Attachment 250714 Details for Bug 142944 – WIP

[patch] WIP

ternary-backup.diff (text/plain), 117.01 KB, created by Saam Barati on 2015-04-14 10:52:29 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2015-04-14 10:52:29 PDT

Size: 117.01 KB

patch

obsolete

>Index: Source/JavaScriptCore/bytecode/BytecodeList.json
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeList.json	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/BytecodeList.json	(working copy)
>@@ -110,6 +110,8 @@
>             { "name" : "op_push_with_scope", "length" : 3 },
>             { "name" : "op_pop_scope", "length" : 2 },
>             { "name" : "op_push_name_scope", "length" : 5 },
>+            { "name" : "op_push_lexical_scope", "length" : 4 },
>+            { "name" : "op_pop_lexical_scope", "length" : 2 },
>             { "name" : "op_catch", "length" : 2 },
>             { "name" : "op_throw", "length" : 2 },
>             { "name" : "op_throw_static_error", "length" : 3 },
>Index: Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(working copy)
>@@ -58,6 +58,7 @@ void computeUsesForBytecodeOffset(
>     case op_to_this:
>     case op_check_tdz:
>     case op_pop_scope:
>+    case op_pop_lexical_scope:
>     case op_profile_will_call:
>     case op_profile_did_call:
>     case op_profile_type:
>@@ -120,6 +121,7 @@ void computeUsesForBytecodeOffset(
>     case op_init_global_const:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_get_from_scope:
>     case op_to_primitive:
>@@ -293,8 +295,10 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_enumerator_structure_pname:
>     case op_enumerator_generic_pname:
>     case op_pop_scope:
>+    case op_pop_lexical_scope:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_strcat:
>     case op_to_primitive:
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -1447,6 +1447,11 @@ void CodeBlock::dumpBytecode(
>             printLocationOpAndRegisterOperand(out, exec, location, it, "pop_scope", r0);
>             break;
>         }
>+        case op_pop_lexical_scope: {
>+            int r0 = (++it)->u.operand;
>+            printLocationOpAndRegisterOperand(out, exec, location, it, "pop_lexical_scope", r0);
>+            break;
>+        }
>         case op_push_name_scope: {
>             int dst = (++it)->u.operand;
>             int r1 = (++it)->u.operand;
>@@ -1456,6 +1461,14 @@ void CodeBlock::dumpBytecode(
>             out.printf("%s, %s, %s, %s", registerName(dst).data(), registerName(r1).data(), constantName(k0).data(), (scopeType == JSNameScope::FunctionNameScope) ? "functionScope" : ((scopeType == JSNameScope::CatchScope) ? "catchScope" : "unknownScopeType"));
>             break;
>         }
>+        case op_push_lexical_scope: {
>+            int dst = (++it)->u.operand;
>+            int scope = (++it)->u.operand;
>+            int symbolTable = (++it)->u.operand;
>+            printLocationAndOp(out, exec, location, it, "push_lexical_scope");
>+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(scope).data(), registerName(symbolTable).data());
>+            break;
>+        }
>         case op_catch: {
>             int r0 = (++it)->u.operand;
>             printLocationOpAndRegisterOperand(out, exec, location, it, "catch", r0);
>@@ -1840,6 +1853,9 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>     UnlinkedInstructionStream::Reader instructionReader(unlinkedCodeBlock->instructions());
> 
>     Vector<Instruction, 0, UnsafeVectorOverflow> instructions(instructionCount);
>+
>+    Vector<SymbolTable*> symbolTableStack;
>+
>     for (unsigned i = 0; !instructionReader.atEnd(); ) {
>         const UnlinkedInstruction* pc = instructionReader.next();
> 
>@@ -1944,12 +1960,38 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             break;
>         }
> 
>+        case op_push_lexical_scope: {
>+            SymbolTable* unlinkedTable = jsCast<SymbolTable*>(getConstant(pc[3].u.operand));
>+            RELEASE_ASSERT(unlinkedTable->scopeSize());
>+            SymbolTable* linkedTable = unlinkedTable->cloneScopePart(*m_vm);
>+            {
>+                ConcurrentJITLocker locker(linkedTable->m_lock);
>+                for (auto iter = linkedTable->begin(locker), end = linkedTable->end(locker); iter != end; ++iter)
>+                    iter->value.disableWatching();
>+            }
>+            m_constantRegisters[pc[3].u.operand - FirstConstantRegisterIndex].set(m_globalObject->vm(), m_ownerExecutable.get(), linkedTable);
>+            symbolTableStack.append(linkedTable);
>+            break;
>+        }
>+
>+        case op_create_lexical_environment: {
>+            if (symbolTable()->scopeSize())
>+                RELEASE_ASSERT(didCloneSymbolTable);
>+            symbolTableStack.append(symbolTable());
>+            break;
>+        }
>+
>+        case op_pop_lexical_scope: {
>+            symbolTableStack.removeLast();
>+            break;
>+        }
>+
>         case op_resolve_scope: {
>             const Identifier& ident = identifier(pc[3].u.operand);
>             ResolveType type = static_cast<ResolveType>(pc[4].u.operand);
>             RELEASE_ASSERT(type != LocalClosureVar);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, type);
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, type);
>             instructions[i + 4].u.operand = op.type;
>             instructions[i + 5].u.operand = op.depth;
>             if (op.lexicalEnvironment)
>@@ -1973,7 +2015,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[3].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -1981,6 +2023,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             else if (op.structure)
>                 instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
>             instructions[i + 6].u.pointer = reinterpret_cast<void*>(op.operand);
>+
>             break;
>         }
> 
>@@ -1990,14 +2033,21 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             if (modeAndType.type() == LocalClosureVar) {
>                 // Only do watching if the property we're putting to is not anonymous.
>                 if (static_cast<unsigned>(pc[2].u.operand) != UINT_MAX) {
>-                    RELEASE_ASSERT(didCloneSymbolTable);
>                     const Identifier& ident = identifier(pc[2].u.operand);
>                     StringImpl* uid = ident.impl();
>-                    ConcurrentJITLocker locker(m_symbolTable->m_lock);
>-                    SymbolTable::Map::iterator iter = m_symbolTable->find(locker, uid);
>-                    ASSERT(iter != m_symbolTable->end(locker));
>-                    iter->value.prepareToWatch();
>-                    instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                    bool found = false;
>+                    for (unsigned stackIdx = symbolTableStack.size(); stackIdx--; ) {
>+                        SymbolTable* symbolTable = symbolTableStack[stackIdx];
>+                        ConcurrentJITLocker locker(symbolTable->m_lock);
>+                        SymbolTable::Map::iterator iter = symbolTable->find(locker, uid);
>+                        if (iter != symbolTable->end(locker)) {
>+                            iter->value.prepareToWatch();
>+                            instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                            found = true;
>+                            break;
>+                        }
>+                    }
>+                    RELEASE_ASSERT(found);
>                 } else
>                     instructions[i + 5].u.watchpointSet = nullptr;
>                 break;
>@@ -2005,7 +2055,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[2].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Put, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Put, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -2037,7 +2087,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             case ProfileTypeBytecodeGetFromScope: {
>                 const Identifier& ident = identifier(pc[4].u.operand);
>                 ResolveType type = static_cast<ResolveType>(pc[5].u.operand);
>-                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
>+                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
> 
>                 // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
>                 // https://bugs.webkit.org/show_bug.cgi?id=135184
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 182773)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
>@@ -75,6 +75,9 @@ ParserError BytecodeGenerator::generate(
>         entry.second->bindValue(*this, entry.first.get());
>     }
> 
>+    // Must come before functions.
>+    pushLexicalScope(m_scopeNode->lexicalVariables(), m_scopeNode->lexicalCaptures());
>+
>     {
>         RefPtr<RegisterID> temp = newTemporary();
>         for (FunctionBodyNode* functionBody : m_functionsToInitialize) {
>@@ -482,6 +485,10 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         instructions().append(0);
>         instructions().append(0);
>     }
>+
>+    // FIXME: make a way for this symbol table to be the same as the lexical symbol table for
>+    // lexical variables defined at the base level of functions.
>+    m_symbolTableStack.append(SymbolTableStackEntry(m_symbolTable, m_lexicalEnvironmentRegister));
> }
> 
> BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>@@ -548,12 +555,23 @@ RegisterID* BytecodeGenerator::newRegist
>     return &m_calleeRegisters.last();
> }
> 
>-RegisterID* BytecodeGenerator::newTemporary()
>+void BytecodeGenerator::reclaimFreeRegisters()
> {
>-    // Reclaim free register IDs.
>     while (m_calleeRegisters.size() && !m_calleeRegisters.last().refCount())
>         m_calleeRegisters.removeLast();
>-        
>+}
>+
>+RegisterID* BytecodeGenerator::newLexicalVariable()
>+{
>+    reclaimFreeRegisters();
>+
>+    return newRegister();
>+}
>+
>+RegisterID* BytecodeGenerator::newTemporary()
>+{
>+    reclaimFreeRegisters();
>+
>     RegisterID* result = newRegister();
>     result->setTemporary();
>     return result;
>@@ -1185,6 +1203,179 @@ RegisterID* BytecodeGenerator::emitLoadG
>     return m_globalObjectRegister;
> }
> 
>+const Identifier* BytecodeGenerator::makeIdentifier(StringImpl* impl)
>+{
>+    if (impl->is8Bit())
>+        return &parserArena().identifierArena().makeIdentifier(m_vm, impl->characters8(), impl->length());
>+    else
>+        return &parserArena().identifierArena().makeIdentifier(m_vm, impl->characters16(), impl->length());
>+}
>+
>+void BytecodeGenerator::pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars, bool prefillWithEmptyValue)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTable* symbolTable = SymbolTable::create(*m_vm);
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto ident : vars) {
>+            SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+            if (!entry.isNull()) // FIXME: consider what to do here.
>+                continue;
>+
>+            VarKind varKind = capturedVars.contains(ident) ? VarKind::Scope : VarKind::Stack;
>+            VarOffset varOffset;
>+            if (varKind == VarKind::Scope)
>+                varOffset = VarOffset(symbolTable->takeNextScopeOffset(locker));
>+            else {
>+                ASSERT(varKind == VarKind::Stack);
>+                RegisterID* local = newLexicalVariable();
>+                local->ref();
>+                varOffset = VarOffset(local->virtualRegister());
>+            }
>+            SymbolTableEntry newEntry(varOffset, 0/*constantMode == IsConstant ? ReadOnly : 0*/);
>+            // FIXME: why does cloning symbol table not preserve disableWatching() for symbol table entries?
>+            // newEntry.disableWatching();
>+            symbolTable->add(locker, ident.get(), newEntry);
>+        }
>+    }
>+    
>+    RegisterID* newScope = nullptr;
>+    if (capturedVars.size()) {
>+        newScope = newLexicalVariable();
>+        newScope->ref();
>+
>+        emitOpcode(op_push_lexical_scope);
>+        instructions().append(newScope->index());
>+        instructions().append(scopeRegister()->index());
>+        instructions().append(addConstantValue(symbolTable->cloneScopePart(*m_vm))->index());
>+
>+        emitMove(scopeRegister(), newScope);
>+    }
>+
>+    m_symbolTableStack.append(SymbolTableStackEntry(symbolTable, newScope));
>+    m_TDZStack.append(&vars);
>+    if (prefillWithEmptyValue) {
>+        // Prefill slots with the empty value.
>+        for (auto ident : vars) {
>+            SymbolTableEntry entry = symbolTable->get(ident.get());
>+            ASSERT(!entry.isNull());
>+            VarOffset offset = entry.varOffset();
>+            RefPtr<RegisterID> emptyValue = addConstantEmptyValue();
>+            if (offset.isStack())
>+                emitMoveEmptyValue(&registerFor(offset.stackOffset()));
>+            else {
>+                ASSERT(offset.isScope() && newScope);
>+                const Identifier* identifier = makeIdentifier(ident.get());
>+                emitPutToScope(newScope, variableForLocalEntry(*identifier, entry), emptyValue.get(), DoNotThrowIfNotFound);
>+            }
>+        }
>+    }
>+}
>+
>+void BytecodeGenerator::popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTableStackEntry stackEntry = m_symbolTableStack.takeLast();
>+    SymbolTable* symbolTable = stackEntry.first;
>+    ConcurrentJITLocker locker(symbolTable->m_lock);
>+    for (auto ident : vars) {
>+        if (capturedVars.contains(ident))
>+            continue;
>+        SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+        ASSERT(!entry.isNull());
>+        VarOffset offset = entry.varOffset();
>+        ASSERT(offset.isStack());
>+        RegisterID* local = &registerFor(offset.stackOffset());
>+        local->deref();
>+    }
>+
>+    if (capturedVars.size()) {
>+        RELEASE_ASSERT(stackEntry.second);
>+        stackEntry.second->deref();
>+        emitOpcode(op_pop_lexical_scope);
>+        instructions().append(scopeRegister()->index());
>+    }
>+
>+    RELEASE_ASSERT(m_TDZStack.last() == &vars);
>+    m_TDZStack.removeLast();
>+}
>+
>+void BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    UNUSED_PARAM(vars);
>+
>+    // This function needs to do setup for a for loop's activation if 
>+    // any of the for loop's declared variables are captured. This needs 
>+    // to make a copy of the current activation because each iteration 
>+    // of a for loop gets a new activation. We only need to do this 
>+    // if the symbol table has any captured variables.
>+    if (!capturedVars.size())
>+        return;
>+
>+    ASSERT(m_symbolTableStack.size());
>+    SymbolTableStackEntry stackEntry = m_symbolTableStack.last();
>+    SymbolTable* symbolTable = stackEntry.first;
>+    ASSERT(symbolTable->scopeSize());
>+    RegisterID* scope = stackEntry.second;
>+    ASSERT(scope);
>+    Vector<std::pair<RegisterID*, const Identifier*>> activationValuesToCopyOver;
>+
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        activationValuesToCopyOver.reserveInitialCapacity(symbolTable->scopeSize());
>+
>+        for (auto end = symbolTable->end(locker), ptr = symbolTable->begin(locker); ptr != end; ++ptr) {
>+            if (!ptr->value.varOffset().isScope())
>+                continue;
>+             
>+            RefPtr<StringImpl> ident = ptr->key;
>+            const Identifier* identifier = makeIdentifier(ident.get());
>+                 
>+            RegisterID* transitionValue = newLexicalVariable();
>+            transitionValue->ref();
>+            emitGetFromScope(transitionValue, scope, variableForLocalEntry(*identifier, ptr->value), DoNotThrowIfNotFound);
>+            activationValuesToCopyOver.uncheckedAppend(std::make_pair(transitionValue, identifier));
>+        }
>+    }
>+
>+    // We need this dynamic behavior of the executing code to ensure
>+    // each loop iteration has a new activation. (It's pretty ugly).
>+    // Also, this new scope needs to be assigned to the same register
>+    // as the previous scope because the loop body is compiled under
>+    // the assumption that the scope's register index is constant even 
>+    // though the value in that register will change on each loop iteration.
>+    emitOpcode(op_pop_lexical_scope);
>+    instructions().append(scopeRegister()->index());
>+
>+    // FIXME: make sure we're not messing up any state here.
>+    emitOpcode(op_push_lexical_scope);
>+    instructions().append(scope->index());
>+    instructions().append(scopeRegister()->index());
>+    instructions().append(addConstantValue(symbolTable->cloneScopePart(*m_vm))->index());
>+
>+    emitMove(scopeRegister(), scope);
>+
>+    // FIXME: these variables no longer need to be under TDZ.
>+    // Everything lexically declared in For Loop will no longer
>+    // be under TDZ in the body of the loop by the nature of a
>+    // For Loop's syntactic structure and semantics.
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto pair : activationValuesToCopyOver) {
>+            const Identifier* identifier = pair.second;
>+            SymbolTableEntry entry = symbolTable->get(locker, identifier->impl());
>+            RELEASE_ASSERT(!entry.isNull());
>+            RegisterID* transitionValue = pair.first;
>+            emitPutToScope(scope, variableForLocalEntry(*identifier, entry), transitionValue, DoNotThrowIfNotFound);
>+            transitionValue->deref();
>+        }
>+    }
>+}
>+
> Variable BytecodeGenerator::variable(const Identifier& property)
> {
>     if (property == propertyNames().thisIdentifier) {
>@@ -1193,20 +1384,19 @@ Variable BytecodeGenerator::variable(con
>             ReadOnly, Variable::SpecialVariable);
>     }
>     
>-    if (!shouldOptimizeLocals())
>-        return Variable(property);
>-    
>-    SymbolTableEntry entry = symbolTable().get(property.impl());
>-    if (entry.isNull())
>-        return Variable(property);
>-    
>-    if (entry.varOffset().isScope() && m_localScopeDepth) {
>-        // FIXME: We should be able to statically resolve through our local scopes.
>-        // https://bugs.webkit.org/show_bug.cgi?id=141885
>+    if (m_localScopeDepth)
>         return Variable(property);
>+
>+    for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+        SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+        SymbolTableEntry entry = symbolTable.get(property.impl());
>+        if (entry.isNull())
>+            continue;
>+        
>+        return variableForLocalEntry(property, entry);
>     }
>-    
>-    return variableForLocalEntry(property, entry);
>+
>+    return Variable(property);
> }
> 
> Variable BytecodeGenerator::variablePerSymbolTable(const Identifier& property)
>@@ -1237,9 +1427,9 @@ void BytecodeGenerator::createVariable(
>     ExistingVariableMode existingVariableMode)
> {
>     ASSERT(property != propertyNames().thisIdentifier);
>-    
>-    ConcurrentJITLocker locker(symbolTable().m_lock);
>-    SymbolTableEntry entry = symbolTable().get(locker, property.impl());
>+    SymbolTable& symbolTable = *m_symbolTable;
>+    ConcurrentJITLocker locker(symbolTable.m_lock);
>+    SymbolTableEntry entry = symbolTable.get(locker, property.impl());
>     
>     if (!entry.isNull()) {
>         if (existingVariableMode == IgnoreExisting)
>@@ -1263,13 +1453,13 @@ void BytecodeGenerator::createVariable(
>     
>     VarOffset varOffset;
>     if (varKind == VarKind::Scope)
>-        varOffset = VarOffset(symbolTable().takeNextScopeOffset(locker));
>+        varOffset = VarOffset(symbolTable.takeNextScopeOffset(locker));
>     else {
>         ASSERT(varKind == VarKind::Stack);
>         varOffset = VarOffset(virtualRegisterForLocal(m_calleeRegisters.size()));
>     }
>     SymbolTableEntry newEntry(varOffset, constantMode == IsConstant ? ReadOnly : 0);
>-    symbolTable().add(locker, property.impl(), newEntry);
>+    symbolTable.add(locker, property.impl(), newEntry);
>     
>     if (varKind == VarKind::Stack) {
>         RegisterID* local = addVar();
>@@ -1314,7 +1504,19 @@ RegisterID* BytecodeGenerator::emitResol
>         // don't do that already is that m_lexicalEnvironment is required by ConstDeclNode. ConstDeclNode
>         // requires weird things because it is a shameful pile of nonsense, but block scoping would make
>         // that code sensible and obviate the need for us to do bad things.
>-        return m_lexicalEnvironmentRegister;
>+        for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+            SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+            SymbolTableEntry entry = symbolTable.get(variable.ident().impl());
>+            if (entry.isNull())
>+                continue;
>+            
>+            RegisterID* scope = m_symbolTableStack[i].second; 
>+            RELEASE_ASSERT(scope);
>+            return scope;
>+        }
>+
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return nullptr;
>         
>     case VarKind::Invalid:
>         // Indicates non-local resolution.
>@@ -1635,6 +1837,34 @@ void BytecodeGenerator::emitTDZCheck(Reg
>     instructions().append(target->index());
> }
> 
>+void BytecodeGenerator::emitTDZCheckIfNecessary(const Variable& variable, RegisterID* target, RegisterID* scope)
>+{
>+    // FIXME: this doesn't work for lexical variables outside the current function, i.e:
>+    // ```
>+    // function foo() {
>+    //     capture();
>+    //     let baz = 20;
>+    //     function capture() { return baz; }
>+    // }
>+    // ```
>+    // doesn't throw.
>+    for (unsigned i = m_TDZStack.size(); i-- > 0;) {
>+        const IdentifierSet* identifiers = m_TDZStack[i];
>+        if (identifiers->contains(variable.ident().impl())) {
>+            if (target)
>+                emitTDZCheck(target);
>+            else {
>+                RELEASE_ASSERT(!variable.isLocal() && scope);
>+                RefPtr<RegisterID> result = newTemporary();
>+                emitGetFromScope(result.get(), scope, variable, DoNotThrowIfNotFound);
>+                emitTDZCheck(result.get());
>+            }
>+
>+            break;
>+        }
>+    }
>+}
>+
> RegisterID* BytecodeGenerator::emitNewObject(RegisterID* dst)
> {
>     size_t begin = instructions().size();
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 182773)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
>@@ -309,6 +309,13 @@ namespace JSC {
> 
>         RegisterID* ignoredResult() { return &m_ignoredResultRegister; }
> 
>+        // This will be allocated in the temporary region of registers, but it
>+        // will not be marked as a temporary. This will ensure that finalDestination()
>+        // does not overwrite a lexical variable that it mistakes as a temporary. These
>+        // registers can be reclaimed when the lexical scope they belong to is no longer
>+        // on the symbol table stack.
>+        RegisterID* newLexicalVariable();
>+
>         // Returns a place to write intermediate values of an operation
>         // which reuses dst if it is safe to do so.
>         RegisterID* tempDestination(RegisterID* dst)
>@@ -449,6 +456,7 @@ namespace JSC {
> 
>         RegisterID* emitCreateThis(RegisterID* dst);
>         void emitTDZCheck(RegisterID* target);
>+        void emitTDZCheckIfNecessary(const Variable&, RegisterID* target, RegisterID* scope);
>         RegisterID* emitNewObject(RegisterID* dst);
>         RegisterID* emitNewArray(RegisterID* dst, ElementNode*, unsigned length); // stops at first elision
> 
>@@ -586,8 +594,14 @@ namespace JSC {
> 
>         OpcodeID lastOpcodeID() const { return m_lastOpcodeID; }
> 
>+        void pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars, bool prefillWithEmptyValue = true);
>+        void popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+        void prepareLexicalScopeForNextForLoopIteration(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+
>     private:
>+        void reclaimFreeRegisters();
>         Variable variableForLocalEntry(const Identifier&, const SymbolTableEntry&);
>+        const Identifier* makeIdentifier(StringImpl*);
> 
>         void emitOpcode(OpcodeID);
>         UnlinkedArrayAllocationProfile newArrayAllocationProfile();
>@@ -670,31 +684,6 @@ namespace JSC {
> 
>         SymbolTable& symbolTable() { return *m_symbolTable; }
> 
>-        bool shouldOptimizeLocals()
>-        {
>-            if (m_codeType != FunctionCode)
>-                return false;
>-
>-            if (m_localScopeDepth)
>-                return false;
>-
>-            return true;
>-        }
>-
>-        bool canOptimizeNonLocals()
>-        {
>-            if (m_localScopeDepth)
>-                return false;
>-
>-            if (m_codeType == EvalCode)
>-                return false;
>-
>-            if (m_codeType == FunctionCode && m_codeBlock->usesEval())
>-                return false;
>-
>-            return true;
>-        }
>-
>         RegisterID* emitThrowExpressionTooDeepException();
> 
>     private:
>@@ -704,6 +693,9 @@ namespace JSC {
>         bool m_shouldEmitProfileHooks;
> 
>         SymbolTable* m_symbolTable { nullptr };
>+        typedef std::pair<SymbolTable*, RegisterID*> SymbolTableStackEntry;
>+        Vector<SymbolTableStackEntry> m_symbolTableStack;
>+        Vector<const IdentifierSet*> m_TDZStack;
> 
>         ScopeNode* const m_scopeNode;
>         Strong<UnlinkedCodeBlock> m_codeBlock;
>Index: Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(revision 182773)
>+++ Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(working copy)
>@@ -194,6 +194,7 @@ RegisterID* ResolveNode::emitBytecode(By
> {
>     Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (dst == generator.ignoredResult())
>             return nullptr;
>         if (generator.vm()->typeProfiler()) {
>@@ -208,6 +209,7 @@ RegisterID* ResolveNode::emitBytecode(By
>     RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
>     RegisterID* finalDest = generator.finalDestination(dst);
>     RegisterID* result = generator.emitGetFromScope(finalDest, scope.get(), var, ThrowIfNotFound);
>+    generator.emitTDZCheckIfNecessary(var, finalDest, scope.get());
>     if (generator.vm()->typeProfiler()) {
>         generator.emitProfileType(finalDest, var.isResolved() ? ProfileTypeBytecodeGetFromLocalScope : ProfileTypeBytecodeGetFromScope, &m_ident);
>         generator.emitTypeProfilerExpressionInfo(m_position, JSTextPosition(-1, m_position.offset + m_ident.length(), -1));
>@@ -1610,6 +1612,8 @@ RegisterID* AssignResolveNode::emitBytec
>             generator.emitReadOnlyExceptionIfNeeded();
>             return generator.emitNode(dst, m_right);
>         }
>+        if (!m_isInVariableDeclaration)
>+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (var.isSpecial() || generator.vm()->typeProfiler()) {
>             RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
>             generator.emitNode(tempDst.get(), m_right);
>@@ -1627,6 +1631,8 @@ RegisterID* AssignResolveNode::emitBytec
>     if (generator.isStrictMode())
>         generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>     RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>+    if (!m_isInVariableDeclaration)
>+        generator.emitTDZCheckIfNecessary(var, nullptr, scope.get());
>     if (dst == generator.ignoredResult())
>         dst = 0;
>     RefPtr<RegisterID> result = generator.emitNode(dst, m_right);
>@@ -1829,7 +1835,9 @@ void BlockNode::emitBytecode(BytecodeGen
> {
>     if (!m_statements)
>         return;
>+    generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>     m_statements->emitBytecode(generator, dst);
>+    generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
> }
> 
> // ------------------------------ EmptyStatementNode ---------------------------
>@@ -1868,21 +1876,37 @@ void VarStatementNode::emitBytecode(Byte
> 
> RegisterID* EmptyVarExpression::emitBytecode(BytecodeGenerator& generator, RegisterID*)
> {
>+    Variable var = generator.variable(m_ident);
>+    RefPtr<RegisterID> scope;
>+    RefPtr<RegisterID> value;
>+    // Lexical declarations like 'let' must move undefined into their variables so we don't
>+    // get TDZ errors for situations like this: `let x; x;`
>+    if (m_isInLexicalDeclaration) {
>+        if (RegisterID* local = var.local())
>+            generator.emitLoad(local, jsUndefined());
>+        else {
>+            scope = generator.emitResolveScope(nullptr, var);
>+            RefPtr<RegisterID> undefined = generator.emitLoad(nullptr, jsUndefined());
>+            generator.emitPutToScope(scope.get(), var, undefined.get(), generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound);
>+        }
>+    }
>+
>+    // It's safe to return null here because this node will always be a child node of VarStatementNode which ignores our return value.
>     if (!generator.vm()->typeProfiler())
>         return nullptr;
> 
>-    Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local())
>         generator.emitProfileType(local, ProfileTypeBytecodeHasGlobalID, nullptr);
>     else {
>-        RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>-        RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
>+        if (!m_isInLexicalDeclaration) {
>+            scope = generator.emitResolveScope(nullptr, var);
>+            value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
>+        }
>         generator.emitProfileType(value.get(), var.isResolved() ? ProfileTypeBytecodeGetFromLocalScope : ProfileTypeBytecodeGetFromScope, &m_ident);
>     }
> 
>     generator.emitTypeProfilerExpressionInfo(position(), JSTextPosition(-1, position().offset + m_ident.length(), -1));
> 
>-    // It's safe to return null here because this node will always be a child node of VarStatementNode which ignores our return value.
>     return nullptr;
> }
> 
>@@ -2014,6 +2038,7 @@ void ForNode::emitBytecode(BytecodeGener
> 
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
> 
>+    generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>     if (m_expr1)
>         generator.emitNode(generator.ignoredResult(), m_expr1);
>     
>@@ -2029,6 +2054,7 @@ void ForNode::emitBytecode(BytecodeGener
> 
>     generator.emitLabel(scope->continueTarget());
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
>+    generator.prepareLexicalScopeForNextForLoopIteration(lexicalVariables(), lexicalCaptures());
>     if (m_expr3)
>         generator.emitNode(generator.ignoredResult(), m_expr3);
> 
>@@ -2038,6 +2064,7 @@ void ForNode::emitBytecode(BytecodeGener
>         generator.emitJump(topOfLoop.get());
> 
>     generator.emitLabel(scope->breakTarget());
>+    generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
>     generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
> }
> 
>@@ -2178,12 +2205,15 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitJumpIfFalse(result.get(), scope->continueTarget());
> 
>         generator.emitToIndexString(propertyName.get(), i.get());
>+
>+        generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>         this->emitLoopHeader(generator, propertyName.get());
> 
>         generator.emitProfileControlFlow(profilerStartOffset);
> 
>         generator.pushIndexedForInScope(local.get(), i.get());
>         generator.emitNode(dst, m_statement);
>+        generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
>         generator.popIndexedForInScope(local.get());
> 
>         generator.emitProfileControlFlow(profilerEndOffset);
>@@ -2215,12 +2245,14 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitHasStructureProperty(result.get(), base.get(), propertyName.get(), enumerator.get());
>         generator.emitJumpIfFalse(result.get(), scope->continueTarget());
> 
>+        generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>         this->emitLoopHeader(generator, propertyName.get());
> 
>         generator.emitProfileControlFlow(profilerStartOffset);
> 
>         generator.pushStructureForInScope(local.get(), enumeratorIndex.get(), propertyName.get(), enumerator.get());
>         generator.emitNode(dst, m_statement);
>+        generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
>         generator.popStructureForInScope(local.get());
> 
>         generator.emitProfileControlFlow(profilerEndOffset);
>@@ -2254,11 +2286,13 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitHasGenericProperty(result.get(), base.get(), propertyName.get());
>         generator.emitJumpIfFalse(result.get(), scope->continueTarget());
> 
>+        generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>         this->emitLoopHeader(generator, propertyName.get());
> 
>         generator.emitProfileControlFlow(profilerStartOffset);
> 
>         generator.emitNode(dst, m_statement);
>+        generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
> 
>         generator.emitLabel(scope->continueTarget());
>         generator.emitInc(enumeratorIndex.get());
>@@ -2287,10 +2321,11 @@ void ForOfNode::emitBytecode(BytecodeGen
>         emitThrowReferenceError(generator, ASCIILiteral("Left side of for-of statement is not a reference."));
>         return;
>     }
>-
>+    
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
>     auto extractor = [this, dst](BytecodeGenerator& generator, RegisterID* value)
>     {
>+        generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>         if (m_lexpr->isResolveNode()) {
>             const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
>             Variable var = generator.variable(ident);
>@@ -2336,6 +2371,7 @@ void ForOfNode::emitBytecode(BytecodeGen
>         }
>         generator.emitProfileControlFlow(m_statement->startOffset());
>         generator.emitNode(dst, m_statement);
>+        generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
>     };
>     generator.emitEnumeration(this, m_expr, extractor);
>     generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 182773)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -3672,6 +3672,18 @@ bool ByteCodeParser::parseBlock(unsigned
>             set(VirtualRegister(currentInstruction[2].u.operand), lexicalEnvironment);
>             NEXT_OPCODE(op_create_lexical_environment);
>         }
>+
>+        case op_push_lexical_scope: {
>+            Node* lexicalEnvironment = addToGraph(CreateActivation, get(VirtualRegister(currentInstruction[2].u.operand)), get(VirtualRegister(currentInstruction[3].u.operand)));
>+            set(VirtualRegister(currentInstruction[1].u.operand), lexicalEnvironment);
>+            NEXT_OPCODE(op_push_lexical_scope);
>+        }
>+
>+        case op_pop_lexical_scope: {
>+            Node* poppedScope = addToGraph(SkipScope, get(VirtualRegister(currentInstruction[1].u.operand)));
>+            set(VirtualRegister(currentInstruction[1].u.operand), poppedScope);
>+            NEXT_OPCODE(op_pop_lexical_scope);
>+        }
>             
>         case op_get_scope: {
>             // Help the later stages a bit by doing some small constant folding here. Note that this
>Index: Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(revision 182773)
>+++ Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(working copy)
>@@ -207,6 +207,8 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_new_func:
>     case op_new_func_exp:
>     case op_create_lexical_environment:
>+    case op_push_lexical_scope:
>+    case op_pop_lexical_scope:
>         return CanCompileAndInline;
> 
>     case op_put_to_scope: {
>Index: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(revision 182773)
>+++ Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(working copy)
>@@ -1180,11 +1180,16 @@ private:
>         }
> 
>         case CreateScopedArguments:
>-        case CreateActivation:
>         case NewFunction: {
>             fixEdge<CellUse>(node->child1());
>             break;
>         }
>+        case CreateActivation: {
>+            fixEdge<CellUse>(node->child1());
>+            if (node->child2())
>+                fixEdge<KnownCellUse>(node->child2());
>+            break;
>+        }
>             
> #if !ASSERT_DISABLED
>         // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 182773)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -4441,13 +4441,18 @@ void SpeculativeJIT::compileForwardVarar
> 
> void SpeculativeJIT::compileCreateActivation(Node* node)
> {
>-    SymbolTable* table = m_jit.graph().symbolTableFor(node->origin.semantic);
>+    SymbolTable* table = nullptr;
>+    if (node->child2())
>+        table = node->child2()->castConstant<SymbolTable*>();
>+    else
>+        table = m_jit.graph().symbolTableFor(node->origin.semantic);
>     Structure* structure = m_jit.graph().globalObjectFor(
>         node->origin.semantic)->activationStructure();
>         
>     SpeculateCellOperand scope(this, node->child1());
>     GPRReg scopeGPR = scope.gpr();
>     
>+    // FIXME: should we do this for block scoped activations?
>     if (table->singletonScope()->isStillValid()) {
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 182773)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -273,6 +273,8 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_profile_control_flow)
>         DEFINE_OP(op_push_name_scope)
>         DEFINE_OP(op_push_with_scope)
>+        DEFINE_OP(op_push_lexical_scope)
>+        DEFINE_OP(op_pop_lexical_scope)
>         case op_put_by_id_out_of_line:
>         case op_put_by_id_transition_direct:
>         case op_put_by_id_transition_normal:
>Index: Source/JavaScriptCore/jit/JIT.h
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.h	(revision 182773)
>+++ Source/JavaScriptCore/jit/JIT.h	(working copy)
>@@ -534,6 +534,8 @@ namespace JSC {
>         void emit_op_profile_control_flow(Instruction*);
>         void emit_op_push_name_scope(Instruction*);
>         void emit_op_push_with_scope(Instruction*);
>+        void emit_op_push_lexical_scope(Instruction*);
>+        void emit_op_pop_lexical_scope(Instruction*);
>         void emit_op_put_by_id(Instruction*);
>         void emit_op_put_by_index(Instruction*);
>         void emit_op_put_by_val(Instruction*);
>@@ -711,6 +713,7 @@ namespace JSC {
>         MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EPc, int, Instruction*);
>         MacroAssembler::Call callOperation(J_JITOperation_EZ, int, int32_t);
>         MacroAssembler::Call callOperation(J_JITOperation_EZZ, int, int32_t, int32_t);
>+        MacroAssembler::Call callOperation(J_JITOperation_ESymtabZ, int, SymbolTable*, int32_t);
>         MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, size_t);
>         MacroAssembler::Call callOperation(S_JITOperation_ECC, RegisterID, RegisterID);
>         MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID);
>Index: Source/JavaScriptCore/jit/JITInlines.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlines.h	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITInlines.h	(working copy)
>@@ -295,6 +295,12 @@ ALWAYS_INLINE MacroAssembler::Call JIT::
>     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
> }
> 
>+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESymtabZ operation, int dst, SymbolTable* symbolTable, int32_t arg2)
>+{
>+    setupArgumentsWithExecState(TrustedImmPtr(symbolTable), TrustedImm32(arg2));
>+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
>+}
>+
> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_ECC operation, RegisterID regOp1, RegisterID regOp2)
> {
>     setupArgumentsWithExecState(regOp1, regOp2);
>Index: Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(working copy)
>@@ -815,6 +815,21 @@ void JIT::emit_op_catch(Instruction* cur
>     emitStore(exception, regT1, regT0);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand;
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+}
>+
>+void JIT::emit_op_pop_lexical_scope(Instruction* currentInstruction)
>+{
>+    int scopeSrcAndDst = currentInstruction[1].u.operand;
>+    emitLoadPayload(scopeSrcAndDst, regT0);
>+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
>+    emitStoreCell(scopeSrcAndDst, regT0);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOpcodes.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes.cpp	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITOpcodes.cpp	(working copy)
>@@ -520,6 +520,22 @@ void JIT::emit_op_catch(Instruction* cur
>     emitPutVirtualRegister(currentInstruction[1].u.operand);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand; 
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+    return;
>+}
>+
>+void JIT::emit_op_pop_lexical_scope(Instruction* currentInstruction)
>+{
>+    int scopeSrcAndDst = currentInstruction[1].u.operand;
>+    emitGetVirtualRegister(scopeSrcAndDst, regT0);
>+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
>+    emitStoreCell(scopeSrcAndDst, regT0);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -1333,6 +1333,17 @@ void JIT_OPERATION operationPushWithScop
>     exec->uncheckedR(dst) = JSWithScope::create(exec, o, currentScope);
> }
> 
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState* exec, SymbolTable* symbolTable, int32_t scopeReg)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+
>+    return JSValue::encode(newScope);
>+}
>+
> void JIT_OPERATION operationPopScope(ExecState* exec, int32_t scopeReg)
> {
>     VM& vm = exec->vm();
>Index: Source/JavaScriptCore/jit/JITOperations.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.h	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITOperations.h	(working copy)
>@@ -121,6 +121,7 @@ typedef EncodedJSValue JIT_OPERATION (*J
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZ)(ExecState*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZIcfZ)(ExecState*, int32_t, InlineCallFrame*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZZ)(ExecState*, int32_t, int32_t);
>+typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_ESymtabZ)(ExecState*, SymbolTable*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_E)(ExecState*);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EZ)(ExecState*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EC)(ExecState*, JSCell*);
>@@ -296,6 +297,7 @@ void JIT_OPERATION operationPutGetterSet
> void JIT_OPERATION operationPushCatchScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushFunctionNameScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushWithScope(ExecState*, int32_t, EncodedJSValue) WTF_INTERNAL;
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState*, SymbolTable*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationPopScope(ExecState*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationProfileDidCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationProfileWillCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 182773)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -1290,6 +1290,25 @@ LLINT_SLOW_PATH_DECL(slow_path_push_name
>     LLINT_END();
> }
> 
>+LLINT_SLOW_PATH_DECL(slow_path_push_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[2].u.operand;
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    SymbolTable* symbolTable = jsCast<SymbolTable*>(LLINT_OP_C(3).jsValue());
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+    LLINT_RETURN(newScope);
>+}
>+
>+LLINT_SLOW_PATH_DECL(slow_path_pop_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[1].u.operand;
>+    JSScope* scope = exec->uncheckedR(scopeReg).Register::scope();
>+    exec->uncheckedR(scopeReg) = scope->next();
>+    LLINT_END();
>+}
>+
> LLINT_SLOW_PATH_DECL(slow_path_throw)
> {
>     LLINT_BEGIN();
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.h	(revision 182773)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.h	(working copy)
>@@ -108,6 +108,8 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_name_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_lexical_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_lexical_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_handle_watchdog_timer);
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(revision 182773)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(working copy)
>@@ -787,8 +787,9 @@ _llint_op_new_object:
> 
> _llint_op_check_tdz:
>     traceExecution()
>-    loadpFromInstruction(1, t0)
>-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opNotTDZ
>+    loadisFromInstruction(1, t0)
>+    loadConstantOrVariableTag(t0, t1)
>+    bineq TagOffset[cfr, t1, 8], EmptyValueTag, .opNotTDZ
>     callSlowPath(_slow_path_throw_tdz_error)
> 
> .opNotTDZ:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 182773)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -672,9 +672,9 @@ _llint_op_new_object:
> 
> _llint_op_check_tdz:
>     traceExecution()
>-    loadpFromInstruction(1, t0)
>-    loadq [cfr, t0, 8], t0
>-    bqneq t0, ValueEmpty, .opNotTDZ
>+    loadisFromInstruction(1, t0)
>+    loadConstantOrVariable(t0, t1)
>+    bqneq t1, ValueEmpty, .opNotTDZ
>     callSlowPath(_slow_path_throw_tdz_error)
> 
> .opNotTDZ:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 182773)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -1285,6 +1285,18 @@ _llint_op_push_name_scope:
>     dispatch(5)
> 
> 
>+_llint_op_push_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_push_lexical_scope)
>+    dispatch(4)
>+
>+
>+_llint_op_pop_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_pop_lexical_scope)
>+    dispatch(2)
>+
>+
> _llint_op_throw:
>     traceExecution()
>     callSlowPath(_llint_slow_path_throw)
>Index: Source/JavaScriptCore/parser/ASTBuilder.h
>===================================================================
>--- Source/JavaScriptCore/parser/ASTBuilder.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/ASTBuilder.h	(working copy)
>@@ -276,11 +276,11 @@ public:
>         return new (m_parserArena) ConditionalNode(location, condition, lhs, rhs);
>     }
> 
>-    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
>+    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end, bool isInVariableDeclaration)
>     {
>         if (rhs->isFuncExprNode())
>             static_cast<FuncExprNode*>(rhs)->body()->setInferredName(ident);
>-        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs);
>+        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs, isInVariableDeclaration);
>         setExceptionLocation(node, start, divot, end);
>         return node;
>     }
>@@ -379,16 +379,16 @@ public:
>         const JSTextPosition& classStart, const JSTextPosition& classEnd, unsigned startLine, unsigned endLine)
>     {
>         // FIXME: Use "let" declaration.
>-        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd);
>+        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd, false);
>         ClassDeclNode* decl = new (m_parserArena) ClassDeclNode(location, assign);
>         decl->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return decl;
>     }
> #endif
> 
>-    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine)
>+    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine, IdentifierSet& lexicalVariables, IdentifierSet& lexicallyCapturedVariables)
>     {
>-        BlockNode* block = new (m_parserArena) BlockNode(location, elements);
>+        BlockNode* block = new (m_parserArena) BlockNode(location, elements, lexicalVariables, lexicallyCapturedVariables);
>         block->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return block;
>     }
>@@ -407,39 +407,39 @@ public:
>         return result;
>     }
> 
>-    StatementNode* createForLoop(const JSTokenLocation& location, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end)
>+    StatementNode* createForLoop(const JSTokenLocation& location, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>-        ForNode* result = new (m_parserArena) ForNode(location, initializer, condition, iter, statements);
>+        ForNode* result = new (m_parserArena) ForNode(location, initializer, condition, iter, statements, lexicalVariables, lexicalCaptures);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         return result;
>     }
> 
>-    StatementNode* createForInLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForInLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>-        ForInNode* result = new (m_parserArena) ForInNode(location, lhs, iter, statements);
>+        ForInNode* result = new (m_parserArena) ForInNode(location, lhs, iter, statements, lexicalVariables, lexicalCaptures);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         setExceptionLocation(result, eStart, eDivot, eEnd);
>         return result;
>     }
>     
>-    StatementNode* createForInLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForInLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>         auto lexpr = new (m_parserArena) DeconstructingAssignmentNode(location, pattern.get(), 0);
>-        return createForInLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end);
>+        return createForInLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end, lexicalVariables, lexicalCaptures);
>     }
>     
>-    StatementNode* createForOfLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForOfLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>-        ForOfNode* result = new (m_parserArena) ForOfNode(location, lhs, iter, statements);
>+        ForOfNode* result = new (m_parserArena) ForOfNode(location, lhs, iter, statements, lexicalVariables, lexicalCaptures);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         setExceptionLocation(result, eStart, eDivot, eEnd);
>         return result;
>     }
>     
>-    StatementNode* createForOfLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForOfLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>         auto lexpr = new (m_parserArena) DeconstructingAssignmentNode(location, pattern.get(), 0);
>-        return createForOfLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end);
>+        return createForOfLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end, lexicalVariables, lexicalCaptures);
>     }
> 
>     bool isBindingNode(const DeconstructionPattern& pattern)
>@@ -457,9 +457,15 @@ public:
>         return result;
>     }
> 
>-    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier)
>+    StatementNode* createLetStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
>     {
>-        return new (m_parserArena) EmptyVarExpression(location, identifier);
>+        // FIXME: better name for 'VarStatementNode'.
>+        return createVarStatement(location, expr, start, end);
>+    }
>+
>+    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier, bool isLexicalDeclaration)
>+    {
>+        return new (m_parserArena) EmptyVarExpression(location, identifier, isLexicalDeclaration);
>     }
> 
>     StatementNode* createReturnStatement(const JSTokenLocation& location, ExpressionNode* expression, const JSTextPosition& start, const JSTextPosition& end)
>@@ -1091,7 +1097,7 @@ ExpressionNode* ASTBuilder::makeAssignNo
>         if (op == OpEqual) {
>             if (expr->isFuncExprNode())
>                 static_cast<FuncExprNode*>(expr)->body()->setInferredName(resolve->identifier());
>-            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr);
>+            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr, false);
>             setExceptionLocation(node, start, divot, end);
>             return node;
>         }
>Index: Source/JavaScriptCore/parser/Keywords.table
>===================================================================
>--- Source/JavaScriptCore/parser/Keywords.table	(revision 182773)
>+++ Source/JavaScriptCore/parser/Keywords.table	(working copy)
>@@ -2,56 +2,56 @@
> @begin mainTable 47
> 
> # Types.
>-null		NULLTOKEN
>-true		TRUETOKEN
>-false		FALSETOKEN
>+null         NULLTOKEN
>+true         TRUETOKEN
>+false        FALSETOKEN
> 
> # Keywords.
>-break		BREAK
>-case		CASE
>-catch		CATCH
>-class		CLASSTOKEN
>-const		CONSTTOKEN
>-default		DEFAULT
>-extends	EXTENDS
>-finally		FINALLY
>-for		FOR
>-instanceof	INSTANCEOF
>-new		NEW
>-var		VAR
>-continue	CONTINUE
>-function	FUNCTION
>-return		RETURN
>-void		VOIDTOKEN
>-delete		DELETETOKEN
>-if		IF
>-this		THISTOKEN
>-do		DO
>-while		WHILE
>-else		ELSE
>-in		INTOKEN
>-super		SUPER
>-switch		SWITCH
>-throw		THROW
>-try		TRY
>-typeof		TYPEOF
>-with		WITH
>-debugger	DEBUGGER
>+break        BREAK
>+case         CASE
>+catch        CATCH
>+class        CLASSTOKEN
>+const        CONSTTOKEN
>+default      DEFAULT
>+extends      EXTENDS
>+finally      FINALLY
>+for          FOR
>+instanceof   INSTANCEOF
>+new          NEW
>+var          VAR
>+let          LET
>+continue     CONTINUE
>+function     FUNCTION
>+return       RETURN
>+void         VOIDTOKEN
>+delete       DELETETOKEN
>+if           IF
>+this         THISTOKEN
>+do           DO
>+while        WHILE
>+else         ELSE
>+in           INTOKEN
>+super        SUPER
>+switch       SWITCH
>+throw        THROW
>+try          TRY
>+typeof       TYPEOF
>+with         WITH
>+debugger     DEBUGGER
> 
> # Reserved for future use.
>-enum            RESERVED
>-export          RESERVED
>-import          RESERVED
>+enum         RESERVED
>+export       RESERVED
>+import       RESERVED
> 
> # Reserved for future use in strict code.
>-implements      RESERVED_IF_STRICT
>-interface       RESERVED_IF_STRICT
>-let             RESERVED_IF_STRICT
>-package         RESERVED_IF_STRICT
>-private         RESERVED_IF_STRICT
>-protected       RESERVED_IF_STRICT
>-public          RESERVED_IF_STRICT
>-static          RESERVED_IF_STRICT
>-yield           RESERVED_IF_STRICT
>+implements   RESERVED_IF_STRICT
>+interface    RESERVED_IF_STRICT
>+package      RESERVED_IF_STRICT
>+private      RESERVED_IF_STRICT
>+protected    RESERVED_IF_STRICT
>+public       RESERVED_IF_STRICT
>+static       RESERVED_IF_STRICT
>+yield        RESERVED_IF_STRICT
> 
> @end
>Index: Source/JavaScriptCore/parser/NodeConstructors.h
>===================================================================
>--- Source/JavaScriptCore/parser/NodeConstructors.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/NodeConstructors.h	(working copy)
>@@ -572,10 +572,11 @@ namespace JSC {
>     {
>     }
> 
>-    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right)
>+    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right, bool isInVariableDeclaration)
>         : ExpressionNode(location)
>         , m_ident(ident)
>         , m_right(right)
>+        , m_isInVariableDeclaration(isInVariableDeclaration)
>     {
>     }
> 
>@@ -671,9 +672,10 @@ namespace JSC {
>     {
>     }
> 
>-    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident)
>+    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident, bool isInLexicalDeclaration)
>         : ExpressionNode(location)
>         , m_ident(ident)
>+        , m_isInLexicalDeclaration(isInLexicalDeclaration)
>     {
>     }
>     
>@@ -699,8 +701,9 @@ namespace JSC {
>     {
>     }
> 
>-    inline ForNode::ForNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement)
>+    inline ForNode::ForNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicalCaptures)
>         , m_expr1(expr1)
>         , m_expr2(expr2)
>         , m_expr3(expr3)
>@@ -847,14 +850,16 @@ namespace JSC {
>     {
>     }
> 
>-    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements)
>+    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements, IdentifierSet& lexicalVariables, IdentifierSet& lexicallyCapturedVariables)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicallyCapturedVariables)
>         , m_statements(statements)
>     {
>     }
> 
>-    inline EnumerationNode::EnumerationNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>+    inline EnumerationNode::EnumerationNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicalCaptures)
>         , m_lexpr(l)
>         , m_expr(expr)
>         , m_statement(statement)
>@@ -862,13 +867,13 @@ namespace JSC {
>         ASSERT(l);
>     }
>     
>-    inline ForInNode::ForInNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>-        : EnumerationNode(location, l, expr, statement)
>+    inline ForInNode::ForInNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>+        : EnumerationNode(location, l, expr, statement, lexicalVariables, lexicalCaptures)
>     {
>     }
>     
>-    inline ForOfNode::ForOfNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>-        : EnumerationNode(location, l, expr, statement)
>+    inline ForOfNode::ForOfNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>+        : EnumerationNode(location, l, expr, statement, lexicalVariables, lexicalCaptures)
>     {
>     }
>     
>Index: Source/JavaScriptCore/parser/Nodes.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.cpp	(revision 182773)
>+++ Source/JavaScriptCore/parser/Nodes.cpp	(working copy)
>@@ -94,9 +94,10 @@ ScopeNode::ScopeNode(ParserArena& parser
> {
> }
> 
>-ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, CodeFeatures features, int numConstants)
>+ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, CodeFeatures features, int numConstants)
>     : StatementNode(endLocation)
>     , ParserArenaRoot(parserArena)
>+    , LexicalNode(lexicalVariables, lexicalCaptures)
>     , m_startLineNumber(startLocation.line)
>     , m_startStartOffset(startLocation.startOffset)
>     , m_startLineStartOffset(startLocation.lineStartOffset)
>@@ -117,8 +118,8 @@ StatementNode* ScopeNode::singleStatemen
> 
> // ------------------------------ ProgramNode -----------------------------
> 
>-ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>@@ -131,8 +132,8 @@ void ProgramNode::setClosedVariables(Vec
> 
> // ------------------------------ EvalNode -----------------------------
> 
>-EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_endColumn(endColumn)
> {
> }
>@@ -201,8 +202,8 @@ void FunctionBodyNode::setEndPosition(JS
> 
> // ------------------------------ FunctionNode -----------------------------
> 
>-FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, features, numConstants)
>+FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>Index: Source/JavaScriptCore/parser/Nodes.h
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/Nodes.h	(working copy)
>@@ -202,6 +202,26 @@ namespace JSC {
>         int m_lastLine;
>     };
> 
>+    class LexicalNode {
>+    public:
>+        LexicalNode()
>+        {
>+        }
>+
>+        LexicalNode(IdentifierSet& lexicalDeclaredVariables, IdentifierSet& capturedVariables)
>+        {
>+            m_lexicalVariables.swap(lexicalDeclaredVariables);
>+            m_lexicalCaptures.swap(capturedVariables);
>+        }
>+
>+        const IdentifierSet& lexicalVariables() { return m_lexicalVariables; }
>+        const IdentifierSet& lexicalCaptures() { return m_lexicalCaptures; }
>+
>+    protected:
>+        IdentifierSet m_lexicalVariables;
>+        IdentifierSet m_lexicalCaptures;
>+    };
>+
>     class ConstantNode : public ExpressionNode {
>     public:
>         ConstantNode(const JSTokenLocation&, ResultType);
>@@ -1058,13 +1078,14 @@ namespace JSC {
> 
>     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
>     public:
>-        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right);
>+        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right, bool isInVariableDeclaration);
> 
>     private:
>         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         const Identifier& m_ident;
>         ExpressionNode* m_right;
>+        bool m_isInVariableDeclaration;
>     };
> 
>     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
>@@ -1192,9 +1213,9 @@ namespace JSC {
>         StatementNode* m_tail;
>     };
> 
>-    class BlockNode : public StatementNode {
>+    class BlockNode : public StatementNode, public LexicalNode {
>     public:
>-        BlockNode(const JSTokenLocation&, SourceElements* = 0);
>+        BlockNode(const JSTokenLocation&, SourceElements*, IdentifierSet&, IdentifierSet&);
> 
>         StatementNode* singleStatement() const;
>         StatementNode* lastStatement() const;
>@@ -1250,12 +1271,13 @@ namespace JSC {
> 
>     class EmptyVarExpression : public ExpressionNode {
>     public:
>-        EmptyVarExpression(const JSTokenLocation&, const Identifier&);
>+        EmptyVarExpression(const JSTokenLocation&, const Identifier&, bool isInLexicalDeclaration);
> 
>     private:
>         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         const Identifier& m_ident;
>+        bool m_isInLexicalDeclaration;
>     };
> 
> 
>@@ -1295,9 +1317,9 @@ namespace JSC {
>         StatementNode* m_statement;
>     };
> 
>-    class ForNode : public StatementNode {
>+    class ForNode : public StatementNode, public LexicalNode {
>     public:
>-        ForNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*);
>+        ForNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*, IdentifierSet&, IdentifierSet&);
> 
>     private:
>         virtual void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -1310,9 +1332,9 @@ namespace JSC {
>     
>     class DeconstructionPatternNode;
>     
>-    class EnumerationNode : public StatementNode, public ThrowableExpressionData {
>+    class EnumerationNode : public StatementNode, public ThrowableExpressionData, public LexicalNode {
>     public:
>-        EnumerationNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        EnumerationNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, IdentifierSet&, IdentifierSet&);
>         
>     protected:
>         ExpressionNode* m_lexpr;
>@@ -1322,7 +1344,7 @@ namespace JSC {
>     
>     class ForInNode : public EnumerationNode {
>     public:
>-        ForInNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        ForInNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, IdentifierSet&, IdentifierSet&);
> 
>     private:
>         RegisterID* tryGetBoundLocal(BytecodeGenerator&);
>@@ -1334,7 +1356,7 @@ namespace JSC {
>     
>     class ForOfNode : public EnumerationNode {
>     public:
>-        ForOfNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        ForOfNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, IdentifierSet&, IdentifierSet&);
>         
>     private:
>         virtual void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -1438,13 +1460,13 @@ namespace JSC {
>         ParameterNode* m_next;
>     };
> 
>-    class ScopeNode : public StatementNode, public ParserArenaRoot {
>+    class ScopeNode : public StatementNode, public ParserArenaRoot, public LexicalNode {
>     public:
>         typedef DeclarationStacks::VarStack VarStack;
>         typedef DeclarationStacks::FunctionStack FunctionStack;
> 
>         ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, bool inStrictContext);
>-        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, CodeFeatures, int numConstants);
>+        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, CodeFeatures, int numConstants);
> 
>         using ParserArenaRoot::operator new;
> 
>@@ -1507,7 +1529,7 @@ namespace JSC {
> 
>     class ProgramNode : public ScopeNode {
>     public:
>-        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         unsigned startColumn() const { return m_startColumn; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1526,7 +1548,7 @@ namespace JSC {
> 
>     class EvalNode : public ScopeNode {
>     public:
>-        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         ALWAYS_INLINE unsigned startColumn() const { return 0; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1613,7 +1635,7 @@ namespace JSC {
> 
>     class FunctionNode final : public ScopeNode {
>     public:
>-        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         FunctionParameters* parameters() const { return m_parameters.get(); }
> 
>Index: Source/JavaScriptCore/parser/Parser.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.cpp	(revision 182773)
>+++ Source/JavaScriptCore/parser/Parser.cpp	(working copy)
>@@ -264,6 +264,8 @@ String Parser<LexerType>::parseInner()
>     if (m_lexer->isReparsing())
>         m_statementDepth--;
>     ScopeRef scope = currentScope();
>+    scope->setIsLexicalScope();
>+
>     SourceElements* sourceElements = parseSourceElements(context, CheckForStrictMode);
>     if (!sourceElements || !consume(EOFTOK)) {
>         if (hasError())
>@@ -374,9 +376,9 @@ template <class TreeBuilder> TreeSourceE
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVarDeclaration(TreeBuilder& context)
>+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVariableDeclaration(TreeBuilder& context, DeclarationType type)
> {
>-    ASSERT(match(VAR));
>+    ASSERT(match(VAR) || match(LET));
>     JSTokenLocation location(tokenLocation());
>     int start = tokenLine();
>     int end = 0;
>@@ -384,11 +386,14 @@ template <class TreeBuilder> TreeStateme
>     TreeDeconstructionPattern scratch1 = 0;
>     TreeExpression scratch2 = 0;
>     JSTextPosition scratch3;
>-    TreeExpression varDecls = parseVarDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext);
>+    TreeExpression decls = parseVariableDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext, type);
>     propagateError();
>     failIfFalse(autoSemiColon(), "Expected ';' after var declaration");
>     
>-    return context.createVarStatement(location, varDecls, start, end);
>+    if (type == VarDeclaration)
>+        return context.createVarStatement(location, decls, start, end);
>+    else 
>+        return context.createLetStatement(location, decls, start, end);
> }
> 
> template <typename LexerType>
>@@ -453,7 +458,7 @@ template <class TreeBuilder> TreeStateme
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext)
>+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVariableDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext, DeclarationType declarationType)
> {
>     TreeExpression head = 0;
>     TreeExpression tail = 0;
>@@ -476,7 +481,7 @@ template <class TreeBuilder> TreeExpress
>             lastIdentToken = m_token;
>             next();
>             hasInitializer = match(EQUAL);
>-            failIfFalseIfStrict(declareVariable(name), "Cannot declare a variable named ", name->impl(), " in strict mode");
>+            failIfFalseIfStrict(declareVariable(name, declarationType), "Cannot declare a variable named ", name->impl(), " in strict mode");
>             context.addVar(name, (hasInitializer || (!m_allowsIn && (match(INTOKEN) || isofToken()))) ? DeclarationStacks::HasInitializer : 0);
>             if (hasInitializer) {
>                 JSTextPosition varDivot = tokenStartPosition() + 1;
>@@ -487,12 +492,12 @@ template <class TreeBuilder> TreeExpress
>                 lastInitializer = initializer;
>                 failIfFalse(initializer, "Expected expression as the intializer for the variable '", name->impl(), "'");
>                 
>-                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition());
>+                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition(), true);
>             } else
>-                node = context.createEmptyVarExpression(varStartLocation, *name);
>+                node = context.createEmptyVarExpression(varStartLocation, *name, declarationType == LetDeclaration);
>         } else {
>             lastIdent = 0;
>-            auto pattern = parseDeconstructionPattern(context, DeconstructToVariables);
>+            auto pattern = parseDeconstructionPattern(context, declarationType == VarDeclaration ? DeconstructToVariables : DeconstructToLexicalVariables);
>             failIfFalse(pattern, "Cannot parse this deconstruction pattern");
>             hasInitializer = match(EQUAL);
>             failIfTrue(declarationListContext == VarDeclarationContext && !hasInitializer, "Expected an initializer in destructuring variable declaration");
>@@ -513,8 +518,10 @@ template <class TreeBuilder> TreeExpress
>         } else
>             tail = context.appendToCommaExpr(location, head, tail, node);
>     } while (match(COMMA));
>+    // FIXME: consider that this causes the last variable in each declaration list to be declared twice.
>     if (lastIdent)
>-        lastPattern = createBindingPattern(context, DeconstructToVariables, *lastIdent, 0, lastIdentToken);
>+        lastPattern = createBindingPattern(context, declarationType == VarDeclaration ? DeconstructToVariables : DeconstructToLexicalVariables, *lastIdent, 0, lastIdentToken);
>+
>     return head;
> }
> 
>@@ -528,7 +535,9 @@ template <class TreeBuilder> TreeDeconst
>     if (depth) {
>         if (kind == DeconstructToVariables)
>             failIfFalseIfStrict(declareVariable(&name), "Cannot deconstruct to a variable named '", name.impl(), "' in strict mode");
>-        if (kind == DeconstructToParameters) {
>+        else if (kind == DeconstructToLexicalVariables)
>+            failIfFalseIfStrict(declareVariable(&name, LetDeclaration), "Cannot deconstruct to a variable named '", name.impl(), "' in strict mode");
>+        else if (kind == DeconstructToParameters) {
>             auto bindingResult = declareBoundParameter(&name);
>             if (bindingResult == Scope::StrictBindingFailed && strictMode()) {
>                 semanticFailIfTrue(m_vm->propertyNames->arguments == name || m_vm->propertyNames->eval == name, "Cannot deconstruct to a parameter name '", name.impl(), "' in strict mode");
>@@ -546,16 +555,16 @@ template <class TreeBuilder> TreeDeconst
>                 semanticFail("Cannot deconstruct to a parameter named '", name.impl(), "'");
>             }
>         }
>-        if (kind != DeconstructToExpressions)
>+        if (kind != DeconstructToExpressions && kind != DeconstructToLexicalVariables)
>             context.addVar(&name, DeclarationStacks::HasInitializer);
> 
>     } else {
>         if (kind == DeconstructToVariables) {
>             failIfFalseIfStrict(declareVariable(&name), "Cannot declare a variable named '", name.impl(), "' in strict mode");
>             context.addVar(&name, DeclarationStacks::HasInitializer);
>-        }
>-        
>-        if (kind == DeconstructToParameters) {
>+        } else if (kind == DeconstructToLexicalVariables)
>+            failIfFalseIfStrict(declareVariable(&name, LetDeclaration), "Cannot declare a variable named '", name.impl(), "' in strict mode");
>+        else if (kind == DeconstructToParameters) {
>             bool declarationResult = declareParameter(&name);
>             if (!declarationResult && strictMode()) {
>                 semanticFailIfTrue(m_vm->propertyNames->arguments == name || m_vm->propertyNames->eval == name, "Cannot deconstruct to a parameter name '", name.impl(), "' in strict mode");
>@@ -735,17 +744,50 @@ template <class TreeBuilder> TreeStateme
>     JSTextPosition declsEnd;
>     TreeExpression decls = 0;
>     TreeDeconstructionPattern pattern = 0;
>-    if (match(VAR)) {
>+    bool isVarDeclaraton = match(VAR);
>+    bool isLetDeclaration = match(LET);
>+
>+    IdentifierSet dummySet;
>+    IdentifierSet* lexicalVariables = nullptr;
>+    IdentifierSet* lexicalCaptures = nullptr;
>+    AutoCleanupLexicalScope lexicalScope;
>+
>+    auto gatherLexicalVariablesIfNecessary = [&] () {
>+        if (isLetDeclaration) {
>+            ScopeRef scope = lexicalScope.scope();
>+            lexicalVariables = &scope->lexicallyDeclaredVariables();
>+            lexicalCaptures = &scope->lexicallyCapturedVariables();
>+        } else {
>+            lexicalVariables = &dummySet;
>+            lexicalCaptures = &dummySet;
>+        }
>+    };
>+
>+    auto popLexicalScopeIfNecessary = [&] () -> bool {
>+        if (isLetDeclaration)
>+            return popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
>+
>+        return true;
>+    };
>+
>+    if (isVarDeclaraton || isLetDeclaration) {
>         /*
>-         for (var IDENT in expression) statement
>-         for (var varDeclarationList; expressionOpt; expressionOpt)
>+         for (var/let IDENT in expression) statement
>+         for (var/let varDeclarationList; expressionOpt; expressionOpt)
>          */
>+        if (isLetDeclaration) {
>+            ScopeRef newScope = pushScope();
>+            newScope->setIsLexicalScope();
>+            newScope->preventVarDeclarations();
>+            lexicalScope.setIsValid(newScope, this);
>+        }
>+
>         TreeDeconstructionPattern forInTarget = 0;
>         TreeExpression forInInitializer = 0;
>         m_allowsIn = false;
>         JSTextPosition initStart;
>         JSTextPosition initEnd;
>-        decls = parseVarDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext);
>+        decls = parseVariableDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext, isVarDeclaraton ? VarDeclaration : LetDeclaration);
>         m_allowsIn = true;
>         propagateError();
> 
>@@ -781,9 +823,14 @@ template <class TreeBuilder> TreeStateme
>         TreeStatement statement = parseStatement(context, unused);
>         endLoop();
>         failIfFalse(statement, "Expected statement as body of for-", isOfEnumeration ? "of" : "in", " statement");
>+        gatherLexicalVariablesIfNecessary();
>+        TreeStatement result;
>         if (isOfEnumeration)
>-            return context.createForOfLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine);
>-        return context.createForInLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine);
>+            result = context.createForOfLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+        else
>+            result = context.createForInLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+        failIfFalse(popLexicalScopeIfNecessary(), "Parser error");
>+        return result;
>     }
>     
>     if (!match(SEMICOLON)) {
>@@ -829,10 +876,13 @@ template <class TreeBuilder> TreeStateme
>         TreeStatement statement = parseStatement(context, unused);
>         endLoop();
>         failIfFalse(statement, "Expected a statement as the body of a for loop");
>-        return context.createForLoop(location, decls, condition, increment, statement, startLine, endLine);
>+        gatherLexicalVariablesIfNecessary();
>+        TreeStatement result = context.createForLoop(location, decls, condition, increment, statement, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+        failIfFalse(popLexicalScopeIfNecessary(), "Parser error");
>+        return result;
>     }
>     
>-    // For-in loop
>+    // For-in and For-of loop
> enumerationLoop:
>     failIfFalse(nonLHSCount == m_nonLHSCount, "Expected a reference on the left hand side of an enumeration statement");
>     bool isOfEnumeration = false;
>@@ -852,15 +902,24 @@ enumerationLoop:
>     TreeStatement statement = parseStatement(context, unused);
>     endLoop();
>     failIfFalse(statement, "Expected a statement as the body of a for-", isOfEnumeration ? "of" : "in", "loop");
>+    gatherLexicalVariablesIfNecessary();
>+    TreeStatement result;
>     if (pattern) {
>         ASSERT(!decls);
>         if (isOfEnumeration)
>-            return context.createForOfLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>-        return context.createForInLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>+            result = context.createForOfLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+        else 
>+            result = context.createForInLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+
>+        failIfFalse(popLexicalScopeIfNecessary(), "Parser error");
>+        return result;
>     }
>     if (isOfEnumeration)
>-        return context.createForOfLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>-    return context.createForInLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>+        result = context.createForOfLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+    else
>+        result = context.createForInLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+    failIfFalse(popLexicalScopeIfNecessary(), "Parser error");
>+    return result;
> }
> 
> template <typename LexerType>
>@@ -1085,7 +1144,7 @@ template <class TreeBuilder> TreeStateme
>         next();
>         AutoPopScopeRef catchScope(this, pushScope());
>         failIfFalseIfStrict(declareVariable(ident), "Cannot declare a catch variable named '", ident->impl(), "' in strict mode");
>-        catchScope->preventNewDecls();
>+        catchScope->preventAllVariableDeclarations(); // FIXME: Probably should just preventVarDeclarations and make catchScope a lexical scope.
>         handleProductionOrFail(CLOSEPAREN, ")", "end", "'catch' target");
>         matchOrFail(OPENBRACE, "Expected exception handler to be a block statement");
>         catchBlock = parseBlockStatement(context);
>@@ -1121,16 +1180,31 @@ template <typename LexerType>
> template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBlockStatement(TreeBuilder& context)
> {
>     ASSERT(match(OPENBRACE));
>+
>+    // This is hacky, but we should treat the first block statement of the function (the body of the function)
>+    // as the lexical scope of the function itself, and not the lexical scope of a 'block' statement within
>+    // a function.
>+    AutoCleanupLexicalScope lexicalScope;
>+    bool shouldPushLexicalScope = m_statementDepth > 0;
>+    if (shouldPushLexicalScope) {
>+        ScopeRef newScope = pushScope();
>+        newScope->setIsLexicalScope();
>+        newScope->preventVarDeclarations();
>+        lexicalScope.setIsValid(newScope, this);
>+    }
>     JSTokenLocation location(tokenLocation());
>     int startOffset = m_token.m_data.offset;
>     int start = tokenLine();
>+    IdentifierSet dummyIdentifierSet;
>     next();
>     if (match(CLOSEBRACE)) {
>         int endOffset = m_token.m_data.offset;
>         next();
>-        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line);
>+        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->lexicallyDeclaredVariables() : dummyIdentifierSet, shouldPushLexicalScope ? currentScope()->lexicallyCapturedVariables() : dummyIdentifierSet);
>         context.setStartOffset(result, startOffset);
>         context.setEndOffset(result, endOffset);
>+        if (shouldPushLexicalScope)
>+            failIfFalse(popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>         return result;
>     }
>     TreeSourceElements subtree = parseSourceElements(context, DontCheckForStrictMode);
>@@ -1138,9 +1212,12 @@ template <class TreeBuilder> TreeStateme
>     matchOrFail(CLOSEBRACE, "Expected a closing '}' at the end of a block statement");
>     int endOffset = m_token.m_data.offset;
>     next();
>-    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line);
>+    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->lexicallyDeclaredVariables() : dummyIdentifierSet, shouldPushLexicalScope ? currentScope()->lexicallyCapturedVariables() : dummyIdentifierSet);
>     context.setStartOffset(result, startOffset);
>     context.setEndOffset(result, endOffset);
>+    if (shouldPushLexicalScope)
>+        failIfFalse(popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>+
>     return result;
> }
> 
>@@ -1160,7 +1237,7 @@ template <class TreeBuilder> TreeStateme
>         shouldSetEndOffset = false;
>         break;
>     case VAR:
>-        result = parseVarDeclaration(context);
>+        result = parseVariableDeclaration(context, VarDeclaration);
>         break;
>     case CONSTTOKEN:
>         result = parseConstDeclaration(context);
>@@ -1223,6 +1300,13 @@ template <class TreeBuilder> TreeStateme
>     case DEFAULT:
>         // These tokens imply the end of a set of source elements
>         return 0;
>+    case LET:
>+        // FIXME: make sure that sloppy mode has 'let' parse as IDENT and not default.
>+        if (strictMode()) {
>+            result = parseVariableDeclaration(context, LetDeclaration);
>+            break;
>+        }
>+        FALLTHROUGH;
>     case IDENT:
>         result = parseExpressionOrLabelStatement(context);
>         break;
>@@ -1650,6 +1734,7 @@ template <class TreeBuilder> TreeStateme
>         break;
>     }
>     const Identifier* unused = 0;
>+    ScopeRef labelScope = currentScope();
>     if (!m_syntaxAlreadyValidated) {
>         for (size_t i = 0; i < labels.size(); i++)
>             pushLabel(labels[i].m_ident, isLoop);
>@@ -1657,7 +1742,7 @@ template <class TreeBuilder> TreeStateme
>     TreeStatement statement = parseStatement(context, unused);
>     if (!m_syntaxAlreadyValidated) {
>         for (size_t i = 0; i < labels.size(); i++)
>-            popLabel();
>+            popLabel(labelScope);
>     }
>     failIfFalse(statement, "Cannot parse statement");
>     for (size_t i = 0; i < labels.size(); i++) {
>@@ -2296,6 +2381,7 @@ template <class TreeBuilder> TreeExpress
>         return context.thisExpr(location, m_thisTDZMode);
>     }
>     case IDENT: {
>+    identifierExpression:
>         JSTextPosition start = tokenStartPosition();
>         const Identifier* ident = m_token.m_data.ident;
>         JSTokenLocation location(tokenLocation());
>@@ -2357,6 +2443,11 @@ template <class TreeBuilder> TreeExpress
>         }
>         return re;
>     }
>+    case LET: {
>+        if (!strictMode())
>+            goto identifierExpression;
>+        FALLTHROUGH;
>+    }
>     default:
>         failDueToUnexpectedToken();
>     }
>Index: Source/JavaScriptCore/parser/Parser.h
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/Parser.h	(working copy)
>@@ -89,6 +89,7 @@ enum FunctionParseMode {
> };
> enum DeconstructionKind {
>     DeconstructToVariables,
>+    DeconstructToLexicalVariables,
>     DeconstructToParameters,
>     DeconstructToExpressions
> };
>@@ -115,9 +116,11 @@ struct Scope {
>         , m_needsFullActivation(false)
>         , m_hasDirectSuper(false)
>         , m_needsSuperBinding(false)
>-        , m_allowsNewDecls(true)
>+        , m_allowsVarDecls(true)
>+        , m_allowsLetDecls(true)
>         , m_strictMode(strictMode)
>         , m_isFunction(isFunction)
>+        , m_isLexicalScope(false)
>         , m_isFunctionBoundary(false)
>         , m_isValidStrictMode(true)
>         , m_loopDepth(0)
>@@ -132,9 +135,11 @@ struct Scope {
>         , m_needsFullActivation(rhs.m_needsFullActivation)
>         , m_hasDirectSuper(rhs.m_hasDirectSuper)
>         , m_needsSuperBinding(rhs.m_needsSuperBinding)
>-        , m_allowsNewDecls(rhs.m_allowsNewDecls)
>+        , m_allowsVarDecls(rhs.m_allowsVarDecls)
>+        , m_allowsLetDecls(rhs.m_allowsLetDecls)
>         , m_strictMode(rhs.m_strictMode)
>         , m_isFunction(rhs.m_isFunction)
>+        , m_isLexicalScope(rhs.m_isLexicalScope)
>         , m_isFunctionBoundary(rhs.m_isFunctionBoundary)
>         , m_isValidStrictMode(rhs.m_isValidStrictMode)
>         , m_loopDepth(rhs.m_loopDepth)
>@@ -187,9 +192,38 @@ struct Scope {
>     {
>         m_isFunction = true;
>         m_isFunctionBoundary = true;
>+        setIsLexicalScope();
>+    }
>+    bool isFunction() const { return m_isFunction; }
>+    bool isFunctionBoundary() const { return m_isFunctionBoundary; }
>+
>+    void setIsLexicalScope() { m_isLexicalScope = true; }
>+    bool isLexicalScope() { return m_isLexicalScope; }
>+    IdentifierSet& lexicallyDeclaredVariables() { return m_lexicallyDeclaredVariables; }
>+    IdentifierSet& lexicallyCapturedVariables()
>+    {
>+        if (m_usesEval) {
>+            m_lexicalCaptures = m_lexicallyDeclaredVariables;
>+            return m_lexicalCaptures; 
>+        }
>+
>+        IdentifierSet::iterator end = m_lexicallyDeclaredVariables.end();
>+        for (IdentifierSet::iterator ptr = m_lexicallyDeclaredVariables.begin(); ptr != end; ++ptr) {
>+            if (m_closedVariables.contains(*ptr))
>+                m_lexicalCaptures.add(*ptr);
>+        }
>+
>+        return m_lexicalCaptures;
>+    }
>+
>+    void dumpLexicalVariables()
>+    {
>+        IdentifierSet lexicalCaptures = lexicallyCapturedVariables();
>+        IdentifierSet::iterator end = m_lexicallyDeclaredVariables.end();
>+        for (IdentifierSet::iterator ptr = m_lexicallyDeclaredVariables.begin(); ptr != end; ++ptr) {
>+            printf("lexical variable: '%s' is captured: %d\n", String(*ptr).ascii().data(), lexicalCaptures.contains(*ptr));
>+        }
>     }
>-    bool isFunction() { return m_isFunction; }
>-    bool isFunctionBoundary() { return m_isFunctionBoundary; }
> 
>     void declareCallee(const Identifier* ident)
>     {
>@@ -204,6 +238,14 @@ struct Scope {
>         return isValidStrictMode;
>     }
> 
>+    bool declareLexicalVariable(const Identifier* ident)
>+    {
>+        bool isValidStrictMode = m_vm->propertyNames->eval != *ident && m_vm->propertyNames->arguments != *ident;
>+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
>+        m_lexicallyDeclaredVariables.add(ident->string().impl());
>+        return isValidStrictMode;
>+    }
>+
>     bool hasDeclaredVariable(const Identifier& ident)
>     {
>         return m_declaredVariables.contains(ident.impl());
>@@ -220,8 +262,14 @@ struct Scope {
>         m_writtenVariables.add(ident->impl());
>     }
> 
>-    void preventNewDecls() { m_allowsNewDecls = false; }
>-    bool allowsNewDecls() const { return m_allowsNewDecls; }
>+    void preventAllVariableDeclarations()
>+    {
>+        m_allowsVarDecls = false; 
>+        m_allowsLetDecls = false;
>+    }
>+    void preventVarDeclarations() { m_allowsVarDecls = false; }
>+    bool allowsNewDecls() const { return m_allowsVarDecls; }
>+    bool allowsLexicalDeclarations() const { return m_allowsLetDecls; }
> 
>     bool declareParameter(const Identifier* ident)
>     {
>@@ -266,6 +314,7 @@ struct Scope {
>     }
> 
>     void setNeedsFullActivation() { m_needsFullActivation = true; }
>+    bool needsFullActivation() const { return m_needsFullActivation; }
> 
> #if ENABLE(ES6_CLASS_SYNTAX)
>     bool hasDirectSuper() { return m_hasDirectSuper; }
>@@ -287,16 +336,29 @@ struct Scope {
>             m_usesEval = true;
>         IdentifierSet::iterator end = nestedScope->m_usedVariables.end();
>         for (IdentifierSet::iterator ptr = nestedScope->m_usedVariables.begin(); ptr != end; ++ptr) {
>-            if (nestedScope->m_declaredVariables.contains(*ptr))
>+            if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                 continue;
>             m_usedVariables.add(*ptr);
>-            if (shouldTrackClosedVariables)
>+            // FIXME: This isn't so intuitive and we should have better names here. Basically, we don't
>+            // want a declared variable that is used in an inner scope to be thought of as captured if
>+            // that inner scope is both a lexical scope and not a function. Only inner functions
>+            // can capture variables.
>+            if (shouldTrackClosedVariables && (nestedScope->m_isFunctionBoundary || !nestedScope->m_isLexicalScope))
>+                m_closedVariables.add(*ptr);
>+        }
>+
>+        if (nestedScope->m_isLexicalScope && !nestedScope->m_isFunctionBoundary) {
>+            // Propagate closed variables downwards from nested block scopes within the same function/global code.
>+            IdentifierSet::iterator end = nestedScope->m_closedVariables.end();
>+            for (IdentifierSet::iterator ptr = nestedScope->m_closedVariables.begin(); ptr != end; ++ptr)
>                 m_closedVariables.add(*ptr);
>         }
>+
>         if (nestedScope->m_writtenVariables.size()) {
>             IdentifierSet::iterator end = nestedScope->m_writtenVariables.end();
>             for (IdentifierSet::iterator ptr = nestedScope->m_writtenVariables.begin(); ptr != end; ++ptr) {
>-                if (nestedScope->m_declaredVariables.contains(*ptr))
>+                // FIXME: make sure this is correct here.
>+                if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                     continue;
>                 m_writtenVariables.add(*ptr);
>             }
>@@ -376,9 +438,11 @@ private:
>     bool m_needsFullActivation : 1;
>     bool m_hasDirectSuper : 1;
>     bool m_needsSuperBinding : 1;
>-    bool m_allowsNewDecls : 1;
>+    bool m_allowsVarDecls : 1;
>+    bool m_allowsLetDecls : 1;
>     bool m_strictMode : 1;
>     bool m_isFunction : 1;
>+    bool m_isLexicalScope : 1;
>     bool m_isFunctionBoundary : 1;
>     bool m_isValidStrictMode : 1;
>     int m_loopDepth;
>@@ -388,8 +452,10 @@ private:
>     std::unique_ptr<LabelStack> m_labels;
>     IdentifierSet m_declaredParameters;
>     IdentifierSet m_declaredVariables;
>+    IdentifierSet m_lexicallyDeclaredVariables;
>     IdentifierSet m_usedVariables;
>     IdentifierSet m_closedVariables;
>+    IdentifierSet m_lexicalCaptures;
>     IdentifierSet m_writtenVariables;
> };
> 
>@@ -437,6 +503,7 @@ public:
> 
>     JSTextPosition positionBeforeLastNewline() const { return m_lexer->positionBeforeLastNewline(); }
>     Vector<RefPtr<StringImpl>>&& closedVariables() { return WTF::move(m_closedVariables); }
>+    enum DeclarationType { VarDeclaration, LetDeclaration };
> 
> private:
>     struct AllowInOverride {
>@@ -476,6 +543,47 @@ private:
>         Parser* m_parser;
>     };
> 
>+    struct AutoCleanupLexicalScope {
>+        // We can allocate this object on the stack without actually knowing beforehand
>+        // if we're going to create a new scope. If we decide to create a new scope, we
>+        // can pass the scope into this obejct and it will take care of the cleanup for us.
>+        // This is helpful if we may fail from syntax errors after creating a scope conditionally.
>+        AutoCleanupLexicalScope()
>+            : m_scope(nullptr, UINT_MAX)
>+            , m_parser(nullptr)
>+        {
>+        }
>+
>+        ~AutoCleanupLexicalScope()
>+        {
>+            // This should only ever be called if we fail from a syntax error. Otherwise
>+            // it's the intention that a user of this interface pops this scope manually 
>+            // on a successful parse. 
>+            if (m_parser)
>+                m_parser->popScope(*this, false);
>+        }
>+
>+        void setIsValid(ScopeRef& scope, Parser* parser)
>+        {
>+            RELEASE_ASSERT(scope->isLexicalScope());
>+            m_scope = scope;
>+            m_parser = parser;
>+        }
>+
>+        bool isValid() const { return !!m_parser; }
>+
>+        void setPopped()
>+        {
>+            m_parser = nullptr;
>+        }
>+
>+        ScopeRef& scope() { return m_scope; }
>+
>+    private:
>+        ScopeRef m_scope;
>+        Parser* m_parser;
>+    };
>+
>     ScopeRef currentScope()
>     {
>         return ScopeRef(&m_scopeStack, m_scopeStack.size() - 1);
>@@ -498,6 +606,8 @@ private:
>         ASSERT_UNUSED(scope, scope.index() == m_scopeStack.size() - 1);
>         ASSERT(m_scopeStack.size() > 1);
>         bool result = m_scopeStack[m_scopeStack.size() - 2].collectFreeVariables(&m_scopeStack.last(), shouldTrackClosedVariables);
>+        if (!m_scopeStack.last().isFunctionBoundary() && m_scopeStack.last().needsFullActivation())
>+            m_scopeStack[m_scopeStack.size() - 2].setNeedsFullActivation();
>         m_scopeStack.removeLast();
>         return result;
>     }
>@@ -512,20 +622,42 @@ private:
>         scope.setPopped();
>         return popScopeInternal(scope, shouldTrackClosedVariables);
>     }
>+
>+    bool popScope(AutoCleanupLexicalScope& cleanupScope, bool shouldTrackClosedVariables)
>+    {
>+        RELEASE_ASSERT(cleanupScope.isValid());
>+        ScopeRef& scope = cleanupScope.scope();
>+        cleanupScope.setPopped();
>+        bool result = popScopeInternal(scope, shouldTrackClosedVariables);
>+        return result;
>+    }
>     
>-    bool declareVariable(const Identifier* ident)
>+    bool declareVariable(const Identifier* ident, Parser::DeclarationType type = VarDeclaration)
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+
>+        if (type == VarDeclaration) {
>+            while (!m_scopeStack[i].allowsNewDecls()) {
>+                i--;
>+                ASSERT(i < m_scopeStack.size());
>+            }
>+
>+            return m_scopeStack[i].declareVariable(ident);
>+        }
>+
>+        ASSERT(type == LetDeclaration);
>+        while (!m_scopeStack[i].allowsLexicalDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>-        return m_scopeStack[i].declareVariable(ident);
>+
>+        return m_scopeStack[i].declareLexicalVariable(ident);
>     }
>     
>     NEVER_INLINE bool hasDeclaredVariable(const Identifier& ident)
>     {
>+        // FIXME: make work with lexical scoping.
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>         while (!m_scopeStack[i].allowsNewDecls()) {
>@@ -709,7 +841,7 @@ private:
>         return true;
>     }
>     void pushLabel(const Identifier* label, bool isLoop) { currentScope()->pushLabel(label, isLoop); }
>-    void popLabel() { currentScope()->popLabel(); }
>+    void popLabel(ScopeRef scope) { scope->popLabel(); }
>     ScopeLabelInfo* getLabel(const Identifier* label)
>     {
>         ScopeRef current = currentScope();
>@@ -728,7 +860,7 @@ private:
>     template <class TreeBuilder> TreeStatement parseClassDeclaration(TreeBuilder&);
> #endif
>     template <class TreeBuilder> TreeStatement parseFunctionDeclaration(TreeBuilder&);
>-    template <class TreeBuilder> TreeStatement parseVarDeclaration(TreeBuilder&);
>+    template <class TreeBuilder> TreeStatement parseVariableDeclaration(TreeBuilder&, DeclarationType);
>     template <class TreeBuilder> TreeStatement parseConstDeclaration(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseDoWhileStatement(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseWhileStatement(TreeBuilder&);
>@@ -765,7 +897,7 @@ private:
>     template <class TreeBuilder> ALWAYS_INLINE TreeFunctionBody parseFunctionBody(TreeBuilder&, int functionKeywordStart, int functionNameStart, int parametersStart, ConstructorKind);
>     template <class TreeBuilder> ALWAYS_INLINE TreeFormalParameterList parseFormalParameters(TreeBuilder&);
>     enum VarDeclarationListContext { ForLoopContext, VarDeclarationContext };
>-    template <class TreeBuilder> TreeExpression parseVarDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext);
>+    template <class TreeBuilder> TreeExpression parseVariableDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext, DeclarationType);
>     template <class TreeBuilder> NEVER_INLINE TreeConstDeclList parseConstDeclarationList(TreeBuilder&);
> 
>     template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern createBindingPattern(TreeBuilder&, DeconstructionKind, const Identifier&, int depth, JSToken);
>@@ -851,9 +983,7 @@ private:
>         m_assignmentCount = state.assignmentCount;
>         m_nonLHSCount = state.nonLHSCount;
>         m_nonTrivialExpressionCount = state.nonTrivialExpressionCount;
>-        
>     }
>-    
> 
>     VM* m_vm;
>     const SourceCode* m_source;
>@@ -952,6 +1082,8 @@ std::unique_ptr<ParsedNode> Parser<Lexer
>                                     m_varDeclarations,
>                                     m_funcDeclarations,
>                                     m_capturedVariables,
>+                                    currentScope()->lexicallyDeclaredVariables(),
>+                                    currentScope()->lexicallyCapturedVariables(),
>                                     *m_source,
>                                     m_features,
>                                     m_numConstants);
>Index: Source/JavaScriptCore/parser/ParserTokens.h
>===================================================================
>--- Source/JavaScriptCore/parser/ParserTokens.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/ParserTokens.h	(working copy)
>@@ -57,6 +57,7 @@ enum JSTokenType {
>     FOR,
>     NEW,
>     VAR,
>+    LET,
>     CONSTTOKEN,
>     CONTINUE,
>     FUNCTION,
>Index: Source/JavaScriptCore/parser/SyntaxChecker.h
>===================================================================
>--- Source/JavaScriptCore/parser/SyntaxChecker.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/SyntaxChecker.h	(working copy)
>@@ -163,8 +163,8 @@ public:
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int, int, int) { return NewExpr; }
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int) { return NewExpr; }
>     ExpressionType createConditionalExpr(const JSTokenLocation&, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
>-    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int) { return AssignmentExpr; }
>-    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&) { return AssignmentExpr; }
>+    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int, bool) { return AssignmentExpr; }
>+    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&, bool) { return AssignmentExpr; }
> #if ENABLE(ES6_CLASS_SYNTAX)
>     ClassExpression createClassExpr(const JSTokenLocation&, const Identifier&, ExpressionType, ExpressionType, PropertyList, PropertyList) { return ClassExpr; }
> #endif
>@@ -206,15 +206,16 @@ public:
>     int createClassDeclStatement(const JSTokenLocation&, ClassExpression,
>         const JSTextPosition&, const JSTextPosition&, int, int) { return StatementResult; }
> #endif
>-    int createBlockStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createBlockStatement(const JSTokenLocation&, int, int, int, IdentifierSet&, IdentifierSet&) { return StatementResult; }
>     int createExprStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int, int) { return StatementResult; }
>-    int createForLoop(const JSTokenLocation&, int, int, int, int, int, int) { return StatementResult; }
>-    int createForInLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>-    int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>+    int createForLoop(const JSTokenLocation&, int, int, int, int, int, int, IdentifierSet&, IdentifierSet&) { return StatementResult; }
>+    int createForInLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int, IdentifierSet&, IdentifierSet&) { return StatementResult; }
>+    int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int, IdentifierSet& , IdentifierSet&) { return StatementResult; }
>     int createEmptyStatement(const JSTokenLocation&) { return StatementResult; }
>     int createVarStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createLetStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createReturnStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
>Index: Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(working copy)
>@@ -65,6 +65,12 @@ public:
>         SymbolTable* symbolTable = codeBlock->symbolTable();
>         return create(vm, structure, currentScope, symbolTable);
>     }
>+
>+    static JSLexicalEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable)
>+    {
>+        Structure* structure = globalObject->activationStructure();
>+        return create(vm, structure, currentScope, symbolTable);
>+    }
>         
>     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
>     static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
>Index: Source/JavaScriptCore/runtime/JSScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.cpp	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSScope.cpp	(working copy)
>@@ -170,14 +170,14 @@ JSValue JSScope::resolve(ExecState* exec
>     }
> }
> 
>-ResolveOp JSScope::abstractResolve(ExecState* exec, bool hasTopActivation, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
>+ResolveOp JSScope::abstractResolve(ExecState* exec, unsigned depthOffset, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
> {
>     ResolveOp op(Dynamic, 0, 0, 0, 0, 0);
>     if (unlinkedType == Dynamic)
>         return op;
> 
>-    size_t depth = hasTopActivation ? 1 : 0;
>     bool needsVarInjectionChecks = JSC::needsVarInjectionChecks(unlinkedType);
>+    size_t depth = depthOffset;
>     for (; scope; scope = scope->next()) {
>         if (abstractAccess(exec, scope, ident, getOrPut, depth, needsVarInjectionChecks, op))
>             break;
>Index: Source/JavaScriptCore/runtime/JSScope.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.h	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSScope.h	(working copy)
>@@ -157,7 +157,7 @@ public:
>     static JSObject* objectAtScope(JSScope*);
> 
>     static JSValue resolve(ExecState*, JSScope*, const Identifier&);
>-    static ResolveOp abstractResolve(ExecState*, bool hasTopActivation, JSScope*, const Identifier&, GetOrPut, ResolveType);
>+    static ResolveOp abstractResolve(ExecState*, unsigned depthOffset, JSScope*, const Identifier&, GetOrPut, ResolveType);
> 
>     static void visitChildren(JSCell*, SlotVisitor&);
>

Actions: View | Formatted Diff | Diff

Attachments on bug 142944: 249945 | 249961 | 250169 | 250230 | 250533 | 250684 | 250714 | 250715 | 251081 | 251130 | 251133 | 251136 | 251409 | 251653 | 251913 | 252074 | 253066 | 253070 | 253115 | 253794 | 255536 | 255614 | 255622 | 255804 | 255806 | 255807 | 255830 | 255834 | 255835 | 255871 | 256033 | 256036 | 256226 | 256232 | 256233 | 256257 | 256264 | 256267 | 256433 | 256438 | 256445 | 256450 | 256465 | 256481 | 256658 | 256860