RESERVED_IF_STRICT
>-package         RESERVED_IF_STRICT
>-private         RESERVED_IF_STRICT
>-protected       RESERVED_IF_STRICT
>-public          RESERVED_IF_STRICT
>-static          RESERVED_IF_STRICT
>-yield           RESERVED_IF_STRICT
>+implements   RESERVED_IF_STRICT
>+interface    RESERVED_IF_STRICT
>+package      RESERVED_IF_STRICT
>+private      RESERVED_IF_STRICT
>+protected    RESERVED_IF_STRICT
>+public       RESERVED_IF_STRICT
>+static       RESERVED_IF_STRICT
>+yield        RESERVED_IF_STRICT
> 
> @end
>Index: Source/JavaScriptCore/parser/NodeConstructors.h
>===================================================================
>--- Source/JavaScriptCore/parser/NodeConstructors.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/NodeConstructors.h	(working copy)
>@@ -571,10 +571,11 @@ namespace JSC {
>     {
>     }
> 
>-    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right)
>+    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right, bool isInVariableDeclaration)
>         : ExpressionNode(location)
>         , m_ident(ident)
>         , m_right(right)
>+        , m_isInVariableDeclaration(isInVariableDeclaration)
>     {
>     }
> 
>@@ -670,9 +671,10 @@ namespace JSC {
>     {
>     }
> 
>-    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident)
>+    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident, bool isInLexicalDeclaration)
>         : ExpressionNode(location)
>         , m_ident(ident)
>+        , m_isInLexicalDeclaration(isInLexicalDeclaration)
>     {
>     }
>     
>@@ -846,8 +848,9 @@ namespace JSC {
>     {
>     }
> 
>-    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements)
>+    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements, IdentifierSet& lexicalVariables, IdentifierSet& lexicallyCapturedVariables)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicallyCapturedVariables)
>         , m_statements(statements)
>     {
>     }
>Index: Source/JavaScriptCore/parser/Nodes.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.cpp	(revision 182114)
>+++ Source/JavaScriptCore/parser/Nodes.cpp	(working copy)
>@@ -94,9 +94,10 @@ ScopeNode::ScopeNode(ParserArena& parser
> {
> }
> 
>-ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, CodeFeatures features, int numConstants)
>+ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, CodeFeatures features, int numConstants)
>     : StatementNode(endLocation)
>     , ParserArenaRoot(parserArena)
>+    , LexicalNode(lexicalVariables, lexicalCaptures)
>     , m_startLineNumber(startLocation.line)
>     , m_startStartOffset(startLocation.startOffset)
>     , m_startLineStartOffset(startLocation.lineStartOffset)
>@@ -117,8 +118,8 @@ StatementNode* ScopeNode::singleStatemen
> 
> // ------------------------------ ProgramNode -----------------------------
> 
>-ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>@@ -131,8 +132,8 @@ void ProgramNode::setClosedVariables(Vec
> 
> // ------------------------------ EvalNode -----------------------------
> 
>-EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_endColumn(endColumn)
> {
> }
>@@ -201,8 +202,8 @@ void FunctionBodyNode::setEndPosition(JS
> 
> // ------------------------------ FunctionNode -----------------------------
> 
>-FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, features, numConstants)
>+FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>Index: Source/JavaScriptCore/parser/Nodes.h
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/Nodes.h	(working copy)
>@@ -202,6 +202,26 @@ namespace JSC {
>         int m_lastLine;
>     };
> 
>+    class LexicalNode {
>+    public:
>+        LexicalNode()
>+        {
>+        }
>+
>+        LexicalNode(IdentifierSet& lexicalDeclaredVariables, IdentifierSet& capturedVariables)
>+        {
>+            m_lexicalVariables.swap(lexicalDeclaredVariables);
>+            m_lexicalCaptures.swap(capturedVariables);
>+        }
>+
>+        const IdentifierSet& lexicalVariables() { return m_lexicalVariables; }
>+        const IdentifierSet& lexicalCaptures() { return m_lexicalCaptures; }
>+
>+    protected:
>+        IdentifierSet m_lexicalVariables;
>+        IdentifierSet m_lexicalCaptures;
>+    };
>+
>     class ConstantNode : public ExpressionNode {
>     public:
>         ConstantNode(const JSTokenLocation&, ResultType);
>@@ -1056,13 +1076,14 @@ namespace JSC {
> 
>     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
>     public:
>-        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right);
>+        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right, bool isInVariableDeclaration);
> 
>     private:
>         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         const Identifier& m_ident;
>         ExpressionNode* m_right;
>+        bool m_isInVariableDeclaration;
>     };
> 
>     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
>@@ -1190,9 +1211,9 @@ namespace JSC {
>         StatementNode* m_tail;
>     };
> 
>-    class BlockNode : public StatementNode {
>+    class BlockNode : public StatementNode, public LexicalNode {
>     public:
>-        BlockNode(const JSTokenLocation&, SourceElements* = 0);
>+        BlockNode(const JSTokenLocation&, SourceElements*, IdentifierSet&, IdentifierSet&);
> 
>         StatementNode* singleStatement() const;
>         StatementNode* lastStatement() const;
>@@ -1248,12 +1269,13 @@ namespace JSC {
> 
>     class EmptyVarExpression : public ExpressionNode {
>     public:
>-        EmptyVarExpression(const JSTokenLocation&, const Identifier&);
>+        EmptyVarExpression(const JSTokenLocation&, const Identifier&, bool isInLexicalDeclaration);
> 
>     private:
>         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         const Identifier& m_ident;
>+        bool m_isInLexicalDeclaration;
>     };
> 
> 
>@@ -1436,13 +1458,13 @@ namespace JSC {
>         ParameterNode* m_next;
>     };
> 
>-    class ScopeNode : public StatementNode, public ParserArenaRoot {
>+    class ScopeNode : public StatementNode, public ParserArenaRoot, public LexicalNode {
>     public:
>         typedef DeclarationStacks::VarStack VarStack;
>         typedef DeclarationStacks::FunctionStack FunctionStack;
> 
>         ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, bool inStrictContext);
>-        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, CodeFeatures, int numConstants);
>+        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, CodeFeatures, int numConstants);
> 
>         using ParserArenaRoot::operator new;
> 
>@@ -1505,7 +1527,7 @@ namespace JSC {
> 
>     class ProgramNode : public ScopeNode {
>     public:
>-        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         unsigned startColumn() const { return m_startColumn; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1524,7 +1546,7 @@ namespace JSC {
> 
>     class EvalNode : public ScopeNode {
>     public:
>-        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         ALWAYS_INLINE unsigned startColumn() const { return 0; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1611,7 +1633,7 @@ namespace JSC {
> 
>     class FunctionNode final : public ScopeNode {
>     public:
>-        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         FunctionParameters* parameters() const { return m_parameters.get(); }
> 
>Index: Source/JavaScriptCore/parser/Parser.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.cpp	(revision 182114)
>+++ Source/JavaScriptCore/parser/Parser.cpp	(working copy)
>@@ -263,6 +263,9 @@ String Parser<LexerType>::parseInner()
>     if (m_lexer->isReparsing())
>         m_statementDepth--;
>     ScopeRef scope = currentScope();
>+    if (!scope->isFunction())
>+        scope->setIsLexicalScope();
>+
>     SourceElements* sourceElements = parseSourceElements(context, CheckForStrictMode);
>     if (!sourceElements || !consume(EOFTOK)) {
>         if (hasError())
>@@ -373,9 +376,9 @@ template <class TreeBuilder> TreeSourceE
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVarDeclaration(TreeBuilder& context)
>+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVariableDeclaration(TreeBuilder& context, DeclarationType type)
> {
>-    ASSERT(match(VAR));
>+    ASSERT(match(VAR) || match(LET));
>     JSTokenLocation location(tokenLocation());
>     int start = tokenLine();
>     int end = 0;
>@@ -383,11 +386,14 @@ template <class TreeBuilder> TreeStateme
>     TreeDeconstructionPattern scratch1 = 0;
>     TreeExpression scratch2 = 0;
>     JSTextPosition scratch3;
>-    TreeExpression varDecls = parseVarDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext);
>+    TreeExpression decls = parseVariableDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext, type);
>     propagateError();
>     failIfFalse(autoSemiColon(), "Expected ';' after var declaration");
>     
>-    return context.createVarStatement(location, varDecls, start, end);
>+    if (type == VarDeclaration)
>+        return context.createVarStatement(location, decls, start, end);
>+    else 
>+        return context.createLetStatement(location, decls, start, end);
> }
> 
> template <typename LexerType>
>@@ -452,7 +458,7 @@ template <class TreeBuilder> TreeStateme
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext)
>+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVariableDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext, DeclarationType declarationType)
> {
>     TreeExpression head = 0;
>     TreeExpression tail = 0;
>@@ -475,7 +481,7 @@ template <class TreeBuilder> TreeExpress
>             lastIdentToken = m_token;
>             next();
>             hasInitializer = match(EQUAL);
>-            failIfFalseIfStrict(declareVariable(name), "Cannot declare a variable named ", name->impl(), " in strict mode");
>+            failIfFalseIfStrict(declareVariable(name, declarationType), "Cannot declare a variable named ", name->impl(), " in strict mode");
>             context.addVar(name, (hasInitializer || (!m_allowsIn && (match(INTOKEN) || isofToken()))) ? DeclarationStacks::HasInitializer : 0);
>             if (hasInitializer) {
>                 JSTextPosition varDivot = tokenStartPosition() + 1;
>@@ -486,12 +492,12 @@ template <class TreeBuilder> TreeExpress
>                 lastInitializer = initializer;
>                 failIfFalse(initializer, "Expected expression as the intializer for the variable '", name->impl(), "'");
>                 
>-                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition());
>+                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition(), true);
>             } else
>-                node = context.createEmptyVarExpression(varStartLocation, *name);
>+                node = context.createEmptyVarExpression(varStartLocation, *name, declarationType == LetDeclaration);
>         } else {
>             lastIdent = 0;
>-            auto pattern = parseDeconstructionPattern(context, DeconstructToVariables);
>+            auto pattern = parseDeconstructionPattern(context, declarationType == VarDeclaration ? DeconstructToVariables : DeconstructToLexicalVariables);
>             failIfFalse(pattern, "Cannot parse this deconstruction pattern");
>             hasInitializer = match(EQUAL);
>             failIfTrue(declarationListContext == VarDeclarationContext && !hasInitializer, "Expected an initializer in destructuring variable declaration");
>@@ -512,8 +518,10 @@ template <class TreeBuilder> TreeExpress
>         } else
>             tail = context.appendToCommaExpr(location, head, tail, node);
>     } while (match(COMMA));
>+    // FIXME: consider that this causes the last variable in each declaration list to be declared twice.
>     if (lastIdent)
>-        lastPattern = createBindingPattern(context, DeconstructToVariables, *lastIdent, 0, lastIdentToken);
>+        lastPattern = createBindingPattern(context, declarationType == VarDeclaration ? DeconstructToVariables : DeconstructToLexicalVariables, *lastIdent, 0, lastIdentToken);
>+
>     return head;
> }
> 
>@@ -527,7 +535,9 @@ template <class TreeBuilder> TreeDeconst
>     if (depth) {
>         if (kind == DeconstructToVariables)
>             failIfFalseIfStrict(declareVariable(&name), "Cannot deconstruct to a variable named '", name.impl(), "' in strict mode");
>-        if (kind == DeconstructToParameters) {
>+        else if (kind == DeconstructToLexicalVariables)
>+            failIfFalseIfStrict(declareVariable(&name, LetDeclaration), "Cannot deconstruct to a variable named '", name.impl(), "' in strict mode");
>+        else if (kind == DeconstructToParameters) {
>             auto bindingResult = declareBoundParameter(&name);
>             if (bindingResult == Scope::StrictBindingFailed && strictMode()) {
>                 semanticFailIfTrue(m_vm->propertyNames->arguments == name || m_vm->propertyNames->eval == name, "Cannot deconstruct to a parameter name '", name.impl(), "' in strict mode");
>@@ -545,16 +555,16 @@ template <class TreeBuilder> TreeDeconst
>                 semanticFail("Cannot deconstruct to a parameter named '", name.impl(), "'");
>             }
>         }
>-        if (kind != DeconstructToExpressions)
>+        if (kind != DeconstructToExpressions && kind != DeconstructToLexicalVariables)
>             context.addVar(&name, DeclarationStacks::HasInitializer);
> 
>     } else {
>         if (kind == DeconstructToVariables) {
>             failIfFalseIfStrict(declareVariable(&name), "Cannot declare a variable named '", name.impl(), "' in strict mode");
>             context.addVar(&name, DeclarationStacks::HasInitializer);
>-        }
>-        
>-        if (kind == DeconstructToParameters) {
>+        } else if (kind == DeconstructToLexicalVariables)
>+            failIfFalseIfStrict(declareVariable(&name, LetDeclaration), "Cannot declare a variable named '", name.impl(), "' in strict mode");
>+        else if (kind == DeconstructToParameters) {
>             bool declarationResult = declareParameter(&name);
>             if (!declarationResult && strictMode()) {
>                 semanticFailIfTrue(m_vm->propertyNames->arguments == name || m_vm->propertyNames->eval == name, "Cannot deconstruct to a parameter name '", name.impl(), "' in strict mode");
>@@ -734,7 +744,7 @@ template <class TreeBuilder> TreeStateme
>     JSTextPosition declsEnd;
>     TreeExpression decls = 0;
>     TreeDeconstructionPattern pattern = 0;
>-    if (match(VAR)) {
>+    if (match(VAR)) { // FIXME: handle LET
>         /*
>          for (var IDENT in expression) statement
>          for (var varDeclarationList; expressionOpt; expressionOpt)
>@@ -744,7 +754,7 @@ template <class TreeBuilder> TreeStateme
>         m_allowsIn = false;
>         JSTextPosition initStart;
>         JSTextPosition initEnd;
>-        decls = parseVarDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext);
>+        decls = parseVariableDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext, VarDeclaration);
>         m_allowsIn = true;
>         propagateError();
> 
>@@ -1084,7 +1094,7 @@ template <class TreeBuilder> TreeStateme
>         next();
>         AutoPopScopeRef catchScope(this, pushScope());
>         failIfFalseIfStrict(declareVariable(ident), "Cannot declare a catch variable named '", ident->impl(), "' in strict mode");
>-        catchScope->preventNewDecls();
>+        catchScope->preventAllVariableDeclarations();
>         handleProductionOrFail(CLOSEPAREN, ")", "end", "'catch' target");
>         matchOrFail(OPENBRACE, "Expected exception handler to be a block statement");
>         catchBlock = parseBlockStatement(context);
>@@ -1120,16 +1130,31 @@ template <typename LexerType>
> template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBlockStatement(TreeBuilder& context)
> {
>     ASSERT(match(OPENBRACE));
>+
>+    // This is hacky, but we should treat the first block statement of the function (the body of the function)
>+    // as the lexical scope of the function itself, and not the lexical scope of a 'block' statement within
>+    // a function.
>+    bool shouldPushLexicalScope = m_statementDepth > 0;
>+    if (shouldPushLexicalScope) {
>+        ScopeRef blockScope = pushScope();
>+        blockScope->setIsLexicalScope();
>+        blockScope->preventVarDeclarations();
>+    }
>     JSTokenLocation location(tokenLocation());
>     int startOffset = m_token.m_data.offset;
>     int start = tokenLine();
>+    IdentifierSet dummyIdentifierSet;
>     next();
>     if (match(CLOSEBRACE)) {
>         int endOffset = m_token.m_data.offset;
>         next();
>-        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line);
>+        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->lexicallyDeclaredVariables() : dummyIdentifierSet, shouldPushLexicalScope ? currentScope()->lexicallyCapturedVariables() : dummyIdentifierSet);
>         context.setStartOffset(result, startOffset);
>         context.setEndOffset(result, endOffset);
>+        if (shouldPushLexicalScope) {
>+            ScopeRef blockScope = currentScope();
>+            failIfFalse(popScope(blockScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>+        }
>         return result;
>     }
>     TreeSourceElements subtree = parseSourceElements(context, DontCheckForStrictMode);
>@@ -1137,9 +1162,14 @@ template <class TreeBuilder> TreeStateme
>     matchOrFail(CLOSEBRACE, "Expected a closing '}' at the end of a block statement");
>     int endOffset = m_token.m_data.offset;
>     next();
>-    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line);
>+    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->lexicallyDeclaredVariables() : dummyIdentifierSet, shouldPushLexicalScope ? currentScope()->lexicallyCapturedVariables() : dummyIdentifierSet);
>     context.setStartOffset(result, startOffset);
>     context.setEndOffset(result, endOffset);
>+    if (shouldPushLexicalScope) {
>+        ScopeRef blockScope = currentScope();
>+        failIfFalse(popScope(blockScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>+    }
>+
>     return result;
> }
> 
>@@ -1159,7 +1189,7 @@ template <class TreeBuilder> TreeStateme
>         shouldSetEndOffset = false;
>         break;
>     case VAR:
>-        result = parseVarDeclaration(context);
>+        result = parseVariableDeclaration(context, VarDeclaration);
>         break;
>     case CONSTTOKEN:
>         result = parseConstDeclaration(context);
>@@ -1222,6 +1252,13 @@ template <class TreeBuilder> TreeStateme
>     case DEFAULT:
>         // These tokens imply the end of a set of source elements
>         return 0;
>+    case LET:
>+        // FIXME: make sure that sloppy mode has 'let' parse as IDENT and not default.
>+        if (strictMode()) {
>+            result = parseVariableDeclaration(context, LetDeclaration);
>+            break;
>+        }
>+        FALLTHROUGH;
>     case IDENT:
>         result = parseExpressionOrLabelStatement(context);
>         break;
>@@ -1397,6 +1434,7 @@ template <class TreeBuilder> bool Parser
>         info.bodyEndLine = m_lastTokenEndPosition.line;
>         return true;
>     }
>+
>     m_lastFunctionName = lastFunctionName;
>     ParserState oldState = saveState();
>     info.body = parseFunctionBody(context, functionKeywordStart, functionNameStart, parametersStart, constructorKind);
>@@ -1650,6 +1688,7 @@ template <class TreeBuilder> TreeStateme
>         break;
>     }
>     const Identifier* unused = 0;
>+    ScopeRef labelScope = currentScope();
>     if (!m_syntaxAlreadyValidated) {
>         for (size_t i = 0; i < labels.size(); i++)
>             pushLabel(labels[i].m_ident, isLoop);
>@@ -1657,7 +1696,7 @@ template <class TreeBuilder> TreeStateme
>     TreeStatement statement = parseStatement(context, unused);
>     if (!m_syntaxAlreadyValidated) {
>         for (size_t i = 0; i < labels.size(); i++)
>-            popLabel();
>+            popLabel(labelScope);
>     }
>     failIfFalse(statement, "Cannot parse statement");
>     for (size_t i = 0; i < labels.size(); i++) {
>@@ -2296,6 +2335,7 @@ template <class TreeBuilder> TreeExpress
>         return context.thisExpr(location);
>     }
>     case IDENT: {
>+    identifierExpression:
>         JSTextPosition start = tokenStartPosition();
>         const Identifier* ident = m_token.m_data.ident;
>         JSTokenLocation location(tokenLocation());
>@@ -2357,6 +2397,11 @@ template <class TreeBuilder> TreeExpress
>         }
>         return re;
>     }
>+    case LET: {
>+        if (!strictMode())
>+            goto identifierExpression;
>+        FALLTHROUGH;
>+    }
>     default:
>         failDueToUnexpectedToken();
>     }
>Index: Source/JavaScriptCore/parser/Parser.h
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/Parser.h	(working copy)
>@@ -89,6 +89,7 @@ enum FunctionParseMode {
> };
> enum DeconstructionKind {
>     DeconstructToVariables,
>+    DeconstructToLexicalVariables,
>     DeconstructToParameters,
>     DeconstructToExpressions
> };
>@@ -115,9 +116,11 @@ struct Scope {
>         , m_needsFullActivation(false)
>         , m_hasDirectSuper(false)
>         , m_needsSuperBinding(false)
>-        , m_allowsNewDecls(true)
>+        , m_allowsVarDecls(true)
>+        , m_allowsLetDecls(true)
>         , m_strictMode(strictMode)
>         , m_isFunction(isFunction)
>+        , m_isLexicalScope(false)
>         , m_isFunctionBoundary(false)
>         , m_isValidStrictMode(true)
>         , m_loopDepth(0)
>@@ -132,9 +135,11 @@ struct Scope {
>         , m_needsFullActivation(rhs.m_needsFullActivation)
>         , m_hasDirectSuper(rhs.m_hasDirectSuper)
>         , m_needsSuperBinding(rhs.m_needsSuperBinding)
>-        , m_allowsNewDecls(rhs.m_allowsNewDecls)
>+        , m_allowsVarDecls(rhs.m_allowsVarDecls)
>+        , m_allowsLetDecls(rhs.m_allowsLetDecls)
>         , m_strictMode(rhs.m_strictMode)
>         , m_isFunction(rhs.m_isFunction)
>+        , m_isLexicalScope(rhs.m_isLexicalScope)
>         , m_isFunctionBoundary(rhs.m_isFunctionBoundary)
>         , m_isValidStrictMode(rhs.m_isValidStrictMode)
>         , m_loopDepth(rhs.m_loopDepth)
>@@ -187,9 +192,37 @@ struct Scope {
>     {
>         m_isFunction = true;
>         m_isFunctionBoundary = true;
>+        setIsLexicalScope();
>+    }
>+    bool isFunction() const { return m_isFunction; }
>+    bool isFunctionBoundary() const { return m_isFunctionBoundary; }
>+
>+    void setIsLexicalScope() { m_isLexicalScope = true; }
>+    IdentifierSet& lexicallyDeclaredVariables() { return m_lexicallyDeclaredVariables; }
>+    IdentifierSet& lexicallyCapturedVariables()
>+    {
>+        if (m_usesEval) {
>+            m_lexicalCaptures = m_lexicallyDeclaredVariables;
>+            return m_lexicalCaptures; 
>+        }
>+
>+        IdentifierSet::iterator end = m_lexicallyDeclaredVariables.end();
>+        for (IdentifierSet::iterator ptr = m_lexicallyDeclaredVariables.begin(); ptr != end; ++ptr) {
>+            if (m_closedVariables.contains(*ptr))
>+                m_lexicalCaptures.add(*ptr);
>+        }
>+
>+        return m_lexicalCaptures;
>+    }
>+
>+    void dumpLexicalVariables()
>+    {
>+        IdentifierSet lexicalCaptures = lexicallyCapturedVariables();
>+        IdentifierSet::iterator end = m_lexicallyDeclaredVariables.end();
>+        for (IdentifierSet::iterator ptr = m_lexicallyDeclaredVariables.begin(); ptr != end; ++ptr) {
>+            printf("lexical variable: '%s' is captured: %d\n", String(*ptr).ascii().data(), lexicalCaptures.contains(*ptr));
>+        }
>     }
>-    bool isFunction() { return m_isFunction; }
>-    bool isFunctionBoundary() { return m_isFunctionBoundary; }
> 
>     void declareCallee(const Identifier* ident)
>     {
>@@ -204,6 +237,14 @@ struct Scope {
>         return isValidStrictMode;
>     }
> 
>+    bool declareLexicalVariable(const Identifier* ident)
>+    {
>+        bool isValidStrictMode = m_vm->propertyNames->eval != *ident && m_vm->propertyNames->arguments != *ident;
>+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
>+        m_lexicallyDeclaredVariables.add(ident->string().impl());
>+        return isValidStrictMode;
>+    }
>+
>     bool hasDeclaredVariable(const Identifier& ident)
>     {
>         return m_declaredVariables.contains(ident.impl());
>@@ -220,8 +261,14 @@ struct Scope {
>         m_writtenVariables.add(ident->impl());
>     }
> 
>-    void preventNewDecls() { m_allowsNewDecls = false; }
>-    bool allowsNewDecls() const { return m_allowsNewDecls; }
>+    void preventAllVariableDeclarations()
>+    {
>+        m_allowsVarDecls = false; 
>+        m_allowsLetDecls = false;
>+    }
>+    void preventVarDeclarations() { m_allowsVarDecls = false; }
>+    bool allowsNewDecls() const { return m_allowsVarDecls; }
>+    bool allowsLexicalDeclarations() const { return m_allowsLetDecls; }
> 
>     bool declareParameter(const Identifier* ident)
>     {
>@@ -266,6 +313,7 @@ struct Scope {
>     }
> 
>     void setNeedsFullActivation() { m_needsFullActivation = true; }
>+    bool needsFullActivation() const { return m_needsFullActivation; }
> 
> #if ENABLE(ES6_CLASS_SYNTAX)
>     bool hasDirectSuper() { return m_hasDirectSuper; }
>@@ -287,16 +335,29 @@ struct Scope {
>             m_usesEval = true;
>         IdentifierSet::iterator end = nestedScope->m_usedVariables.end();
>         for (IdentifierSet::iterator ptr = nestedScope->m_usedVariables.begin(); ptr != end; ++ptr) {
>-            if (nestedScope->m_declaredVariables.contains(*ptr))
>+            if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                 continue;
>             m_usedVariables.add(*ptr);
>-            if (shouldTrackClosedVariables)
>+            // FIXME: This isn't so intuitive and we should have better names here. Basically, we don't
>+            // want a declared variable that is used in an inner scope to be thought of as captured if
>+            // that inner scope is both a lexical scope and not a function. Only inner functions
>+            // can capture variables.
>+            if (shouldTrackClosedVariables && (nestedScope->m_isFunctionBoundary || !nestedScope->m_isLexicalScope))
>+                m_closedVariables.add(*ptr);
>+        }
>+
>+        if (nestedScope->m_isLexicalScope && !nestedScope->m_isFunctionBoundary) {
>+            // Propagate closed variables downwards from nested block scopes within the same function/global code.
>+            IdentifierSet::iterator end = nestedScope->m_closedVariables.end();
>+            for (IdentifierSet::iterator ptr = nestedScope->m_closedVariables.begin(); ptr != end; ++ptr)
>                 m_closedVariables.add(*ptr);
>         }
>+
>         if (nestedScope->m_writtenVariables.size()) {
>             IdentifierSet::iterator end = nestedScope->m_writtenVariables.end();
>             for (IdentifierSet::iterator ptr = nestedScope->m_writtenVariables.begin(); ptr != end; ++ptr) {
>-                if (nestedScope->m_declaredVariables.contains(*ptr))
>+                // FIXME: make sure this is correct here.
>+                if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                     continue;
>                 m_writtenVariables.add(*ptr);
>             }
>@@ -376,9 +437,11 @@ private:
>     bool m_needsFullActivation : 1;
>     bool m_hasDirectSuper : 1;
>     bool m_needsSuperBinding : 1;
>-    bool m_allowsNewDecls : 1;
>+    bool m_allowsVarDecls : 1;
>+    bool m_allowsLetDecls : 1;
>     bool m_strictMode : 1;
>     bool m_isFunction : 1;
>+    bool m_isLexicalScope : 1;
>     bool m_isFunctionBoundary : 1;
>     bool m_isValidStrictMode : 1;
>     int m_loopDepth;
>@@ -388,8 +451,10 @@ private:
>     std::unique_ptr<LabelStack> m_labels;
>     IdentifierSet m_declaredParameters;
>     IdentifierSet m_declaredVariables;
>+    IdentifierSet m_lexicallyDeclaredVariables;
>     IdentifierSet m_usedVariables;
>     IdentifierSet m_closedVariables;
>+    IdentifierSet m_lexicalCaptures;
>     IdentifierSet m_writtenVariables;
> };
> 
>@@ -437,6 +502,7 @@ public:
> 
>     JSTextPosition positionBeforeLastNewline() const { return m_lexer->positionBeforeLastNewline(); }
>     Vector<RefPtr<StringImpl>>&& closedVariables() { return WTF::move(m_closedVariables); }
>+    enum DeclarationType { VarDeclaration, LetDeclaration };
> 
> private:
>     struct AllowInOverride {
>@@ -498,6 +564,8 @@ private:
>         ASSERT_UNUSED(scope, scope.index() == m_scopeStack.size() - 1);
>         ASSERT(m_scopeStack.size() > 1);
>         bool result = m_scopeStack[m_scopeStack.size() - 2].collectFreeVariables(&m_scopeStack.last(), shouldTrackClosedVariables);
>+        if (!m_scopeStack.last().isFunctionBoundary() && m_scopeStack.last().needsFullActivation())
>+            m_scopeStack[m_scopeStack.size() - 2].setNeedsFullActivation();
>         m_scopeStack.removeLast();
>         return result;
>     }
>@@ -513,15 +581,27 @@ private:
>         return popScopeInternal(scope, shouldTrackClosedVariables);
>     }
>     
>-    bool declareVariable(const Identifier* ident)
>+    bool declareVariable(const Identifier* ident, Parser::DeclarationType type = VarDeclaration)
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+
>+        if (type == VarDeclaration) {
>+            while (!m_scopeStack[i].allowsNewDecls()) {
>+                i--;
>+                ASSERT(i < m_scopeStack.size());
>+            }
>+
>+            return m_scopeStack[i].declareVariable(ident);
>+        }
>+
>+        ASSERT(type == LetDeclaration);
>+        while (!m_scopeStack[i].allowsLexicalDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>-        return m_scopeStack[i].declareVariable(ident);
>+
>+        return m_scopeStack[i].declareLexicalVariable(ident);
>     }
>     
>     NEVER_INLINE bool hasDeclaredVariable(const Identifier& ident)
>@@ -562,8 +642,8 @@ private:
>     Parser();
>     String parseInner();
> 
>-    void didFinishParsing(SourceElements*, DeclarationStacks::VarStack&, 
>-        DeclarationStacks::FunctionStack&, CodeFeatures, int, IdentifierSet&, const Vector<RefPtr<StringImpl>>&&);
>+    void didFinishParsing(SourceElements*, DeclarationStacks::VarStack&, DeclarationStacks::FunctionStack&, 
>+        CodeFeatures, int, IdentifierSet&, const Vector<RefPtr<StringImpl>>&&);
> 
>     // Used to determine type of error to report.
>     bool isFunctionBodyNode(ScopeNode*) { return false; }
>@@ -709,7 +789,7 @@ private:
>         return true;
>     }
>     void pushLabel(const Identifier* label, bool isLoop) { currentScope()->pushLabel(label, isLoop); }
>-    void popLabel() { currentScope()->popLabel(); }
>+    void popLabel(ScopeRef scope) { scope->popLabel(); }
>     ScopeLabelInfo* getLabel(const Identifier* label)
>     {
>         ScopeRef current = currentScope();
>@@ -728,7 +808,7 @@ private:
>     template <class TreeBuilder> TreeStatement parseClassDeclaration(TreeBuilder&);
> #endif
>     template <class TreeBuilder> TreeStatement parseFunctionDeclaration(TreeBuilder&);
>-    template <class TreeBuilder> TreeStatement parseVarDeclaration(TreeBuilder&);
>+    template <class TreeBuilder> TreeStatement parseVariableDeclaration(TreeBuilder&, DeclarationType);
>     template <class TreeBuilder> TreeStatement parseConstDeclaration(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseDoWhileStatement(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseWhileStatement(TreeBuilder&);
>@@ -765,7 +845,7 @@ private:
>     template <class TreeBuilder> ALWAYS_INLINE TreeFunctionBody parseFunctionBody(TreeBuilder&, int functionKeywordStart, int functionNameStart, int parametersStart, ConstructorKind);
>     template <class TreeBuilder> ALWAYS_INLINE TreeFormalParameterList parseFormalParameters(TreeBuilder&);
>     enum VarDeclarationListContext { ForLoopContext, VarDeclarationContext };
>-    template <class TreeBuilder> TreeExpression parseVarDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext);
>+    template <class TreeBuilder> TreeExpression parseVariableDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext, DeclarationType);
>     template <class TreeBuilder> NEVER_INLINE TreeConstDeclList parseConstDeclarationList(TreeBuilder&);
> 
>     template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern createBindingPattern(TreeBuilder&, DeconstructionKind, const Identifier&, int depth, JSToken);
>@@ -851,9 +931,7 @@ private:
>         m_assignmentCount = state.assignmentCount;
>         m_nonLHSCount = state.nonLHSCount;
>         m_nonTrivialExpressionCount = state.nonTrivialExpressionCount;
>-        
>     }
>-    
> 
>     VM* m_vm;
>     const SourceCode* m_source;
>@@ -951,6 +1029,8 @@ std::unique_ptr<ParsedNode> Parser<Lexer
>                                     m_varDeclarations,
>                                     m_funcDeclarations,
>                                     m_capturedVariables,
>+                                    currentScope()->lexicallyDeclaredVariables(),
>+                                    currentScope()->lexicallyCapturedVariables(),
>                                     *m_source,
>                                     m_features,
>                                     m_numConstants);
>Index: Source/JavaScriptCore/parser/ParserTokens.h
>===================================================================
>--- Source/JavaScriptCore/parser/ParserTokens.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/ParserTokens.h	(working copy)
>@@ -57,6 +57,7 @@ enum JSTokenType {
>     FOR,
>     NEW,
>     VAR,
>+    LET,
>     CONSTTOKEN,
>     CONTINUE,
>     FUNCTION,
>Index: Source/JavaScriptCore/parser/SyntaxChecker.h
>===================================================================
>--- Source/JavaScriptCore/parser/SyntaxChecker.h	(revision 182114)
>+++ Source/JavaScriptCore/parser/SyntaxChecker.h	(working copy)
>@@ -163,8 +163,8 @@ public:
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int, int, int) { return NewExpr; }
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int) { return NewExpr; }
>     ExpressionType createConditionalExpr(const JSTokenLocation&, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
>-    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int) { return AssignmentExpr; }
>-    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&) { return AssignmentExpr; }
>+    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int, bool) { return AssignmentExpr; }
>+    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&, bool) { return AssignmentExpr; }
> #if ENABLE(ES6_CLASS_SYNTAX)
>     ClassExpression createClassExpr(const JSTokenLocation&, const Identifier&, ExpressionType, ExpressionType, PropertyList, PropertyList) { return ClassExpr; }
> #endif
>@@ -206,7 +206,7 @@ public:
>     int createClassDeclStatement(const JSTokenLocation&, ClassExpression,
>         const JSTextPosition&, const JSTextPosition&, int, int) { return StatementResult; }
> #endif
>-    int createBlockStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createBlockStatement(const JSTokenLocation&, int, int, int, IdentifierSet&, IdentifierSet&) { return StatementResult; }
>     int createExprStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int, int) { return StatementResult; }
>@@ -215,6 +215,7 @@ public:
>     int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>     int createEmptyStatement(const JSTokenLocation&) { return StatementResult; }
>     int createVarStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createLetStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createReturnStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
>Index: Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(working copy)
>@@ -64,6 +64,12 @@ public:
>         SymbolTable* symbolTable = codeBlock->symbolTable();
>         return create(vm, structure, currentScope, symbolTable);
>     }
>+
>+    static JSLexicalEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable)
>+    {
>+        Structure* structure = globalObject->activationStructure();
>+        return create(vm, structure, currentScope, symbolTable);
>+    }
>         
>     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
>     static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
>Index: Source/JavaScriptCore/runtime/JSScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.cpp	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSScope.cpp	(working copy)
>@@ -148,14 +148,14 @@ JSValue JSScope::resolve(ExecState* exec
>     }
> }
> 
>-ResolveOp JSScope::abstractResolve(ExecState* exec, bool hasTopActivation, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
>+ResolveOp JSScope::abstractResolve(ExecState* exec, unsigned depthOffset, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
> {
>     ResolveOp op(Dynamic, 0, 0, 0, 0, 0);
>     if (unlinkedType == Dynamic)
>         return op;
> 
>-    size_t depth = hasTopActivation ? 1 : 0;
>     bool needsVarInjectionChecks = JSC::needsVarInjectionChecks(unlinkedType);
>+    size_t depth = depthOffset;
>     for (; scope; scope = scope->next()) {
>         if (abstractAccess(exec, scope, ident, getOrPut, depth, needsVarInjectionChecks, op))
>             break;
>Index: Source/JavaScriptCore/runtime/JSScope.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.h	(revision 182114)
>+++ Source/JavaScriptCore/runtime/JSScope.h	(working copy)
>@@ -156,7 +156,7 @@ public:
>     static JSObject* objectAtScope(JSScope*);
> 
>     static JSValue resolve(ExecState*, JSScope*, const Identifier&);
>-    static ResolveOp abstractResolve(ExecState*, bool hasTopActivation, JSScope*, const Identifier&, GetOrPut, ResolveType);
>+    static ResolveOp abstractResolve(ExecState*, unsigned depthOffset, JSScope*, const Identifier&, GetOrPut, ResolveType);
> 
>     static void visitChildren(JSCell*, SlotVisitor&);
>

Actions: View | Formatted Diff | Diff

Attachments on bug 142944: 249945 | 249961 | 250169 | 250230 | 250533 | 250684 | 250714 | 250715 | 251081 | 251130 | 251133 | 251136 | 251409 | 251653 | 251913 | 252074 | 253066 | 253070 | 253115 | 253794 | 255536 | 255614 | 255622 | 255804 | 255806 | 255807 | 255830 | 255834 | 255835 | 255871 | 256033 | 256036 | 256226 | 256232 | 256233 | 256257 | 256264 | 256267 | 256433 | 256438 | 256445 | 256450 | 256465 | 256481 | 256658 | 256860