Attachment 251081 Details for Bug 142944 – WIP

[patch] WIP

ternary-backup.diff (text/plain), 158.25 KB, created by Saam Barati on 2015-04-17 21:24:37 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2015-04-17 21:24:37 PDT

Size: 158.25 KB

patch

obsolete

>Index: Source/JavaScriptCore/builtins/BuiltinExecutables.cpp
>===================================================================
>--- Source/JavaScriptCore/builtins/BuiltinExecutables.cpp	(revision 182773)
>+++ Source/JavaScriptCore/builtins/BuiltinExecutables.cpp	(working copy)
>@@ -104,7 +104,8 @@ UnlinkedFunctionExecutable* BuiltinExecu
>         RELEASE_ASSERT(m_vm.propertyNames->isPrivateName(closedVariable.get()));
>     }
>     body->overrideName(name);
>-    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&m_vm, source, body, kind, WTF::move(sourceOverride));
>+    IdentifierSet dummyTDZVariables;
>+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&m_vm, source, body, kind, dummyTDZVariables, WTF::move(sourceOverride));
>     functionExecutable->m_nameValue.set(m_vm, functionExecutable, jsString(&m_vm, name.string()));
>     return functionExecutable;
> }
>Index: Source/JavaScriptCore/bytecode/BytecodeList.json
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeList.json	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/BytecodeList.json	(working copy)
>@@ -110,6 +110,8 @@
>             { "name" : "op_push_with_scope", "length" : 3 },
>             { "name" : "op_pop_scope", "length" : 2 },
>             { "name" : "op_push_name_scope", "length" : 5 },
>+            { "name" : "op_push_lexical_scope", "length" : 4 },
>+            { "name" : "op_pop_lexical_scope", "length" : 2 },
>             { "name" : "op_catch", "length" : 2 },
>             { "name" : "op_throw", "length" : 2 },
>             { "name" : "op_throw_static_error", "length" : 3 },
>Index: Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(working copy)
>@@ -58,6 +58,7 @@ void computeUsesForBytecodeOffset(
>     case op_to_this:
>     case op_check_tdz:
>     case op_pop_scope:
>+    case op_pop_lexical_scope:
>     case op_profile_will_call:
>     case op_profile_did_call:
>     case op_profile_type:
>@@ -120,6 +121,7 @@ void computeUsesForBytecodeOffset(
>     case op_init_global_const:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_get_from_scope:
>     case op_to_primitive:
>@@ -293,8 +295,10 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_enumerator_structure_pname:
>     case op_enumerator_generic_pname:
>     case op_pop_scope:
>+    case op_pop_lexical_scope:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_strcat:
>     case op_to_primitive:
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -1447,6 +1447,11 @@ void CodeBlock::dumpBytecode(
>             printLocationOpAndRegisterOperand(out, exec, location, it, "pop_scope", r0);
>             break;
>         }
>+        case op_pop_lexical_scope: {
>+            int r0 = (++it)->u.operand;
>+            printLocationOpAndRegisterOperand(out, exec, location, it, "pop_lexical_scope", r0);
>+            break;
>+        }
>         case op_push_name_scope: {
>             int dst = (++it)->u.operand;
>             int r1 = (++it)->u.operand;
>@@ -1456,6 +1461,14 @@ void CodeBlock::dumpBytecode(
>             out.printf("%s, %s, %s, %s", registerName(dst).data(), registerName(r1).data(), constantName(k0).data(), (scopeType == JSNameScope::FunctionNameScope) ? "functionScope" : ((scopeType == JSNameScope::CatchScope) ? "catchScope" : "unknownScopeType"));
>             break;
>         }
>+        case op_push_lexical_scope: {
>+            int dst = (++it)->u.operand;
>+            int scope = (++it)->u.operand;
>+            int symbolTable = (++it)->u.operand;
>+            printLocationAndOp(out, exec, location, it, "push_lexical_scope");
>+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(scope).data(), registerName(symbolTable).data());
>+            break;
>+        }
>         case op_catch: {
>             int r0 = (++it)->u.operand;
>             printLocationOpAndRegisterOperand(out, exec, location, it, "catch", r0);
>@@ -1840,6 +1853,9 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>     UnlinkedInstructionStream::Reader instructionReader(unlinkedCodeBlock->instructions());
> 
>     Vector<Instruction, 0, UnsafeVectorOverflow> instructions(instructionCount);
>+
>+    Vector<SymbolTable*> symbolTableStack;
>+
>     for (unsigned i = 0; !instructionReader.atEnd(); ) {
>         const UnlinkedInstruction* pc = instructionReader.next();
> 
>@@ -1944,12 +1960,38 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             break;
>         }
> 
>+        case op_push_lexical_scope: {
>+            SymbolTable* unlinkedTable = jsCast<SymbolTable*>(getConstant(pc[3].u.operand));
>+            RELEASE_ASSERT(unlinkedTable->scopeSize());
>+            SymbolTable* linkedTable = unlinkedTable->cloneScopePart(*m_vm);
>+            {
>+                ConcurrentJITLocker locker(linkedTable->m_lock);
>+                for (auto iter = linkedTable->begin(locker), end = linkedTable->end(locker); iter != end; ++iter)
>+                    iter->value.disableWatching();
>+            }
>+            m_constantRegisters[pc[3].u.operand - FirstConstantRegisterIndex].set(m_globalObject->vm(), m_ownerExecutable.get(), linkedTable);
>+            symbolTableStack.append(linkedTable);
>+            break;
>+        }
>+
>+        case op_create_lexical_environment: {
>+            if (symbolTable()->scopeSize())
>+                RELEASE_ASSERT(didCloneSymbolTable);
>+            symbolTableStack.append(symbolTable());
>+            break;
>+        }
>+
>+        case op_pop_lexical_scope: {
>+            symbolTableStack.removeLast();
>+            break;
>+        }
>+
>         case op_resolve_scope: {
>             const Identifier& ident = identifier(pc[3].u.operand);
>             ResolveType type = static_cast<ResolveType>(pc[4].u.operand);
>             RELEASE_ASSERT(type != LocalClosureVar);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, type);
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, type);
>             instructions[i + 4].u.operand = op.type;
>             instructions[i + 5].u.operand = op.depth;
>             if (op.lexicalEnvironment)
>@@ -1973,7 +2015,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[3].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -1981,6 +2023,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             else if (op.structure)
>                 instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
>             instructions[i + 6].u.pointer = reinterpret_cast<void*>(op.operand);
>+
>             break;
>         }
> 
>@@ -1990,14 +2033,21 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             if (modeAndType.type() == LocalClosureVar) {
>                 // Only do watching if the property we're putting to is not anonymous.
>                 if (static_cast<unsigned>(pc[2].u.operand) != UINT_MAX) {
>-                    RELEASE_ASSERT(didCloneSymbolTable);
>                     const Identifier& ident = identifier(pc[2].u.operand);
>                     StringImpl* uid = ident.impl();
>-                    ConcurrentJITLocker locker(m_symbolTable->m_lock);
>-                    SymbolTable::Map::iterator iter = m_symbolTable->find(locker, uid);
>-                    ASSERT(iter != m_symbolTable->end(locker));
>-                    iter->value.prepareToWatch();
>-                    instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                    bool found = false;
>+                    for (unsigned stackIdx = symbolTableStack.size(); stackIdx--; ) {
>+                        SymbolTable* symbolTable = symbolTableStack[stackIdx];
>+                        ConcurrentJITLocker locker(symbolTable->m_lock);
>+                        SymbolTable::Map::iterator iter = symbolTable->find(locker, uid);
>+                        if (iter != symbolTable->end(locker)) {
>+                            iter->value.prepareToWatch();
>+                            instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                            found = true;
>+                            break;
>+                        }
>+                    }
>+                    RELEASE_ASSERT(found);
>                 } else
>                     instructions[i + 5].u.watchpointSet = nullptr;
>                 break;
>@@ -2005,7 +2055,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[2].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Put, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Put, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -2037,7 +2087,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             case ProfileTypeBytecodeGetFromScope: {
>                 const Identifier& ident = identifier(pc[4].u.operand);
>                 ResolveType type = static_cast<ResolveType>(pc[5].u.operand);
>-                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
>+                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
> 
>                 // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
>                 // https://bugs.webkit.org/show_bug.cgi?id=135184
>Index: Source/JavaScriptCore/bytecode/EvalCodeCache.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/EvalCodeCache.h	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/EvalCodeCache.h	(working copy)
>@@ -52,7 +52,9 @@ namespace JSC {
>         
>         EvalExecutable* getSlow(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, ThisTDZMode thisTDZMode, const String& evalSource, JSScope* scope)
>         {
>-            EvalExecutable* evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext, thisTDZMode);
>+            IdentifierSet variablesUnderTDZ;
>+            JSScope::collectVariablesUnderTDZ(scope, variablesUnderTDZ);
>+            EvalExecutable* evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext, thisTDZMode, &variablesUnderTDZ);
>             if (!evalExecutable)
>                 return 0;
> 
>Index: Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp	(working copy)
>@@ -42,7 +42,7 @@
> 
> namespace JSC {
> 
>-static_assert(sizeof(UnlinkedFunctionExecutable) <= 128, "UnlinkedFunctionExecutable should fit in a 128-byte cell.");
>+static_assert(sizeof(UnlinkedFunctionExecutable) <= 256, "UnlinkedFunctionExecutable should fit in a 256-byte cell.");
> 
> const ClassInfo UnlinkedFunctionExecutable::s_info = { "UnlinkedFunctionExecutable", 0, 0, CREATE_METHOD_TABLE(UnlinkedFunctionExecutable) };
> const ClassInfo UnlinkedCodeBlock::s_info = { "UnlinkedCodeBlock", 0, 0, CREATE_METHOD_TABLE(UnlinkedCodeBlock) };
>@@ -72,7 +72,7 @@ static UnlinkedFunctionCodeBlock* genera
>     
>     UnlinkedFunctionCodeBlock* result = UnlinkedFunctionCodeBlock::create(&vm, FunctionCode,
>         ExecutableInfo(function->needsActivation(), function->usesEval(), function->isStrictMode(), kind == CodeForConstruct, functionKind == UnlinkedBuiltinFunction, executable->constructorKind()));
>-    auto generator(std::make_unique<BytecodeGenerator>(vm, function.get(), result, debuggerMode, profilerMode));
>+    auto generator(std::make_unique<BytecodeGenerator>(vm, function.get(), result, debuggerMode, profilerMode, executable->parentScopeTDZVariables()));
>     error = generator->generate();
>     if (error.isValid())
>         return nullptr;
>@@ -89,7 +89,7 @@ unsigned UnlinkedCodeBlock::addOrFindCon
>     return addConstant(v);
> }
> 
>-UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM* vm, Structure* structure, const SourceCode& source, RefPtr<SourceProvider>&& sourceOverride, FunctionBodyNode* node, UnlinkedFunctionKind kind)
>+UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM* vm, Structure* structure, const SourceCode& source, RefPtr<SourceProvider>&& sourceOverride, FunctionBodyNode* node, UnlinkedFunctionKind kind, IdentifierSet& parentScopeTDZVariables)
>     : Base(*vm, structure)
>     , m_name(node->ident())
>     , m_inferredName(node->inferredName())
>@@ -113,6 +113,7 @@ UnlinkedFunctionExecutable::UnlinkedFunc
>     , m_functionMode(node->functionMode())
> {
>     ASSERT(m_constructorKind == static_cast<unsigned>(node->constructorKind()));
>+    m_parentScopeTDZVariables.swap(parentScopeTDZVariables);
> }
> 
> size_t UnlinkedFunctionExecutable::parameterCount() const
>Index: Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h	(revision 182773)
>+++ Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h	(working copy)
>@@ -106,10 +106,10 @@ public:
>     typedef JSCell Base;
>     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
> 
>-    static UnlinkedFunctionExecutable* create(VM* vm, const SourceCode& source, FunctionBodyNode* node, UnlinkedFunctionKind unlinkedFunctionKind, RefPtr<SourceProvider>&& sourceOverride = nullptr)
>+    static UnlinkedFunctionExecutable* create(VM* vm, const SourceCode& source, FunctionBodyNode* node, UnlinkedFunctionKind unlinkedFunctionKind, IdentifierSet& parentScopeTDZVariables, RefPtr<SourceProvider>&& sourceOverride = nullptr)
>     {
>         UnlinkedFunctionExecutable* instance = new (NotNull, allocateCell<UnlinkedFunctionExecutable>(vm->heap))
>-            UnlinkedFunctionExecutable(vm, vm->unlinkedFunctionExecutableStructure.get(), source, WTF::move(sourceOverride), node, unlinkedFunctionKind);
>+            UnlinkedFunctionExecutable(vm, vm->unlinkedFunctionExecutableStructure.get(), source, WTF::move(sourceOverride), node, unlinkedFunctionKind, parentScopeTDZVariables);
>         instance->finishCreation(*vm);
>         return instance;
>     }
>@@ -169,9 +169,10 @@ public:
> 
>     bool isBuiltinFunction() const { return m_isBuiltinFunction; }
>     bool isClassConstructorFunction() const { return constructorKind() != ConstructorKind::None; }
>+    const IdentifierSet* parentScopeTDZVariables() const { return &m_parentScopeTDZVariables; }
> 
> private:
>-    UnlinkedFunctionExecutable(VM*, Structure*, const SourceCode&, RefPtr<SourceProvider>&& sourceOverride, FunctionBodyNode*, UnlinkedFunctionKind);
>+    UnlinkedFunctionExecutable(VM*, Structure*, const SourceCode&, RefPtr<SourceProvider>&& sourceOverride, FunctionBodyNode*, UnlinkedFunctionKind, IdentifierSet&);
>     WriteBarrier<UnlinkedFunctionCodeBlock> m_codeBlockForCall;
>     WriteBarrier<UnlinkedFunctionCodeBlock> m_codeBlockForConstruct;
> 
>@@ -182,6 +183,7 @@ private:
>     WriteBarrier<SymbolTable> m_symbolTableForConstruct;
>     RefPtr<FunctionParameters> m_parameters;
>     RefPtr<SourceProvider> m_sourceOverride;
>+    IdentifierSet m_parentScopeTDZVariables;
>     unsigned m_firstLineOffset;
>     unsigned m_lineCount;
>     unsigned m_unlinkedFunctionNameStart;
>@@ -564,6 +566,8 @@ private:
> 
>     Vector<unsigned> m_propertyAccessInstructions;
> 
>+    HashMap<unsigned, IdentifierSet, WTF::IntHash<int>, WTF::UnsignedWithZeroKeyHashTraits<int>> m_evalOffsetToParentTDZVariables;
>+
> #if ENABLE(BYTECODE_COMMENTS)
>     Vector<Comment>  m_bytecodeComments;
>     size_t m_bytecodeCommentIterator;
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 182773)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
>@@ -75,6 +75,8 @@ ParserError BytecodeGenerator::generate(
>         entry.second->bindValue(*this, entry.first.get());
>     }
> 
>+    pushLexicalScope(m_scopeNode->lexicalVariables(), m_scopeNode->lexicalCaptures());
>+
>     {
>         RefPtr<RegisterID> temp = newTemporary();
>         for (FunctionBodyNode* functionBody : m_functionsToInitialize) {
>@@ -140,7 +142,7 @@ ParserError BytecodeGenerator::generate(
>     return ParserError(ParserError::ErrorNone);
> }
> 
>-BytecodeGenerator::BytecodeGenerator(VM& vm, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>+BytecodeGenerator::BytecodeGenerator(VM& vm, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode, const IdentifierSet* parentScopeTDZVariables)
>     : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
>     , m_shouldEmitProfileHooks(Options::forceProfilerBytecodeGeneration() || profilerMode == ProfilerOn)
>     , m_scopeNode(programNode)
>@@ -149,6 +151,8 @@ BytecodeGenerator::BytecodeGenerator(VM&
>     , m_codeType(GlobalCode)
>     , m_vm(&vm)
> {
>+    ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables->size());
>+
>     m_codeBlock->setNumParameters(1); // Allocate space for "this"
> 
>     emitOpcode(op_enter);
>@@ -169,7 +173,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
> 
> }
> 
>-BytecodeGenerator::BytecodeGenerator(VM& vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>+BytecodeGenerator::BytecodeGenerator(VM& vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode, const IdentifierSet* parentScopeTDZVariables)
>     : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
>     , m_shouldEmitProfileHooks(Options::forceProfilerBytecodeGeneration() || profilerMode == ProfilerOn)
>     , m_symbolTable(codeBlock->symbolTable())
>@@ -482,9 +486,14 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         instructions().append(0);
>         instructions().append(0);
>     }
>+
>+    // FIXME: make a way for this symbol table to be the same as the lexical symbol table for
>+    // lexical variables defined at the base level of functions.
>+    m_symbolTableStack.append(SymbolTableStackEntry(m_symbolTable, m_lexicalEnvironmentRegister));
>+    m_TDZStack.append(parentScopeTDZVariables);
> }
> 
>-BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>+BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode, const IdentifierSet* parentScopeTDZVariables)
>     : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
>     , m_shouldEmitProfileHooks(Options::forceProfilerBytecodeGeneration() || profilerMode == ProfilerOn)
>     , m_symbolTable(codeBlock->symbolTable())
>@@ -514,6 +523,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         variables.append(varStack[i].first);
>     }
>     codeBlock->adoptVariables(variables);
>+    m_TDZStack.append(parentScopeTDZVariables);
> }
> 
> BytecodeGenerator::~BytecodeGenerator()
>@@ -548,12 +558,23 @@ RegisterID* BytecodeGenerator::newRegist
>     return &m_calleeRegisters.last();
> }
> 
>-RegisterID* BytecodeGenerator::newTemporary()
>+void BytecodeGenerator::reclaimFreeRegisters()
> {
>-    // Reclaim free register IDs.
>     while (m_calleeRegisters.size() && !m_calleeRegisters.last().refCount())
>         m_calleeRegisters.removeLast();
>-        
>+}
>+
>+RegisterID* BytecodeGenerator::newLexicalVariable()
>+{
>+    reclaimFreeRegisters();
>+
>+    return newRegister();
>+}
>+
>+RegisterID* BytecodeGenerator::newTemporary()
>+{
>+    reclaimFreeRegisters();
>+
>     RegisterID* result = newRegister();
>     result->setTemporary();
>     return result;
>@@ -1185,6 +1206,175 @@ RegisterID* BytecodeGenerator::emitLoadG
>     return m_globalObjectRegister;
> }
> 
>+const Identifier* BytecodeGenerator::makeIdentifier(StringImpl* impl)
>+{
>+    if (impl->is8Bit())
>+        return &parserArena().identifierArena().makeIdentifier(m_vm, impl->characters8(), impl->length());
>+    else
>+        return &parserArena().identifierArena().makeIdentifier(m_vm, impl->characters16(), impl->length());
>+}
>+
>+void BytecodeGenerator::pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTable* symbolTable = SymbolTable::create(*m_vm);
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto ident : vars) {
>+            SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+            if (!entry.isNull()) // FIXME: consider what to do here.
>+                continue;
>+
>+            VarKind varKind = capturedVars.contains(ident) ? VarKind::Scope : VarKind::Stack;
>+            VarOffset varOffset;
>+            if (varKind == VarKind::Scope)
>+                varOffset = VarOffset(symbolTable->takeNextScopeOffset(locker));
>+            else {
>+                ASSERT(varKind == VarKind::Stack);
>+                RegisterID* local = newLexicalVariable();
>+                local->ref();
>+                varOffset = VarOffset(local->virtualRegister());
>+            }
>+            // FIXME: need to make this work with 'const' variables.
>+            SymbolTableEntry newEntry(varOffset, 0, true);
>+            symbolTable->add(locker, ident.get(), newEntry);
>+        }
>+    }
>+    
>+    RegisterID* newScope = nullptr;
>+    if (capturedVars.size()) {
>+        newScope = newLexicalVariable();
>+        newScope->ref();
>+
>+        emitOpcode(op_push_lexical_scope);
>+        instructions().append(newScope->index());
>+        instructions().append(scopeRegister()->index());
>+        instructions().append(addConstantValue(symbolTable->cloneScopePart(*m_vm))->index());
>+
>+        emitMove(scopeRegister(), newScope);
>+    }
>+
>+    m_symbolTableStack.append(SymbolTableStackEntry(symbolTable, newScope));
>+    m_TDZStack.append(&vars);
>+    // Prefill variables with the empty value.
>+    for (auto ident : vars) {
>+        SymbolTableEntry entry = symbolTable->get(ident.get());
>+        ASSERT(!entry.isNull());
>+        VarOffset offset = entry.varOffset();
>+        RefPtr<RegisterID> emptyValue = addConstantEmptyValue();
>+        if (offset.isStack())
>+            emitMoveEmptyValue(&registerFor(offset.stackOffset()));
>+        else {
>+            ASSERT(offset.isScope() && newScope);
>+            const Identifier* identifier = makeIdentifier(ident.get());
>+            emitPutToScope(newScope, variableForLocalEntry(*identifier, entry), emptyValue.get(), DoNotThrowIfNotFound);
>+        }
>+    }
>+}
>+
>+void BytecodeGenerator::popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    if (!vars.size())
>+        return;
>+
>+    SymbolTableStackEntry stackEntry = m_symbolTableStack.takeLast();
>+    SymbolTable* symbolTable = stackEntry.first;
>+    ConcurrentJITLocker locker(symbolTable->m_lock);
>+    for (auto ident : vars) {
>+        if (capturedVars.contains(ident))
>+            continue;
>+        SymbolTableEntry entry = symbolTable->get(locker, ident.get());
>+        ASSERT(!entry.isNull());
>+        VarOffset offset = entry.varOffset();
>+        ASSERT(offset.isStack());
>+        RegisterID* local = &registerFor(offset.stackOffset());
>+        local->deref();
>+    }
>+
>+    if (capturedVars.size()) {
>+        RELEASE_ASSERT(stackEntry.second);
>+        stackEntry.second->deref();
>+        emitOpcode(op_pop_lexical_scope);
>+        instructions().append(scopeRegister()->index());
>+    }
>+
>+    RELEASE_ASSERT(m_TDZStack.last() == &vars);
>+    m_TDZStack.removeLast();
>+}
>+
>+void BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration(const IdentifierSet& vars, const IdentifierSet& capturedVars)
>+{
>+    UNUSED_PARAM(vars);
>+
>+    // This function needs to do setup for a for loop's activation if any of 
>+    // the for loop's lexically declared variables are captured (that is, variables 
>+    // declared in the loop header, not the loop body). This function needs to 
>+    // make a copy of the current activation and copy the values from the previous 
>+    // activation into the new activation because each iteration of a for loop 
>+    // gets a new activation.
>+    if (!capturedVars.size())
>+        return;
>+
>+    SymbolTableStackEntry stackEntry = m_symbolTableStack.last();
>+    SymbolTable* symbolTable = stackEntry.first;
>+    RegisterID* loopScope = stackEntry.second;
>+    ASSERT(symbolTable->scopeSize());
>+    ASSERT(loopScope);
>+    Vector<std::pair<RegisterID*, const Identifier*>> activationValuesToCopyOver;
>+
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        activationValuesToCopyOver.reserveInitialCapacity(symbolTable->scopeSize());
>+
>+        for (auto end = symbolTable->end(locker), ptr = symbolTable->begin(locker); ptr != end; ++ptr) {
>+            if (!ptr->value.varOffset().isScope())
>+                continue;
>+             
>+            RefPtr<StringImpl> ident = ptr->key;
>+            const Identifier* identifier = makeIdentifier(ident.get());
>+                 
>+            RegisterID* transitionValue = newLexicalVariable();
>+            transitionValue->ref();
>+            emitGetFromScope(transitionValue, loopScope, variableForLocalEntry(*identifier, ptr->value), DoNotThrowIfNotFound);
>+            activationValuesToCopyOver.uncheckedAppend(std::make_pair(transitionValue, identifier));
>+        }
>+    }
>+
>+    // We need this dynamic behavior of the executing code to ensure
>+    // each loop iteration has a new activation. (It's pretty ugly).
>+    // Also, this new activation needs to be assigned to the same register
>+    // as the previous scope because the loop body is compiled under
>+    // the assumption that the scope's register index is constant even 
>+    // though the value in that register will change on each loop iteration.
>+    emitOpcode(op_pop_lexical_scope);
>+    instructions().append(scopeRegister()->index());
>+
>+    emitOpcode(op_push_lexical_scope);
>+    instructions().append(loopScope->index());
>+    instructions().append(scopeRegister()->index());
>+    instructions().append(addConstantValue(symbolTable->cloneScopePart(*m_vm))->index());
>+
>+    emitMove(scopeRegister(), loopScope);
>+
>+    // FIXME: We can optimize this because these variables no longer 
>+    // need to be under TDZ. Everything lexically declared in a for loop's 
>+    // header will no longer be under TDZ in the body of the loop by the 
>+    // nature of a for loop's syntactic structure and semantics.
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto pair : activationValuesToCopyOver) {
>+            const Identifier* identifier = pair.second;
>+            SymbolTableEntry entry = symbolTable->get(locker, identifier->impl());
>+            RELEASE_ASSERT(!entry.isNull());
>+            RegisterID* transitionValue = pair.first;
>+            emitPutToScope(loopScope, variableForLocalEntry(*identifier, entry), transitionValue, DoNotThrowIfNotFound);
>+            transitionValue->deref();
>+        }
>+    }
>+}
>+
> Variable BytecodeGenerator::variable(const Identifier& property)
> {
>     if (property == propertyNames().thisIdentifier) {
>@@ -1193,20 +1383,19 @@ Variable BytecodeGenerator::variable(con
>             ReadOnly, Variable::SpecialVariable);
>     }
>     
>-    if (!shouldOptimizeLocals())
>-        return Variable(property);
>-    
>-    SymbolTableEntry entry = symbolTable().get(property.impl());
>-    if (entry.isNull())
>-        return Variable(property);
>-    
>-    if (entry.varOffset().isScope() && m_localScopeDepth) {
>-        // FIXME: We should be able to statically resolve through our local scopes.
>-        // https://bugs.webkit.org/show_bug.cgi?id=141885
>+    if (m_localScopeDepth)
>         return Variable(property);
>+
>+    for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+        SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+        SymbolTableEntry entry = symbolTable.get(property.impl());
>+        if (entry.isNull())
>+            continue;
>+        
>+        return variableForLocalEntry(property, entry);
>     }
>-    
>-    return variableForLocalEntry(property, entry);
>+
>+    return Variable(property);
> }
> 
> Variable BytecodeGenerator::variablePerSymbolTable(const Identifier& property)
>@@ -1237,9 +1426,9 @@ void BytecodeGenerator::createVariable(
>     ExistingVariableMode existingVariableMode)
> {
>     ASSERT(property != propertyNames().thisIdentifier);
>-    
>-    ConcurrentJITLocker locker(symbolTable().m_lock);
>-    SymbolTableEntry entry = symbolTable().get(locker, property.impl());
>+    SymbolTable& symbolTable = *m_symbolTable;
>+    ConcurrentJITLocker locker(symbolTable.m_lock);
>+    SymbolTableEntry entry = symbolTable.get(locker, property.impl());
>     
>     if (!entry.isNull()) {
>         if (existingVariableMode == IgnoreExisting)
>@@ -1263,13 +1452,13 @@ void BytecodeGenerator::createVariable(
>     
>     VarOffset varOffset;
>     if (varKind == VarKind::Scope)
>-        varOffset = VarOffset(symbolTable().takeNextScopeOffset(locker));
>+        varOffset = VarOffset(symbolTable.takeNextScopeOffset(locker));
>     else {
>         ASSERT(varKind == VarKind::Stack);
>         varOffset = VarOffset(virtualRegisterForLocal(m_calleeRegisters.size()));
>     }
>     SymbolTableEntry newEntry(varOffset, constantMode == IsConstant ? ReadOnly : 0);
>-    symbolTable().add(locker, property.impl(), newEntry);
>+    symbolTable.add(locker, property.impl(), newEntry);
>     
>     if (varKind == VarKind::Stack) {
>         RegisterID* local = addVar();
>@@ -1314,7 +1503,19 @@ RegisterID* BytecodeGenerator::emitResol
>         // don't do that already is that m_lexicalEnvironment is required by ConstDeclNode. ConstDeclNode
>         // requires weird things because it is a shameful pile of nonsense, but block scoping would make
>         // that code sensible and obviate the need for us to do bad things.
>-        return m_lexicalEnvironmentRegister;
>+        for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+            SymbolTable& symbolTable = *m_symbolTableStack[i].first;
>+            SymbolTableEntry entry = symbolTable.get(variable.ident().impl());
>+            if (entry.isNull())
>+                continue;
>+            
>+            RegisterID* scope = m_symbolTableStack[i].second; 
>+            RELEASE_ASSERT(scope);
>+            return scope;
>+        }
>+
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return nullptr;
>         
>     case VarKind::Invalid:
>         // Indicates non-local resolution.
>@@ -1635,6 +1836,33 @@ void BytecodeGenerator::emitTDZCheck(Reg
>     instructions().append(target->index());
> }
> 
>+void BytecodeGenerator::emitTDZCheckIfNecessary(const Variable& variable, RegisterID* target, RegisterID* scope)
>+{
>+    for (unsigned i = m_TDZStack.size(); i-- > 0;) {
>+        const IdentifierSet* identifiers = m_TDZStack[i];
>+        if (identifiers->contains(variable.ident().impl())) {
>+            if (target)
>+                emitTDZCheck(target);
>+            else {
>+                RELEASE_ASSERT(!variable.isLocal() && scope);
>+                RefPtr<RegisterID> result = newTemporary();
>+                emitGetFromScope(result.get(), scope, variable, DoNotThrowIfNotFound);
>+                emitTDZCheck(result.get());
>+            }
>+
>+            break;
>+        }
>+    }
>+}
>+
>+void BytecodeGenerator::getVariablesUnderTDZ(IdentifierSet& result)
>+{
>+    for (auto identifierSet : m_TDZStack) {
>+        for (auto ident : *identifierSet)
>+            result.add(ident);
>+    }
>+}
>+
> RegisterID* BytecodeGenerator::emitNewObject(RegisterID* dst)
> {
>     size_t begin = instructions().size();
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 182773)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
>@@ -255,9 +255,9 @@ namespace JSC {
>         typedef DeclarationStacks::VarStack VarStack;
>         typedef DeclarationStacks::FunctionStack FunctionStack;
> 
>-        BytecodeGenerator(VM&, ProgramNode*, UnlinkedProgramCodeBlock*, DebuggerMode, ProfilerMode);
>-        BytecodeGenerator(VM&, FunctionNode*, UnlinkedFunctionCodeBlock*, DebuggerMode, ProfilerMode);
>-        BytecodeGenerator(VM&, EvalNode*, UnlinkedEvalCodeBlock*, DebuggerMode, ProfilerMode);
>+        BytecodeGenerator(VM&, ProgramNode*, UnlinkedProgramCodeBlock*, DebuggerMode, ProfilerMode, const IdentifierSet*);
>+        BytecodeGenerator(VM&, FunctionNode*, UnlinkedFunctionCodeBlock*, DebuggerMode, ProfilerMode, const IdentifierSet*);
>+        BytecodeGenerator(VM&, EvalNode*, UnlinkedEvalCodeBlock*, DebuggerMode, ProfilerMode, const IdentifierSet*);
> 
>         ~BytecodeGenerator();
>         
>@@ -309,6 +309,13 @@ namespace JSC {
> 
>         RegisterID* ignoredResult() { return &m_ignoredResultRegister; }
> 
>+        // This will be allocated in the temporary region of registers, but it
>+        // will not be marked as a temporary. This will ensure that finalDestination()
>+        // does not overwrite a lexical variable that it mistakes as a temporary. These
>+        // registers can be reclaimed when the lexical scope they belong to is no longer
>+        // on the symbol table stack.
>+        RegisterID* newLexicalVariable();
>+
>         // Returns a place to write intermediate values of an operation
>         // which reuses dst if it is safe to do so.
>         RegisterID* tempDestination(RegisterID* dst)
>@@ -449,6 +456,7 @@ namespace JSC {
> 
>         RegisterID* emitCreateThis(RegisterID* dst);
>         void emitTDZCheck(RegisterID* target);
>+        void emitTDZCheckIfNecessary(const Variable&, RegisterID* target, RegisterID* scope);
>         RegisterID* emitNewObject(RegisterID* dst);
>         RegisterID* emitNewArray(RegisterID* dst, ElementNode*, unsigned length); // stops at first elision
> 
>@@ -586,8 +594,14 @@ namespace JSC {
> 
>         OpcodeID lastOpcodeID() const { return m_lastOpcodeID; }
> 
>+        void pushLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+        void popLexicalScope(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+        void prepareLexicalScopeForNextForLoopIteration(const IdentifierSet& vars, const IdentifierSet& capturedVars);
>+
>     private:
>+        void reclaimFreeRegisters();
>         Variable variableForLocalEntry(const Identifier&, const SymbolTableEntry&);
>+        const Identifier* makeIdentifier(StringImpl*);
> 
>         void emitOpcode(OpcodeID);
>         UnlinkedArrayAllocationProfile newArrayAllocationProfile();
>@@ -657,9 +671,13 @@ namespace JSC {
>         
>         UnlinkedFunctionExecutable* makeFunction(FunctionBodyNode* body)
>         {
>-            return UnlinkedFunctionExecutable::create(m_vm, m_scopeNode->source(), body, isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction);
>+            IdentifierSet variablesUnderTDZ;
>+            getVariablesUnderTDZ(variablesUnderTDZ);
>+            return UnlinkedFunctionExecutable::create(m_vm, m_scopeNode->source(), body, isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction, variablesUnderTDZ);
>         }
> 
>+        void getVariablesUnderTDZ(IdentifierSet&);
>+
>         RegisterID* emitConstructVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, RegisterID* profileHookRegister, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
>         RegisterID* emitCallVarargs(OpcodeID, RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, RegisterID* profileHookRegister, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
> 
>@@ -670,31 +688,6 @@ namespace JSC {
> 
>         SymbolTable& symbolTable() { return *m_symbolTable; }
> 
>-        bool shouldOptimizeLocals()
>-        {
>-            if (m_codeType != FunctionCode)
>-                return false;
>-
>-            if (m_localScopeDepth)
>-                return false;
>-
>-            return true;
>-        }
>-
>-        bool canOptimizeNonLocals()
>-        {
>-            if (m_localScopeDepth)
>-                return false;
>-
>-            if (m_codeType == EvalCode)
>-                return false;
>-
>-            if (m_codeType == FunctionCode && m_codeBlock->usesEval())
>-                return false;
>-
>-            return true;
>-        }
>-
>         RegisterID* emitThrowExpressionTooDeepException();
> 
>     private:
>@@ -704,6 +697,9 @@ namespace JSC {
>         bool m_shouldEmitProfileHooks;
> 
>         SymbolTable* m_symbolTable { nullptr };
>+        typedef std::pair<SymbolTable*, RegisterID*> SymbolTableStackEntry;
>+        Vector<SymbolTableStackEntry> m_symbolTableStack;
>+        Vector<const IdentifierSet*> m_TDZStack;
> 
>         ScopeNode* const m_scopeNode;
>         Strong<UnlinkedCodeBlock> m_codeBlock;
>Index: Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(revision 182773)
>+++ Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(working copy)
>@@ -194,6 +194,7 @@ RegisterID* ResolveNode::emitBytecode(By
> {
>     Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (dst == generator.ignoredResult())
>             return nullptr;
>         if (generator.vm()->typeProfiler()) {
>@@ -208,6 +209,7 @@ RegisterID* ResolveNode::emitBytecode(By
>     RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
>     RegisterID* finalDest = generator.finalDestination(dst);
>     RegisterID* result = generator.emitGetFromScope(finalDest, scope.get(), var, ThrowIfNotFound);
>+    generator.emitTDZCheckIfNecessary(var, finalDest, scope.get());
>     if (generator.vm()->typeProfiler()) {
>         generator.emitProfileType(finalDest, var.isResolved() ? ProfileTypeBytecodeGetFromLocalScope : ProfileTypeBytecodeGetFromScope, &m_ident);
>         generator.emitTypeProfilerExpressionInfo(m_position, JSTextPosition(-1, m_position.offset + m_ident.length(), -1));
>@@ -1610,6 +1612,8 @@ RegisterID* AssignResolveNode::emitBytec
>             generator.emitReadOnlyExceptionIfNeeded();
>             return generator.emitNode(dst, m_right);
>         }
>+        if (!m_isInVariableDeclaration)
>+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (var.isSpecial() || generator.vm()->typeProfiler()) {
>             RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
>             generator.emitNode(tempDst.get(), m_right);
>@@ -1627,6 +1631,8 @@ RegisterID* AssignResolveNode::emitBytec
>     if (generator.isStrictMode())
>         generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>     RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>+    if (!m_isInVariableDeclaration)
>+        generator.emitTDZCheckIfNecessary(var, nullptr, scope.get());
>     if (dst == generator.ignoredResult())
>         dst = 0;
>     RefPtr<RegisterID> result = generator.emitNode(dst, m_right);
>@@ -1829,7 +1835,9 @@ void BlockNode::emitBytecode(BytecodeGen
> {
>     if (!m_statements)
>         return;
>+    generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>     m_statements->emitBytecode(generator, dst);
>+    generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
> }
> 
> // ------------------------------ EmptyStatementNode ---------------------------
>@@ -1868,21 +1876,37 @@ void VarStatementNode::emitBytecode(Byte
> 
> RegisterID* EmptyVarExpression::emitBytecode(BytecodeGenerator& generator, RegisterID*)
> {
>+    Variable var = generator.variable(m_ident);
>+    RefPtr<RegisterID> scope;
>+    RefPtr<RegisterID> value;
>+    // Lexical declarations like 'let' must move undefined into their variables so we don't
>+    // get TDZ errors for situations like this: `let x; x;`
>+    if (m_isInLexicalDeclaration) {
>+        if (RegisterID* local = var.local())
>+            generator.emitLoad(local, jsUndefined());
>+        else {
>+            scope = generator.emitResolveScope(nullptr, var);
>+            RefPtr<RegisterID> undefined = generator.emitLoad(nullptr, jsUndefined());
>+            generator.emitPutToScope(scope.get(), var, undefined.get(), generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound);
>+        }
>+    }
>+
>+    // It's safe to return null here because this node will always be a child node of VarStatementNode which ignores our return value.
>     if (!generator.vm()->typeProfiler())
>         return nullptr;
> 
>-    Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local())
>         generator.emitProfileType(local, ProfileTypeBytecodeHasGlobalID, nullptr);
>     else {
>-        RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>-        RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
>+        if (!m_isInLexicalDeclaration) {
>+            scope = generator.emitResolveScope(nullptr, var);
>+            value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
>+        }
>         generator.emitProfileType(value.get(), var.isResolved() ? ProfileTypeBytecodeGetFromLocalScope : ProfileTypeBytecodeGetFromScope, &m_ident);
>     }
> 
>     generator.emitTypeProfilerExpressionInfo(position(), JSTextPosition(-1, position().offset + m_ident.length(), -1));
> 
>-    // It's safe to return null here because this node will always be a child node of VarStatementNode which ignores our return value.
>     return nullptr;
> }
> 
>@@ -2014,6 +2038,7 @@ void ForNode::emitBytecode(BytecodeGener
> 
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
> 
>+    generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>     if (m_expr1)
>         generator.emitNode(generator.ignoredResult(), m_expr1);
>     
>@@ -2029,6 +2054,7 @@ void ForNode::emitBytecode(BytecodeGener
> 
>     generator.emitLabel(scope->continueTarget());
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
>+    generator.prepareLexicalScopeForNextForLoopIteration(lexicalVariables(), lexicalCaptures());
>     if (m_expr3)
>         generator.emitNode(generator.ignoredResult(), m_expr3);
> 
>@@ -2038,6 +2064,7 @@ void ForNode::emitBytecode(BytecodeGener
>         generator.emitJump(topOfLoop.get());
> 
>     generator.emitLabel(scope->breakTarget());
>+    generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
>     generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
> }
> 
>@@ -2178,12 +2205,15 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitJumpIfFalse(result.get(), scope->continueTarget());
> 
>         generator.emitToIndexString(propertyName.get(), i.get());
>+
>+        generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>         this->emitLoopHeader(generator, propertyName.get());
> 
>         generator.emitProfileControlFlow(profilerStartOffset);
> 
>         generator.pushIndexedForInScope(local.get(), i.get());
>         generator.emitNode(dst, m_statement);
>+        generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
>         generator.popIndexedForInScope(local.get());
> 
>         generator.emitProfileControlFlow(profilerEndOffset);
>@@ -2215,12 +2245,14 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitHasStructureProperty(result.get(), base.get(), propertyName.get(), enumerator.get());
>         generator.emitJumpIfFalse(result.get(), scope->continueTarget());
> 
>+        generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>         this->emitLoopHeader(generator, propertyName.get());
> 
>         generator.emitProfileControlFlow(profilerStartOffset);
> 
>         generator.pushStructureForInScope(local.get(), enumeratorIndex.get(), propertyName.get(), enumerator.get());
>         generator.emitNode(dst, m_statement);
>+        generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
>         generator.popStructureForInScope(local.get());
> 
>         generator.emitProfileControlFlow(profilerEndOffset);
>@@ -2254,11 +2286,13 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitHasGenericProperty(result.get(), base.get(), propertyName.get());
>         generator.emitJumpIfFalse(result.get(), scope->continueTarget());
> 
>+        generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>         this->emitLoopHeader(generator, propertyName.get());
> 
>         generator.emitProfileControlFlow(profilerStartOffset);
> 
>         generator.emitNode(dst, m_statement);
>+        generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
> 
>         generator.emitLabel(scope->continueTarget());
>         generator.emitInc(enumeratorIndex.get());
>@@ -2287,8 +2321,9 @@ void ForOfNode::emitBytecode(BytecodeGen
>         emitThrowReferenceError(generator, ASCIILiteral("Left side of for-of statement is not a reference."));
>         return;
>     }
>-
>+    
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
>+    generator.pushLexicalScope(lexicalVariables(), lexicalCaptures());
>     auto extractor = [this, dst](BytecodeGenerator& generator, RegisterID* value)
>     {
>         if (m_lexpr->isResolveNode()) {
>@@ -2336,6 +2371,7 @@ void ForOfNode::emitBytecode(BytecodeGen
>         }
>         generator.emitProfileControlFlow(m_statement->startOffset());
>         generator.emitNode(dst, m_statement);
>+        generator.popLexicalScope(lexicalVariables(), lexicalCaptures());
>     };
>     generator.emitEnumeration(this, m_expr, extractor);
>     generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
>Index: Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
>===================================================================
>--- Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(revision 182773)
>+++ Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(working copy)
>@@ -192,7 +192,11 @@ JSValue DebuggerCallFrame::evaluate(cons
>     VM& vm = callFrame->vm();
>     auto& codeBlock = *callFrame->codeBlock();
>     ThisTDZMode thisTDZMode = codeBlock.unlinkedCodeBlock()->constructorKind() == ConstructorKind::Derived ? ThisTDZMode::AlwaysCheck : ThisTDZMode::CheckIfNeeded;
>-    EvalExecutable* eval = EvalExecutable::create(callFrame, makeSource(script), codeBlock.isStrictMode(), thisTDZMode);
>+
>+    IdentifierSet variablesUnderTDZ; // is this correct?
>+    JSScope::collectVariablesUnderTDZ(scope()->jsScope(), variablesUnderTDZ);
>+
>+    EvalExecutable* eval = EvalExecutable::create(callFrame, makeSource(script), codeBlock.isStrictMode(), thisTDZMode, &variablesUnderTDZ);
>     if (vm.exception()) {
>         exception = vm.exception();
>         vm.clearException();
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 182773)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -3672,6 +3672,18 @@ bool ByteCodeParser::parseBlock(unsigned
>             set(VirtualRegister(currentInstruction[2].u.operand), lexicalEnvironment);
>             NEXT_OPCODE(op_create_lexical_environment);
>         }
>+
>+        case op_push_lexical_scope: {
>+            Node* lexicalEnvironment = addToGraph(CreateActivation, get(VirtualRegister(currentInstruction[2].u.operand)), get(VirtualRegister(currentInstruction[3].u.operand)));
>+            set(VirtualRegister(currentInstruction[1].u.operand), lexicalEnvironment);
>+            NEXT_OPCODE(op_push_lexical_scope);
>+        }
>+
>+        case op_pop_lexical_scope: {
>+            Node* poppedScope = addToGraph(SkipScope, get(VirtualRegister(currentInstruction[1].u.operand)));
>+            set(VirtualRegister(currentInstruction[1].u.operand), poppedScope);
>+            NEXT_OPCODE(op_pop_lexical_scope);
>+        }
>             
>         case op_get_scope: {
>             // Help the later stages a bit by doing some small constant folding here. Note that this
>Index: Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(revision 182773)
>+++ Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(working copy)
>@@ -207,6 +207,8 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_new_func:
>     case op_new_func_exp:
>     case op_create_lexical_environment:
>+    case op_push_lexical_scope:
>+    case op_pop_lexical_scope:
>         return CanCompileAndInline;
> 
>     case op_put_to_scope: {
>Index: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(revision 182773)
>+++ Source/JavaScriptCore/dfg/DFGFixupPhase.cpp	(working copy)
>@@ -1180,11 +1180,16 @@ private:
>         }
> 
>         case CreateScopedArguments:
>-        case CreateActivation:
>         case NewFunction: {
>             fixEdge<CellUse>(node->child1());
>             break;
>         }
>+        case CreateActivation: {
>+            fixEdge<CellUse>(node->child1());
>+            if (node->child2())
>+                fixEdge<KnownCellUse>(node->child2());
>+            break;
>+        }
>             
> #if !ASSERT_DISABLED
>         // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 182773)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -4441,13 +4441,18 @@ void SpeculativeJIT::compileForwardVarar
> 
> void SpeculativeJIT::compileCreateActivation(Node* node)
> {
>-    SymbolTable* table = m_jit.graph().symbolTableFor(node->origin.semantic);
>+    SymbolTable* table = nullptr;
>+    if (node->child2())
>+        table = node->child2()->castConstant<SymbolTable*>();
>+    else
>+        table = m_jit.graph().symbolTableFor(node->origin.semantic);
>     Structure* structure = m_jit.graph().globalObjectFor(
>         node->origin.semantic)->activationStructure();
>         
>     SpeculateCellOperand scope(this, node->child1());
>     GPRReg scopeGPR = scope.gpr();
>     
>+    // FIXME: should we do this for block scoped activations?
>     if (table->singletonScope()->isStillValid()) {
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 182773)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -273,6 +273,8 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_profile_control_flow)
>         DEFINE_OP(op_push_name_scope)
>         DEFINE_OP(op_push_with_scope)
>+        DEFINE_OP(op_push_lexical_scope)
>+        DEFINE_OP(op_pop_lexical_scope)
>         case op_put_by_id_out_of_line:
>         case op_put_by_id_transition_direct:
>         case op_put_by_id_transition_normal:
>Index: Source/JavaScriptCore/jit/JIT.h
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.h	(revision 182773)
>+++ Source/JavaScriptCore/jit/JIT.h	(working copy)
>@@ -534,6 +534,8 @@ namespace JSC {
>         void emit_op_profile_control_flow(Instruction*);
>         void emit_op_push_name_scope(Instruction*);
>         void emit_op_push_with_scope(Instruction*);
>+        void emit_op_push_lexical_scope(Instruction*);
>+        void emit_op_pop_lexical_scope(Instruction*);
>         void emit_op_put_by_id(Instruction*);
>         void emit_op_put_by_index(Instruction*);
>         void emit_op_put_by_val(Instruction*);
>@@ -711,6 +713,7 @@ namespace JSC {
>         MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EPc, int, Instruction*);
>         MacroAssembler::Call callOperation(J_JITOperation_EZ, int, int32_t);
>         MacroAssembler::Call callOperation(J_JITOperation_EZZ, int, int32_t, int32_t);
>+        MacroAssembler::Call callOperation(J_JITOperation_ESymtabZ, int, SymbolTable*, int32_t);
>         MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, size_t);
>         MacroAssembler::Call callOperation(S_JITOperation_ECC, RegisterID, RegisterID);
>         MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID);
>Index: Source/JavaScriptCore/jit/JITInlines.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlines.h	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITInlines.h	(working copy)
>@@ -295,6 +295,12 @@ ALWAYS_INLINE MacroAssembler::Call JIT::
>     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
> }
> 
>+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESymtabZ operation, int dst, SymbolTable* symbolTable, int32_t arg2)
>+{
>+    setupArgumentsWithExecState(TrustedImmPtr(symbolTable), TrustedImm32(arg2));
>+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
>+}
>+
> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_ECC operation, RegisterID regOp1, RegisterID regOp2)
> {
>     setupArgumentsWithExecState(regOp1, regOp2);
>Index: Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(working copy)
>@@ -815,6 +815,21 @@ void JIT::emit_op_catch(Instruction* cur
>     emitStore(exception, regT1, regT0);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand;
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+}
>+
>+void JIT::emit_op_pop_lexical_scope(Instruction* currentInstruction)
>+{
>+    int scopeSrcAndDst = currentInstruction[1].u.operand;
>+    emitLoadPayload(scopeSrcAndDst, regT0);
>+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
>+    emitStoreCell(scopeSrcAndDst, regT0);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOpcodes.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes.cpp	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITOpcodes.cpp	(working copy)
>@@ -520,6 +520,22 @@ void JIT::emit_op_catch(Instruction* cur
>     emitPutVirtualRegister(currentInstruction[1].u.operand);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand; 
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+    return;
>+}
>+
>+void JIT::emit_op_pop_lexical_scope(Instruction* currentInstruction)
>+{
>+    int scopeSrcAndDst = currentInstruction[1].u.operand;
>+    emitGetVirtualRegister(scopeSrcAndDst, regT0);
>+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
>+    emitStoreCell(scopeSrcAndDst, regT0);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -1333,6 +1333,17 @@ void JIT_OPERATION operationPushWithScop
>     exec->uncheckedR(dst) = JSWithScope::create(exec, o, currentScope);
> }
> 
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState* exec, SymbolTable* symbolTable, int32_t scopeReg)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+
>+    return JSValue::encode(newScope);
>+}
>+
> void JIT_OPERATION operationPopScope(ExecState* exec, int32_t scopeReg)
> {
>     VM& vm = exec->vm();
>Index: Source/JavaScriptCore/jit/JITOperations.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.h	(revision 182773)
>+++ Source/JavaScriptCore/jit/JITOperations.h	(working copy)
>@@ -121,6 +121,7 @@ typedef EncodedJSValue JIT_OPERATION (*J
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZ)(ExecState*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZIcfZ)(ExecState*, int32_t, InlineCallFrame*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZZ)(ExecState*, int32_t, int32_t);
>+typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_ESymtabZ)(ExecState*, SymbolTable*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_E)(ExecState*);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EZ)(ExecState*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EC)(ExecState*, JSCell*);
>@@ -296,6 +297,7 @@ void JIT_OPERATION operationPutGetterSet
> void JIT_OPERATION operationPushCatchScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushFunctionNameScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushWithScope(ExecState*, int32_t, EncodedJSValue) WTF_INTERNAL;
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState*, SymbolTable*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationPopScope(ExecState*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationProfileDidCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationProfileWillCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 182773)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -1290,6 +1290,25 @@ LLINT_SLOW_PATH_DECL(slow_path_push_name
>     LLINT_END();
> }
> 
>+LLINT_SLOW_PATH_DECL(slow_path_push_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[2].u.operand;
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    SymbolTable* symbolTable = jsCast<SymbolTable*>(LLINT_OP_C(3).jsValue());
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable);
>+    LLINT_RETURN(newScope);
>+}
>+
>+LLINT_SLOW_PATH_DECL(slow_path_pop_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[1].u.operand;
>+    JSScope* scope = exec->uncheckedR(scopeReg).Register::scope();
>+    exec->uncheckedR(scopeReg) = scope->next();
>+    LLINT_END();
>+}
>+
> LLINT_SLOW_PATH_DECL(slow_path_throw)
> {
>     LLINT_BEGIN();
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.h	(revision 182773)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.h	(working copy)
>@@ -108,6 +108,8 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_name_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_lexical_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_lexical_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_handle_watchdog_timer);
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(revision 182773)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(working copy)
>@@ -787,8 +787,9 @@ _llint_op_new_object:
> 
> _llint_op_check_tdz:
>     traceExecution()
>-    loadpFromInstruction(1, t0)
>-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opNotTDZ
>+    loadisFromInstruction(1, t0)
>+    loadConstantOrVariableTag(t0, t1)
>+    bineq TagOffset[cfr, t1, 8], EmptyValueTag, .opNotTDZ
>     callSlowPath(_slow_path_throw_tdz_error)
> 
> .opNotTDZ:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 182773)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -672,9 +672,9 @@ _llint_op_new_object:
> 
> _llint_op_check_tdz:
>     traceExecution()
>-    loadpFromInstruction(1, t0)
>-    loadq [cfr, t0, 8], t0
>-    bqneq t0, ValueEmpty, .opNotTDZ
>+    loadisFromInstruction(1, t0)
>+    loadConstantOrVariable(t0, t1)
>+    bqneq t1, ValueEmpty, .opNotTDZ
>     callSlowPath(_slow_path_throw_tdz_error)
> 
> .opNotTDZ:
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 182773)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -1285,6 +1285,18 @@ _llint_op_push_name_scope:
>     dispatch(5)
> 
> 
>+_llint_op_push_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_push_lexical_scope)
>+    dispatch(4)
>+
>+
>+_llint_op_pop_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_pop_lexical_scope)
>+    dispatch(2)
>+
>+
> _llint_op_throw:
>     traceExecution()
>     callSlowPath(_llint_slow_path_throw)
>Index: Source/JavaScriptCore/parser/ASTBuilder.h
>===================================================================
>--- Source/JavaScriptCore/parser/ASTBuilder.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/ASTBuilder.h	(working copy)
>@@ -276,11 +276,11 @@ public:
>         return new (m_parserArena) ConditionalNode(location, condition, lhs, rhs);
>     }
> 
>-    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
>+    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end, bool isInVariableDeclaration)
>     {
>         if (rhs->isFuncExprNode())
>             static_cast<FuncExprNode*>(rhs)->body()->setInferredName(ident);
>-        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs);
>+        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs, isInVariableDeclaration);
>         setExceptionLocation(node, start, divot, end);
>         return node;
>     }
>@@ -379,16 +379,16 @@ public:
>         const JSTextPosition& classStart, const JSTextPosition& classEnd, unsigned startLine, unsigned endLine)
>     {
>         // FIXME: Use "let" declaration.
>-        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd);
>+        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd, false);
>         ClassDeclNode* decl = new (m_parserArena) ClassDeclNode(location, assign);
>         decl->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return decl;
>     }
> #endif
> 
>-    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine)
>+    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine, IdentifierSet& lexicalVariables, IdentifierSet& lexicallyCapturedVariables)
>     {
>-        BlockNode* block = new (m_parserArena) BlockNode(location, elements);
>+        BlockNode* block = new (m_parserArena) BlockNode(location, elements, lexicalVariables, lexicallyCapturedVariables);
>         block->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return block;
>     }
>@@ -407,39 +407,39 @@ public:
>         return result;
>     }
> 
>-    StatementNode* createForLoop(const JSTokenLocation& location, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end)
>+    StatementNode* createForLoop(const JSTokenLocation& location, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>-        ForNode* result = new (m_parserArena) ForNode(location, initializer, condition, iter, statements);
>+        ForNode* result = new (m_parserArena) ForNode(location, initializer, condition, iter, statements, lexicalVariables, lexicalCaptures);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         return result;
>     }
> 
>-    StatementNode* createForInLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForInLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>-        ForInNode* result = new (m_parserArena) ForInNode(location, lhs, iter, statements);
>+        ForInNode* result = new (m_parserArena) ForInNode(location, lhs, iter, statements, lexicalVariables, lexicalCaptures);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         setExceptionLocation(result, eStart, eDivot, eEnd);
>         return result;
>     }
>     
>-    StatementNode* createForInLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForInLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>         auto lexpr = new (m_parserArena) DeconstructingAssignmentNode(location, pattern.get(), 0);
>-        return createForInLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end);
>+        return createForInLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end, lexicalVariables, lexicalCaptures);
>     }
>     
>-    StatementNode* createForOfLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForOfLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>-        ForOfNode* result = new (m_parserArena) ForOfNode(location, lhs, iter, statements);
>+        ForOfNode* result = new (m_parserArena) ForOfNode(location, lhs, iter, statements, lexicalVariables, lexicalCaptures);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         setExceptionLocation(result, eStart, eDivot, eEnd);
>         return result;
>     }
>     
>-    StatementNode* createForOfLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForOfLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>     {
>         auto lexpr = new (m_parserArena) DeconstructingAssignmentNode(location, pattern.get(), 0);
>-        return createForOfLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end);
>+        return createForOfLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end, lexicalVariables, lexicalCaptures);
>     }
> 
>     bool isBindingNode(const DeconstructionPattern& pattern)
>@@ -457,9 +457,15 @@ public:
>         return result;
>     }
> 
>-    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier)
>+    StatementNode* createLetStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
>     {
>-        return new (m_parserArena) EmptyVarExpression(location, identifier);
>+        // FIXME: better name for 'VarStatementNode'.
>+        return createVarStatement(location, expr, start, end);
>+    }
>+
>+    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier, bool isLexicalDeclaration)
>+    {
>+        return new (m_parserArena) EmptyVarExpression(location, identifier, isLexicalDeclaration);
>     }
> 
>     StatementNode* createReturnStatement(const JSTokenLocation& location, ExpressionNode* expression, const JSTextPosition& start, const JSTextPosition& end)
>@@ -1091,7 +1097,7 @@ ExpressionNode* ASTBuilder::makeAssignNo
>         if (op == OpEqual) {
>             if (expr->isFuncExprNode())
>                 static_cast<FuncExprNode*>(expr)->body()->setInferredName(resolve->identifier());
>-            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr);
>+            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr, false);
>             setExceptionLocation(node, start, divot, end);
>             return node;
>         }
>Index: Source/JavaScriptCore/parser/Keywords.table
>===================================================================
>--- Source/JavaScriptCore/parser/Keywords.table	(revision 182773)
>+++ Source/JavaScriptCore/parser/Keywords.table	(working copy)
>@@ -2,56 +2,56 @@
> @begin mainTable 47
> 
> # Types.
>-null		NULLTOKEN
>-true		TRUETOKEN
>-false		FALSETOKEN
>+null         NULLTOKEN
>+true         TRUETOKEN
>+false        FALSETOKEN
> 
> # Keywords.
>-break		BREAK
>-case		CASE
>-catch		CATCH
>-class		CLASSTOKEN
>-const		CONSTTOKEN
>-default		DEFAULT
>-extends	EXTENDS
>-finally		FINALLY
>-for		FOR
>-instanceof	INSTANCEOF
>-new		NEW
>-var		VAR
>-continue	CONTINUE
>-function	FUNCTION
>-return		RETURN
>-void		VOIDTOKEN
>-delete		DELETETOKEN
>-if		IF
>-this		THISTOKEN
>-do		DO
>-while		WHILE
>-else		ELSE
>-in		INTOKEN
>-super		SUPER
>-switch		SWITCH
>-throw		THROW
>-try		TRY
>-typeof		TYPEOF
>-with		WITH
>-debugger	DEBUGGER
>+break        BREAK
>+case         CASE
>+catch        CATCH
>+class        CLASSTOKEN
>+const        CONSTTOKEN
>+default      DEFAULT
>+extends      EXTENDS
>+finally      FINALLY
>+for          FOR
>+instanceof   INSTANCEOF
>+new          NEW
>+var          VAR
>+let          LET
>+continue     CONTINUE
>+function     FUNCTION
>+return       RETURN
>+void         VOIDTOKEN
>+delete       DELETETOKEN
>+if           IF
>+this         THISTOKEN
>+do           DO
>+while        WHILE
>+else         ELSE
>+in           INTOKEN
>+super        SUPER
>+switch       SWITCH
>+throw        THROW
>+try          TRY
>+typeof       TYPEOF
>+with         WITH
>+debugger     DEBUGGER
> 
> # Reserved for future use.
>-enum            RESERVED
>-export          RESERVED
>-import          RESERVED
>+enum         RESERVED
>+export       RESERVED
>+import       RESERVED
> 
> # Reserved for future use in strict code.
>-implements      RESERVED_IF_STRICT
>-interface       RESERVED_IF_STRICT
>-let             RESERVED_IF_STRICT
>-package         RESERVED_IF_STRICT
>-private         RESERVED_IF_STRICT
>-protected       RESERVED_IF_STRICT
>-public          RESERVED_IF_STRICT
>-static          RESERVED_IF_STRICT
>-yield           RESERVED_IF_STRICT
>+implements   RESERVED_IF_STRICT
>+interface    RESERVED_IF_STRICT
>+package      RESERVED_IF_STRICT
>+private      RESERVED_IF_STRICT
>+protected    RESERVED_IF_STRICT
>+public       RESERVED_IF_STRICT
>+static       RESERVED_IF_STRICT
>+yield        RESERVED_IF_STRICT
> 
> @end
>Index: Source/JavaScriptCore/parser/NodeConstructors.h
>===================================================================
>--- Source/JavaScriptCore/parser/NodeConstructors.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/NodeConstructors.h	(working copy)
>@@ -572,10 +572,11 @@ namespace JSC {
>     {
>     }
> 
>-    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right)
>+    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right, bool isInVariableDeclaration)
>         : ExpressionNode(location)
>         , m_ident(ident)
>         , m_right(right)
>+        , m_isInVariableDeclaration(isInVariableDeclaration)
>     {
>     }
> 
>@@ -671,9 +672,10 @@ namespace JSC {
>     {
>     }
> 
>-    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident)
>+    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident, bool isInLexicalDeclaration)
>         : ExpressionNode(location)
>         , m_ident(ident)
>+        , m_isInLexicalDeclaration(isInLexicalDeclaration)
>     {
>     }
>     
>@@ -699,8 +701,9 @@ namespace JSC {
>     {
>     }
> 
>-    inline ForNode::ForNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement)
>+    inline ForNode::ForNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicalCaptures)
>         , m_expr1(expr1)
>         , m_expr2(expr2)
>         , m_expr3(expr3)
>@@ -847,14 +850,16 @@ namespace JSC {
>     {
>     }
> 
>-    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements)
>+    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements, IdentifierSet& lexicalVariables, IdentifierSet& lexicallyCapturedVariables)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicallyCapturedVariables)
>         , m_statements(statements)
>     {
>     }
> 
>-    inline EnumerationNode::EnumerationNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>+    inline EnumerationNode::EnumerationNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables, lexicalCaptures)
>         , m_lexpr(l)
>         , m_expr(expr)
>         , m_statement(statement)
>@@ -862,13 +867,13 @@ namespace JSC {
>         ASSERT(l);
>     }
>     
>-    inline ForInNode::ForInNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>-        : EnumerationNode(location, l, expr, statement)
>+    inline ForInNode::ForInNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>+        : EnumerationNode(location, l, expr, statement, lexicalVariables, lexicalCaptures)
>     {
>     }
>     
>-    inline ForOfNode::ForOfNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>-        : EnumerationNode(location, l, expr, statement)
>+    inline ForOfNode::ForOfNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures)
>+        : EnumerationNode(location, l, expr, statement, lexicalVariables, lexicalCaptures)
>     {
>     }
>     
>Index: Source/JavaScriptCore/parser/Nodes.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.cpp	(revision 182773)
>+++ Source/JavaScriptCore/parser/Nodes.cpp	(working copy)
>@@ -94,9 +94,10 @@ ScopeNode::ScopeNode(ParserArena& parser
> {
> }
> 
>-ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, CodeFeatures features, int numConstants)
>+ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, CodeFeatures features, int numConstants)
>     : StatementNode(endLocation)
>     , ParserArenaRoot(parserArena)
>+    , LexicalNode(lexicalVariables, lexicalCaptures)
>     , m_startLineNumber(startLocation.line)
>     , m_startStartOffset(startLocation.startOffset)
>     , m_startLineStartOffset(startLocation.lineStartOffset)
>@@ -117,8 +118,8 @@ StatementNode* ScopeNode::singleStatemen
> 
> // ------------------------------ ProgramNode -----------------------------
> 
>-ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>@@ -131,8 +132,8 @@ void ProgramNode::setClosedVariables(Vec
> 
> // ------------------------------ EvalNode -----------------------------
> 
>-EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_endColumn(endColumn)
> {
> }
>@@ -201,8 +202,8 @@ void FunctionBodyNode::setEndPosition(JS
> 
> // ------------------------------ FunctionNode -----------------------------
> 
>-FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, features, numConstants)
>+FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, IdentifierSet& lexicalVariables, IdentifierSet& lexicalCaptures, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, lexicalVariables, lexicalCaptures, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>@@ -216,4 +217,10 @@ void FunctionNode::finishParsing(PassRef
>     m_functionMode = functionMode;
> }
> 
>+LexicalNode::LexicalNode(IdentifierSet& lexicalDeclaredVariables, IdentifierSet& capturedVariables)
>+{
>+    m_lexicalVariables.swap(lexicalDeclaredVariables);
>+    m_lexicalCaptures.swap(capturedVariables);
>+}
>+
> } // namespace JSC
>Index: Source/JavaScriptCore/parser/Nodes.h
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/Nodes.h	(working copy)
>@@ -30,6 +30,7 @@
> #include "JITCode.h"
> #include "Opcode.h"
> #include "ParserArena.h"
>+#include "ParserModes.h"
> #include "ParserTokens.h"
> #include "ResultType.h"
> #include "SourceCode.h"
>@@ -76,8 +77,6 @@ namespace JSC {
>     };
>     inline FallThroughMode invert(FallThroughMode fallThroughMode) { return static_cast<FallThroughMode>(!fallThroughMode); }
> 
>-    typedef HashSet<RefPtr<StringImpl>, IdentifierRepHash> IdentifierSet;
>-
>     namespace DeclarationStacks {
>         enum VarAttrs { IsConstant = 1, HasInitializer = 2 };
>         typedef Vector<std::pair<Identifier, unsigned>> VarStack;
>@@ -202,6 +201,22 @@ namespace JSC {
>         int m_lastLine;
>     };
> 
>+    class LexicalNode {
>+    public:
>+        LexicalNode()
>+        {
>+        }
>+
>+        LexicalNode(IdentifierSet& lexicalDeclaredVariables, IdentifierSet& capturedVariables);
>+
>+        const IdentifierSet& lexicalVariables() { return m_lexicalVariables; }
>+        const IdentifierSet& lexicalCaptures() { return m_lexicalCaptures; }
>+
>+    protected:
>+        IdentifierSet m_lexicalVariables;
>+        IdentifierSet m_lexicalCaptures;
>+    };
>+
>     class ConstantNode : public ExpressionNode {
>     public:
>         ConstantNode(const JSTokenLocation&, ResultType);
>@@ -1058,13 +1073,14 @@ namespace JSC {
> 
>     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
>     public:
>-        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right);
>+        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right, bool isInVariableDeclaration);
> 
>     private:
>         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         const Identifier& m_ident;
>         ExpressionNode* m_right;
>+        bool m_isInVariableDeclaration;
>     };
> 
>     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
>@@ -1192,9 +1208,9 @@ namespace JSC {
>         StatementNode* m_tail;
>     };
> 
>-    class BlockNode : public StatementNode {
>+    class BlockNode : public StatementNode, public LexicalNode {
>     public:
>-        BlockNode(const JSTokenLocation&, SourceElements* = 0);
>+        BlockNode(const JSTokenLocation&, SourceElements*, IdentifierSet&, IdentifierSet&);
> 
>         StatementNode* singleStatement() const;
>         StatementNode* lastStatement() const;
>@@ -1250,12 +1266,13 @@ namespace JSC {
> 
>     class EmptyVarExpression : public ExpressionNode {
>     public:
>-        EmptyVarExpression(const JSTokenLocation&, const Identifier&);
>+        EmptyVarExpression(const JSTokenLocation&, const Identifier&, bool isInLexicalDeclaration);
> 
>     private:
>         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         const Identifier& m_ident;
>+        bool m_isInLexicalDeclaration;
>     };
> 
> 
>@@ -1295,9 +1312,9 @@ namespace JSC {
>         StatementNode* m_statement;
>     };
> 
>-    class ForNode : public StatementNode {
>+    class ForNode : public StatementNode, public LexicalNode {
>     public:
>-        ForNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*);
>+        ForNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*, IdentifierSet&, IdentifierSet&);
> 
>     private:
>         virtual void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -1310,9 +1327,9 @@ namespace JSC {
>     
>     class DeconstructionPatternNode;
>     
>-    class EnumerationNode : public StatementNode, public ThrowableExpressionData {
>+    class EnumerationNode : public StatementNode, public ThrowableExpressionData, public LexicalNode {
>     public:
>-        EnumerationNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        EnumerationNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, IdentifierSet&, IdentifierSet&);
>         
>     protected:
>         ExpressionNode* m_lexpr;
>@@ -1322,7 +1339,7 @@ namespace JSC {
>     
>     class ForInNode : public EnumerationNode {
>     public:
>-        ForInNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        ForInNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, IdentifierSet&, IdentifierSet&);
> 
>     private:
>         RegisterID* tryGetBoundLocal(BytecodeGenerator&);
>@@ -1334,7 +1351,7 @@ namespace JSC {
>     
>     class ForOfNode : public EnumerationNode {
>     public:
>-        ForOfNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        ForOfNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, IdentifierSet&, IdentifierSet&);
>         
>     private:
>         virtual void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -1438,13 +1455,13 @@ namespace JSC {
>         ParameterNode* m_next;
>     };
> 
>-    class ScopeNode : public StatementNode, public ParserArenaRoot {
>+    class ScopeNode : public StatementNode, public ParserArenaRoot, public LexicalNode {
>     public:
>         typedef DeclarationStacks::VarStack VarStack;
>         typedef DeclarationStacks::FunctionStack FunctionStack;
> 
>         ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, bool inStrictContext);
>-        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, CodeFeatures, int numConstants);
>+        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, CodeFeatures, int numConstants);
> 
>         using ParserArenaRoot::operator new;
> 
>@@ -1507,7 +1524,7 @@ namespace JSC {
> 
>     class ProgramNode : public ScopeNode {
>     public:
>-        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         unsigned startColumn() const { return m_startColumn; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1526,7 +1543,7 @@ namespace JSC {
> 
>     class EvalNode : public ScopeNode {
>     public:
>-        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         ALWAYS_INLINE unsigned startColumn() const { return 0; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1600,6 +1617,7 @@ namespace JSC {
>         Identifier m_inferredName;
>         FunctionMode m_functionMode;
>         RefPtr<FunctionParameters> m_parameters;
>+        IdentifierSet m_parentScopeTDZVariables;
>         unsigned m_startColumn;
>         unsigned m_endColumn;
>         int m_functionKeywordStart;
>@@ -1613,7 +1631,7 @@ namespace JSC {
> 
>     class FunctionNode final : public ScopeNode {
>     public:
>-        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, IdentifierSet&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         FunctionParameters* parameters() const { return m_parameters.get(); }
> 
>Index: Source/JavaScriptCore/parser/Parser.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.cpp	(revision 182773)
>+++ Source/JavaScriptCore/parser/Parser.cpp	(working copy)
>@@ -264,6 +264,8 @@ String Parser<LexerType>::parseInner()
>     if (m_lexer->isReparsing())
>         m_statementDepth--;
>     ScopeRef scope = currentScope();
>+    scope->setIsLexicalScope();
>+
>     SourceElements* sourceElements = parseSourceElements(context, CheckForStrictMode);
>     if (!sourceElements || !consume(EOFTOK)) {
>         if (hasError())
>@@ -374,9 +376,9 @@ template <class TreeBuilder> TreeSourceE
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVarDeclaration(TreeBuilder& context)
>+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVariableDeclaration(TreeBuilder& context, DeclarationType type)
> {
>-    ASSERT(match(VAR));
>+    ASSERT(match(VAR) || match(LET));
>     JSTokenLocation location(tokenLocation());
>     int start = tokenLine();
>     int end = 0;
>@@ -384,11 +386,14 @@ template <class TreeBuilder> TreeStateme
>     TreeDeconstructionPattern scratch1 = 0;
>     TreeExpression scratch2 = 0;
>     JSTextPosition scratch3;
>-    TreeExpression varDecls = parseVarDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext);
>+    TreeExpression decls = parseVariableDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext, type);
>     propagateError();
>     failIfFalse(autoSemiColon(), "Expected ';' after var declaration");
>     
>-    return context.createVarStatement(location, varDecls, start, end);
>+    if (type == VarDeclaration)
>+        return context.createVarStatement(location, decls, start, end);
>+    else 
>+        return context.createLetStatement(location, decls, start, end);
> }
> 
> template <typename LexerType>
>@@ -453,7 +458,7 @@ template <class TreeBuilder> TreeStateme
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext)
>+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVariableDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext, DeclarationType declarationType)
> {
>     TreeExpression head = 0;
>     TreeExpression tail = 0;
>@@ -467,7 +472,7 @@ template <class TreeBuilder> TreeExpress
>         TreeExpression node = 0;
>         declarations++;
>         bool hasInitializer = false;
>-        if (match(IDENT)) {
>+        if (match(IDENT) || isLETMaskedAsIDENT()) {
>             JSTextPosition varStart = tokenStartPosition();
>             JSTokenLocation varStartLocation(tokenLocation());
>             identStart = varStart;
>@@ -476,7 +481,7 @@ template <class TreeBuilder> TreeExpress
>             lastIdentToken = m_token;
>             next();
>             hasInitializer = match(EQUAL);
>-            failIfFalseIfStrict(declareVariable(name), "Cannot declare a variable named ", name->impl(), " in strict mode");
>+            failIfFalseIfStrict(declareVariable(name, declarationType), "Cannot declare a variable named ", name->impl(), " in strict mode");
>             context.addVar(name, (hasInitializer || (!m_allowsIn && (match(INTOKEN) || isofToken()))) ? DeclarationStacks::HasInitializer : 0);
>             if (hasInitializer) {
>                 JSTextPosition varDivot = tokenStartPosition() + 1;
>@@ -487,12 +492,12 @@ template <class TreeBuilder> TreeExpress
>                 lastInitializer = initializer;
>                 failIfFalse(initializer, "Expected expression as the intializer for the variable '", name->impl(), "'");
>                 
>-                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition());
>+                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition(), true);
>             } else
>-                node = context.createEmptyVarExpression(varStartLocation, *name);
>+                node = context.createEmptyVarExpression(varStartLocation, *name, declarationType == LetDeclaration);
>         } else {
>             lastIdent = 0;
>-            auto pattern = parseDeconstructionPattern(context, DeconstructToVariables);
>+            auto pattern = parseDeconstructionPattern(context, declarationType == VarDeclaration ? DeconstructToVariables : DeconstructToLexicalVariables);
>             failIfFalse(pattern, "Cannot parse this deconstruction pattern");
>             hasInitializer = match(EQUAL);
>             failIfTrue(declarationListContext == VarDeclarationContext && !hasInitializer, "Expected an initializer in destructuring variable declaration");
>@@ -513,8 +518,10 @@ template <class TreeBuilder> TreeExpress
>         } else
>             tail = context.appendToCommaExpr(location, head, tail, node);
>     } while (match(COMMA));
>+    // FIXME: consider that this causes the last variable in each declaration list to be declared twice.
>     if (lastIdent)
>-        lastPattern = createBindingPattern(context, DeconstructToVariables, *lastIdent, 0, lastIdentToken);
>+        lastPattern = createBindingPattern(context, declarationType == VarDeclaration ? DeconstructToVariables : DeconstructToLexicalVariables, *lastIdent, 0, lastIdentToken);
>+
>     return head;
> }
> 
>@@ -528,7 +535,9 @@ template <class TreeBuilder> TreeDeconst
>     if (depth) {
>         if (kind == DeconstructToVariables)
>             failIfFalseIfStrict(declareVariable(&name), "Cannot deconstruct to a variable named '", name.impl(), "' in strict mode");
>-        if (kind == DeconstructToParameters) {
>+        else if (kind == DeconstructToLexicalVariables)
>+            failIfFalseIfStrict(declareVariable(&name, LetDeclaration), "Cannot deconstruct to a variable named '", name.impl(), "' in strict mode");
>+        else if (kind == DeconstructToParameters) {
>             auto bindingResult = declareBoundParameter(&name);
>             if (bindingResult == Scope::StrictBindingFailed && strictMode()) {
>                 semanticFailIfTrue(m_vm->propertyNames->arguments == name || m_vm->propertyNames->eval == name, "Cannot deconstruct to a parameter name '", name.impl(), "' in strict mode");
>@@ -546,16 +555,16 @@ template <class TreeBuilder> TreeDeconst
>                 semanticFail("Cannot deconstruct to a parameter named '", name.impl(), "'");
>             }
>         }
>-        if (kind != DeconstructToExpressions)
>+        if (kind != DeconstructToExpressions && kind != DeconstructToLexicalVariables)
>             context.addVar(&name, DeclarationStacks::HasInitializer);
> 
>     } else {
>         if (kind == DeconstructToVariables) {
>             failIfFalseIfStrict(declareVariable(&name), "Cannot declare a variable named '", name.impl(), "' in strict mode");
>             context.addVar(&name, DeclarationStacks::HasInitializer);
>-        }
>-        
>-        if (kind == DeconstructToParameters) {
>+        } else if (kind == DeconstructToLexicalVariables)
>+            failIfFalseIfStrict(declareVariable(&name, LetDeclaration), "Cannot declare a variable named '", name.impl(), "' in strict mode");
>+        else if (kind == DeconstructToParameters) {
>             bool declarationResult = declareParameter(&name);
>             if (!declarationResult && strictMode()) {
>                 semanticFailIfTrue(m_vm->propertyNames->arguments == name || m_vm->propertyNames->eval == name, "Cannot deconstruct to a parameter name '", name.impl(), "' in strict mode");
>@@ -677,7 +686,7 @@ template <class TreeBuilder> TreeDeconst
>     }
> 
>     default: {
>-        if (!match(IDENT)) {
>+        if (!match(IDENT) && !isLETMaskedAsIDENT()) {
>             if (kind == DeconstructToExpressions)
>                 return 0;
>             semanticFailureDueToKeyword("variable name");
>@@ -735,17 +744,50 @@ template <class TreeBuilder> TreeStateme
>     JSTextPosition declsEnd;
>     TreeExpression decls = 0;
>     TreeDeconstructionPattern pattern = 0;
>-    if (match(VAR)) {
>+    bool isVarDeclaraton = match(VAR);
>+    bool isLetDeclaration = match(LET);
>+
>+    IdentifierSet dummySet;
>+    IdentifierSet* lexicalVariables = nullptr;
>+    IdentifierSet* lexicalCaptures = nullptr;
>+    AutoCleanupLexicalScope lexicalScope;
>+
>+    auto gatherLexicalVariablesIfNecessary = [&] () {
>+        if (isLetDeclaration) {
>+            ScopeRef scope = lexicalScope.scope();
>+            lexicalVariables = &scope->lexicallyDeclaredVariables();
>+            lexicalCaptures = &scope->lexicallyCapturedVariables();
>+        } else {
>+            lexicalVariables = &dummySet;
>+            lexicalCaptures = &dummySet;
>+        }
>+    };
>+
>+    auto popLexicalScopeIfNecessary = [&] () -> bool {
>+        if (isLetDeclaration)
>+            return popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
>+
>+        return true;
>+    };
>+
>+    if (isVarDeclaraton || isLetDeclaration) {
>         /*
>-         for (var IDENT in expression) statement
>-         for (var varDeclarationList; expressionOpt; expressionOpt)
>+         for (var/let IDENT in expression) statement
>+         for (var/let varDeclarationList; expressionOpt; expressionOpt)
>          */
>+        if (isLetDeclaration) {
>+            ScopeRef newScope = pushScope();
>+            newScope->setIsLexicalScope();
>+            newScope->preventVarDeclarations();
>+            lexicalScope.setIsValid(newScope, this);
>+        }
>+
>         TreeDeconstructionPattern forInTarget = 0;
>         TreeExpression forInInitializer = 0;
>         m_allowsIn = false;
>         JSTextPosition initStart;
>         JSTextPosition initEnd;
>-        decls = parseVarDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext);
>+        decls = parseVariableDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext, isVarDeclaraton ? VarDeclaration : LetDeclaration);
>         m_allowsIn = true;
>         propagateError();
> 
>@@ -781,9 +823,14 @@ template <class TreeBuilder> TreeStateme
>         TreeStatement statement = parseStatement(context, unused);
>         endLoop();
>         failIfFalse(statement, "Expected statement as body of for-", isOfEnumeration ? "of" : "in", " statement");
>+        gatherLexicalVariablesIfNecessary();
>+        TreeStatement result;
>         if (isOfEnumeration)
>-            return context.createForOfLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine);
>-        return context.createForInLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine);
>+            result = context.createForOfLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+        else
>+            result = context.createForInLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+        failIfFalse(popLexicalScopeIfNecessary(), "Parser error");
>+        return result;
>     }
>     
>     if (!match(SEMICOLON)) {
>@@ -829,10 +876,13 @@ template <class TreeBuilder> TreeStateme
>         TreeStatement statement = parseStatement(context, unused);
>         endLoop();
>         failIfFalse(statement, "Expected a statement as the body of a for loop");
>-        return context.createForLoop(location, decls, condition, increment, statement, startLine, endLine);
>+        gatherLexicalVariablesIfNecessary();
>+        TreeStatement result = context.createForLoop(location, decls, condition, increment, statement, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+        failIfFalse(popLexicalScopeIfNecessary(), "Parser error");
>+        return result;
>     }
>     
>-    // For-in loop
>+    // For-in and For-of loop
> enumerationLoop:
>     failIfFalse(nonLHSCount == m_nonLHSCount, "Expected a reference on the left hand side of an enumeration statement");
>     bool isOfEnumeration = false;
>@@ -852,15 +902,24 @@ enumerationLoop:
>     TreeStatement statement = parseStatement(context, unused);
>     endLoop();
>     failIfFalse(statement, "Expected a statement as the body of a for-", isOfEnumeration ? "of" : "in", "loop");
>+    gatherLexicalVariablesIfNecessary();
>+    TreeStatement result;
>     if (pattern) {
>         ASSERT(!decls);
>         if (isOfEnumeration)
>-            return context.createForOfLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>-        return context.createForInLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>+            result = context.createForOfLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+        else 
>+            result = context.createForInLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+
>+        failIfFalse(popLexicalScopeIfNecessary(), "Parser error");
>+        return result;
>     }
>     if (isOfEnumeration)
>-        return context.createForOfLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>-    return context.createForInLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>+        result = context.createForOfLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+    else
>+        result = context.createForInLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables, *lexicalCaptures);
>+    failIfFalse(popLexicalScopeIfNecessary(), "Parser error");
>+    return result;
> }
> 
> template <typename LexerType>
>@@ -1077,7 +1136,7 @@ template <class TreeBuilder> TreeStateme
>         next();
>         
>         handleProductionOrFail(OPENPAREN, "(", "start", "'catch' target");
>-        if (!match(IDENT)) {
>+        if (!(match(IDENT) || isLETMaskedAsIDENT())) {
>             semanticFailureDueToKeyword("catch variable name");
>             failWithMessage("Expected identifier name as catch target");
>         }
>@@ -1085,7 +1144,7 @@ template <class TreeBuilder> TreeStateme
>         next();
>         AutoPopScopeRef catchScope(this, pushScope());
>         failIfFalseIfStrict(declareVariable(ident), "Cannot declare a catch variable named '", ident->impl(), "' in strict mode");
>-        catchScope->preventNewDecls();
>+        catchScope->preventAllVariableDeclarations(); // FIXME: Probably should just preventVarDeclarations and make catchScope a lexical scope.
>         handleProductionOrFail(CLOSEPAREN, ")", "end", "'catch' target");
>         matchOrFail(OPENBRACE, "Expected exception handler to be a block statement");
>         catchBlock = parseBlockStatement(context);
>@@ -1121,16 +1180,31 @@ template <typename LexerType>
> template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBlockStatement(TreeBuilder& context)
> {
>     ASSERT(match(OPENBRACE));
>+
>+    // This is hacky, but we should treat the first block statement of the function (the body of the function)
>+    // as the lexical scope of the function itself, and not the lexical scope of a 'block' statement within
>+    // a function.
>+    AutoCleanupLexicalScope lexicalScope;
>+    bool shouldPushLexicalScope = m_statementDepth > 0;
>+    if (shouldPushLexicalScope) {
>+        ScopeRef newScope = pushScope();
>+        newScope->setIsLexicalScope();
>+        newScope->preventVarDeclarations();
>+        lexicalScope.setIsValid(newScope, this);
>+    }
>     JSTokenLocation location(tokenLocation());
>     int startOffset = m_token.m_data.offset;
>     int start = tokenLine();
>+    IdentifierSet dummyIdentifierSet;
>     next();
>     if (match(CLOSEBRACE)) {
>         int endOffset = m_token.m_data.offset;
>         next();
>-        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line);
>+        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->lexicallyDeclaredVariables() : dummyIdentifierSet, shouldPushLexicalScope ? currentScope()->lexicallyCapturedVariables() : dummyIdentifierSet);
>         context.setStartOffset(result, startOffset);
>         context.setEndOffset(result, endOffset);
>+        if (shouldPushLexicalScope)
>+            failIfFalse(popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>         return result;
>     }
>     TreeSourceElements subtree = parseSourceElements(context, DontCheckForStrictMode);
>@@ -1138,9 +1212,12 @@ template <class TreeBuilder> TreeStateme
>     matchOrFail(CLOSEBRACE, "Expected a closing '}' at the end of a block statement");
>     int endOffset = m_token.m_data.offset;
>     next();
>-    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line);
>+    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->lexicallyDeclaredVariables() : dummyIdentifierSet, shouldPushLexicalScope ? currentScope()->lexicallyCapturedVariables() : dummyIdentifierSet);
>     context.setStartOffset(result, startOffset);
>     context.setEndOffset(result, endOffset);
>+    if (shouldPushLexicalScope)
>+        failIfFalse(popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>+
>     return result;
> }
> 
>@@ -1160,7 +1237,7 @@ template <class TreeBuilder> TreeStateme
>         shouldSetEndOffset = false;
>         break;
>     case VAR:
>-        result = parseVarDeclaration(context);
>+        result = parseVariableDeclaration(context, VarDeclaration);
>         break;
>     case CONSTTOKEN:
>         result = parseConstDeclaration(context);
>@@ -1223,6 +1300,13 @@ template <class TreeBuilder> TreeStateme
>     case DEFAULT:
>         // These tokens imply the end of a set of source elements
>         return 0;
>+    case LET:
>+        // FIXME: make sure that sloppy mode has 'let' parse as IDENT and not default.
>+        if (strictMode()) {
>+            result = parseVariableDeclaration(context, LetDeclaration);
>+            break;
>+        }
>+        FALLTHROUGH;
>     case IDENT:
>         result = parseExpressionOrLabelStatement(context);
>         break;
>@@ -1306,7 +1390,7 @@ template <class TreeBuilder> bool Parser
>     int functionNameStart = m_token.m_location.startOffset;
>     const Identifier* lastFunctionName = m_lastFunctionName;
>     m_lastFunctionName = nullptr;
>-    if (match(IDENT)) {
>+    if (match(IDENT) || isLETMaskedAsIDENT()) {
>         info.name = m_token.m_data.ident;
>         m_lastFunctionName = info.name;
>         next();
>@@ -1374,7 +1458,7 @@ template <class TreeBuilder> bool Parser
>             endLocation.startOffset - m_token.m_data.lineStartOffset :
>             endLocation.startOffset - endLocation.lineStartOffset;
>         unsigned currentLineStartOffset = m_token.m_location.lineStartOffset;
>-
>+        
>         info.body = context.createFunctionBody(
>             startLocation, endLocation, info.bodyStartColumn, bodyEndColumn, 
>             functionKeywordStart, functionNameStart, parametersStart, 
>@@ -1433,7 +1517,6 @@ template <class TreeBuilder> bool Parser
>         parameters.closeBraceLineStartOffset = closeBraceLineStartOffset;
>         functionScope->fillParametersForSourceProviderCache(parameters);
>         newInfo = SourceProviderCacheItem::create(parameters);
>-
>     }
>     
>     failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>@@ -1637,7 +1720,7 @@ template <class TreeBuilder> TreeStateme
>             failIfTrue(getLabel(ident), "Cannot find scope for the label '", ident->impl(), "'");
>             labels.append(LabelInfo(ident, start, end));
>         }
>-    } while (match(IDENT));
>+    } while (match(IDENT) || isLETMaskedAsIDENT());
>     bool isLoop = false;
>     switch (m_token.m_type) {
>     case FOR:
>@@ -1650,6 +1733,7 @@ template <class TreeBuilder> TreeStateme
>         break;
>     }
>     const Identifier* unused = 0;
>+    ScopeRef labelScope = currentScope();
>     if (!m_syntaxAlreadyValidated) {
>         for (size_t i = 0; i < labels.size(); i++)
>             pushLabel(labels[i].m_ident, isLoop);
>@@ -1657,7 +1741,7 @@ template <class TreeBuilder> TreeStateme
>     TreeStatement statement = parseStatement(context, unused);
>     if (!m_syntaxAlreadyValidated) {
>         for (size_t i = 0; i < labels.size(); i++)
>-            popLabel();
>+            popLabel(labelScope);
>     }
>     failIfFalse(statement, "Cannot parse statement");
>     for (size_t i = 0; i < labels.size(); i++) {
>@@ -2296,6 +2380,7 @@ template <class TreeBuilder> TreeExpress
>         return context.thisExpr(location, m_thisTDZMode);
>     }
>     case IDENT: {
>+    identifierExpression:
>         JSTextPosition start = tokenStartPosition();
>         const Identifier* ident = m_token.m_data.ident;
>         JSTokenLocation location(tokenLocation());
>@@ -2357,6 +2442,11 @@ template <class TreeBuilder> TreeExpress
>         }
>         return re;
>     }
>+    case LET: {
>+        if (!strictMode())
>+            goto identifierExpression;
>+        FALLTHROUGH;
>+    }
>     default:
>         failDueToUnexpectedToken();
>     }
>Index: Source/JavaScriptCore/parser/Parser.h
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/Parser.h	(working copy)
>@@ -89,6 +89,7 @@ enum FunctionParseMode {
> };
> enum DeconstructionKind {
>     DeconstructToVariables,
>+    DeconstructToLexicalVariables,
>     DeconstructToParameters,
>     DeconstructToExpressions
> };
>@@ -115,9 +116,11 @@ struct Scope {
>         , m_needsFullActivation(false)
>         , m_hasDirectSuper(false)
>         , m_needsSuperBinding(false)
>-        , m_allowsNewDecls(true)
>+        , m_allowsVarDeclarations(true)
>+        , m_allowsLexicalDeclarations(true)
>         , m_strictMode(strictMode)
>         , m_isFunction(isFunction)
>+        , m_isLexicalScope(false)
>         , m_isFunctionBoundary(false)
>         , m_isValidStrictMode(true)
>         , m_loopDepth(0)
>@@ -132,9 +135,11 @@ struct Scope {
>         , m_needsFullActivation(rhs.m_needsFullActivation)
>         , m_hasDirectSuper(rhs.m_hasDirectSuper)
>         , m_needsSuperBinding(rhs.m_needsSuperBinding)
>-        , m_allowsNewDecls(rhs.m_allowsNewDecls)
>+        , m_allowsVarDeclarations(rhs.m_allowsVarDeclarations)
>+        , m_allowsLexicalDeclarations(rhs.m_allowsLexicalDeclarations)
>         , m_strictMode(rhs.m_strictMode)
>         , m_isFunction(rhs.m_isFunction)
>+        , m_isLexicalScope(rhs.m_isLexicalScope)
>         , m_isFunctionBoundary(rhs.m_isFunctionBoundary)
>         , m_isValidStrictMode(rhs.m_isValidStrictMode)
>         , m_loopDepth(rhs.m_loopDepth)
>@@ -187,9 +192,34 @@ struct Scope {
>     {
>         m_isFunction = true;
>         m_isFunctionBoundary = true;
>+        setIsLexicalScope();
>+    }
>+
>+    bool isFunction() const { return m_isFunction; }
>+    bool isFunctionBoundary() const { return m_isFunctionBoundary; }
>+
>+    void setIsLexicalScope() 
>+    { 
>+        m_isLexicalScope = true;
>+        m_allowsLexicalDeclarations = true;
>+    }
>+    bool isLexicalScope() { return m_isLexicalScope; }
>+    IdentifierSet& lexicallyDeclaredVariables() { return m_lexicallyDeclaredVariables; }
>+    IdentifierSet& lexicallyCapturedVariables()
>+    {
>+        if (m_usesEval) {
>+            m_lexicalCaptures = m_lexicallyDeclaredVariables;
>+            return m_lexicalCaptures; 
>+        }
>+
>+        IdentifierSet::iterator end = m_lexicallyDeclaredVariables.end();
>+        for (IdentifierSet::iterator ptr = m_lexicallyDeclaredVariables.begin(); ptr != end; ++ptr) {
>+            if (m_closedVariables.contains(*ptr))
>+                m_lexicalCaptures.add(*ptr);
>+        }
>+
>+        return m_lexicalCaptures;
>     }
>-    bool isFunction() { return m_isFunction; }
>-    bool isFunctionBoundary() { return m_isFunctionBoundary; }
> 
>     void declareCallee(const Identifier* ident)
>     {
>@@ -204,6 +234,14 @@ struct Scope {
>         return isValidStrictMode;
>     }
> 
>+    bool declareLexicalVariable(const Identifier* ident)
>+    {
>+        bool isValidStrictMode = m_vm->propertyNames->eval != *ident && m_vm->propertyNames->arguments != *ident;
>+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
>+        m_lexicallyDeclaredVariables.add(ident->string().impl());
>+        return isValidStrictMode;
>+    }
>+
>     bool hasDeclaredVariable(const Identifier& ident)
>     {
>         return m_declaredVariables.contains(ident.impl());
>@@ -220,8 +258,14 @@ struct Scope {
>         m_writtenVariables.add(ident->impl());
>     }
> 
>-    void preventNewDecls() { m_allowsNewDecls = false; }
>-    bool allowsNewDecls() const { return m_allowsNewDecls; }
>+    void preventAllVariableDeclarations()
>+    {
>+        m_allowsVarDeclarations = false; 
>+        m_allowsLexicalDeclarations = false;
>+    }
>+    void preventVarDeclarations() { m_allowsVarDeclarations = false; }
>+    bool allowsVarDeclarations() const { return m_allowsVarDeclarations; }
>+    bool allowsLexicalDeclarations() const { return m_allowsLexicalDeclarations; }
> 
>     bool declareParameter(const Identifier* ident)
>     {
>@@ -266,6 +310,7 @@ struct Scope {
>     }
> 
>     void setNeedsFullActivation() { m_needsFullActivation = true; }
>+    bool needsFullActivation() const { return m_needsFullActivation; }
> 
> #if ENABLE(ES6_CLASS_SYNTAX)
>     bool hasDirectSuper() { return m_hasDirectSuper; }
>@@ -287,16 +332,28 @@ struct Scope {
>             m_usesEval = true;
>         IdentifierSet::iterator end = nestedScope->m_usedVariables.end();
>         for (IdentifierSet::iterator ptr = nestedScope->m_usedVariables.begin(); ptr != end; ++ptr) {
>-            if (nestedScope->m_declaredVariables.contains(*ptr))
>+            if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                 continue;
>             m_usedVariables.add(*ptr);
>-            if (shouldTrackClosedVariables)
>+            // We don't want a declared variable that is used in an inner scope to be thought of as captured if
>+            // that inner scope is both a lexical scope and not a function. Only inner functions 
>+            // and "catch" statements can capture variables.
>+            if (shouldTrackClosedVariables && (nestedScope->m_isFunctionBoundary || !nestedScope->m_isLexicalScope))
>+                m_closedVariables.add(*ptr);
>+        }
>+
>+        if (nestedScope->m_isLexicalScope && !nestedScope->m_isFunctionBoundary) {
>+            // Propagate closed variables downwards from nested block scopes within the same function/global code.
>+            IdentifierSet::iterator end = nestedScope->m_closedVariables.end();
>+            for (IdentifierSet::iterator ptr = nestedScope->m_closedVariables.begin(); ptr != end; ++ptr)
>                 m_closedVariables.add(*ptr);
>         }
>+
>         if (nestedScope->m_writtenVariables.size()) {
>             IdentifierSet::iterator end = nestedScope->m_writtenVariables.end();
>             for (IdentifierSet::iterator ptr = nestedScope->m_writtenVariables.begin(); ptr != end; ++ptr) {
>-                if (nestedScope->m_declaredVariables.contains(*ptr))
>+                // FIXME: make sure this is correct here.
>+                if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicallyDeclaredVariables.contains(*ptr))
>                     continue;
>                 m_writtenVariables.add(*ptr);
>             }
>@@ -376,9 +433,11 @@ private:
>     bool m_needsFullActivation : 1;
>     bool m_hasDirectSuper : 1;
>     bool m_needsSuperBinding : 1;
>-    bool m_allowsNewDecls : 1;
>+    bool m_allowsVarDeclarations : 1;
>+    bool m_allowsLexicalDeclarations : 1;
>     bool m_strictMode : 1;
>     bool m_isFunction : 1;
>+    bool m_isLexicalScope : 1;
>     bool m_isFunctionBoundary : 1;
>     bool m_isValidStrictMode : 1;
>     int m_loopDepth;
>@@ -388,8 +447,10 @@ private:
>     std::unique_ptr<LabelStack> m_labels;
>     IdentifierSet m_declaredParameters;
>     IdentifierSet m_declaredVariables;
>+    IdentifierSet m_lexicallyDeclaredVariables;
>     IdentifierSet m_usedVariables;
>     IdentifierSet m_closedVariables;
>+    IdentifierSet m_lexicalCaptures;
>     IdentifierSet m_writtenVariables;
> };
> 
>@@ -437,6 +498,7 @@ public:
> 
>     JSTextPosition positionBeforeLastNewline() const { return m_lexer->positionBeforeLastNewline(); }
>     Vector<RefPtr<StringImpl>>&& closedVariables() { return WTF::move(m_closedVariables); }
>+    enum DeclarationType { VarDeclaration, LetDeclaration };
> 
> private:
>     struct AllowInOverride {
>@@ -476,6 +538,47 @@ private:
>         Parser* m_parser;
>     };
> 
>+    struct AutoCleanupLexicalScope {
>+        // We can allocate this object on the stack without actually knowing beforehand
>+        // if we're going to create a new scope. If we decide to create a new scope, we
>+        // can pass the scope into this obejct and it will take care of the cleanup for us.
>+        // This is helpful if we may fail from syntax errors after creating a scope conditionally.
>+        AutoCleanupLexicalScope()
>+            : m_scope(nullptr, UINT_MAX)
>+            , m_parser(nullptr)
>+        {
>+        }
>+
>+        ~AutoCleanupLexicalScope()
>+        {
>+            // This should only ever be called if we fail from a syntax error. Otherwise
>+            // it's the intention that a user of this interface pops this scope manually 
>+            // on a successful parse. 
>+            if (m_parser)
>+                m_parser->popScope(*this, false);
>+        }
>+
>+        void setIsValid(ScopeRef& scope, Parser* parser)
>+        {
>+            RELEASE_ASSERT(scope->isLexicalScope());
>+            m_scope = scope;
>+            m_parser = parser;
>+        }
>+
>+        bool isValid() const { return !!m_parser; }
>+
>+        void setPopped()
>+        {
>+            m_parser = nullptr;
>+        }
>+
>+        ScopeRef& scope() { return m_scope; }
>+
>+    private:
>+        ScopeRef m_scope;
>+        Parser* m_parser;
>+    };
>+
>     ScopeRef currentScope()
>     {
>         return ScopeRef(&m_scopeStack, m_scopeStack.size() - 1);
>@@ -498,6 +601,8 @@ private:
>         ASSERT_UNUSED(scope, scope.index() == m_scopeStack.size() - 1);
>         ASSERT(m_scopeStack.size() > 1);
>         bool result = m_scopeStack[m_scopeStack.size() - 2].collectFreeVariables(&m_scopeStack.last(), shouldTrackClosedVariables);
>+        if (!m_scopeStack.last().isFunctionBoundary() && m_scopeStack.last().needsFullActivation())
>+            m_scopeStack[m_scopeStack.size() - 2].setNeedsFullActivation();
>         m_scopeStack.removeLast();
>         return result;
>     }
>@@ -512,23 +617,45 @@ private:
>         scope.setPopped();
>         return popScopeInternal(scope, shouldTrackClosedVariables);
>     }
>+
>+    bool popScope(AutoCleanupLexicalScope& cleanupScope, bool shouldTrackClosedVariables)
>+    {
>+        RELEASE_ASSERT(cleanupScope.isValid());
>+        ScopeRef& scope = cleanupScope.scope();
>+        cleanupScope.setPopped();
>+        bool result = popScopeInternal(scope, shouldTrackClosedVariables);
>+        return result;
>+    }
>     
>-    bool declareVariable(const Identifier* ident)
>+    bool declareVariable(const Identifier* ident, Parser::DeclarationType type = VarDeclaration)
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+
>+        if (type == VarDeclaration) {
>+            while (!m_scopeStack[i].allowsVarDeclarations()) {
>+                i--;
>+                ASSERT(i < m_scopeStack.size());
>+            }
>+
>+            return m_scopeStack[i].declareVariable(ident);
>+        }
>+
>+        ASSERT(type == LetDeclaration);
>+        while (!m_scopeStack[i].allowsLexicalDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>-        return m_scopeStack[i].declareVariable(ident);
>+
>+        return m_scopeStack[i].declareLexicalVariable(ident);
>     }
>     
>     NEVER_INLINE bool hasDeclaredVariable(const Identifier& ident)
>     {
>+        // FIXME: make work with lexical scoping.
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+        while (!m_scopeStack[i].allowsVarDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>@@ -539,7 +666,7 @@ private:
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+        while (!m_scopeStack[i].allowsVarDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>@@ -551,7 +678,7 @@ private:
>         if (!m_syntaxAlreadyValidated || strictMode())
>             m_scopeStack.last().declareWrite(ident);
>     }
>-    
>+
>     ScopeStack m_scopeStack;
>     
>     const SourceProviderCacheItem* findCachedFunctionInfo(int openBracePos) 
>@@ -709,7 +836,7 @@ private:
>         return true;
>     }
>     void pushLabel(const Identifier* label, bool isLoop) { currentScope()->pushLabel(label, isLoop); }
>-    void popLabel() { currentScope()->popLabel(); }
>+    void popLabel(ScopeRef scope) { scope->popLabel(); }
>     ScopeLabelInfo* getLabel(const Identifier* label)
>     {
>         ScopeRef current = currentScope();
>@@ -721,14 +848,19 @@ private:
>         }
>         return result;
>     }
>-    
>+
>+    ALWAYS_INLINE bool isLETMaskedAsIDENT()
>+    {
>+        return match(LET) && !strictMode();
>+    }
>+
>     template <class TreeBuilder> TreeSourceElements parseSourceElements(TreeBuilder&, SourceElementsMode);
>     template <class TreeBuilder> TreeStatement parseStatement(TreeBuilder&, const Identifier*& directive, unsigned* directiveLiteralLength = 0);
> #if ENABLE(ES6_CLASS_SYNTAX)
>     template <class TreeBuilder> TreeStatement parseClassDeclaration(TreeBuilder&);
> #endif
>     template <class TreeBuilder> TreeStatement parseFunctionDeclaration(TreeBuilder&);
>-    template <class TreeBuilder> TreeStatement parseVarDeclaration(TreeBuilder&);
>+    template <class TreeBuilder> TreeStatement parseVariableDeclaration(TreeBuilder&, DeclarationType);
>     template <class TreeBuilder> TreeStatement parseConstDeclaration(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseDoWhileStatement(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseWhileStatement(TreeBuilder&);
>@@ -765,7 +897,7 @@ private:
>     template <class TreeBuilder> ALWAYS_INLINE TreeFunctionBody parseFunctionBody(TreeBuilder&, int functionKeywordStart, int functionNameStart, int parametersStart, ConstructorKind);
>     template <class TreeBuilder> ALWAYS_INLINE TreeFormalParameterList parseFormalParameters(TreeBuilder&);
>     enum VarDeclarationListContext { ForLoopContext, VarDeclarationContext };
>-    template <class TreeBuilder> TreeExpression parseVarDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext);
>+    template <class TreeBuilder> TreeExpression parseVariableDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext, DeclarationType);
>     template <class TreeBuilder> NEVER_INLINE TreeConstDeclList parseConstDeclarationList(TreeBuilder&);
> 
>     template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern createBindingPattern(TreeBuilder&, DeconstructionKind, const Identifier&, int depth, JSToken);
>@@ -851,9 +983,7 @@ private:
>         m_assignmentCount = state.assignmentCount;
>         m_nonLHSCount = state.nonLHSCount;
>         m_nonTrivialExpressionCount = state.nonTrivialExpressionCount;
>-        
>     }
>-    
> 
>     VM* m_vm;
>     const SourceCode* m_source;
>@@ -952,6 +1082,8 @@ std::unique_ptr<ParsedNode> Parser<Lexer
>                                     m_varDeclarations,
>                                     m_funcDeclarations,
>                                     m_capturedVariables,
>+                                    currentScope()->lexicallyDeclaredVariables(),
>+                                    currentScope()->lexicallyCapturedVariables(),
>                                     *m_source,
>                                     m_features,
>                                     m_numConstants);
>Index: Source/JavaScriptCore/parser/ParserModes.h
>===================================================================
>--- Source/JavaScriptCore/parser/ParserModes.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/ParserModes.h	(working copy)
>@@ -84,6 +84,9 @@ const CodeFeatures ModifiedArgumentsFeat
> 
> const CodeFeatures AllFeatures = EvalFeature | ArgumentsFeature | WithFeature | CatchFeature | ThisFeature | StrictModeFeature | ShadowsArgumentsFeature | ModifiedParameterFeature;
> 
>+// FIXME: this is a crappy place for this.
>+typedef HashSet<RefPtr<StringImpl>, IdentifierRepHash> IdentifierSet;
>+
> } // namespace JSC
> 
> #endif // ParserModes_h
>Index: Source/JavaScriptCore/parser/ParserTokens.h
>===================================================================
>--- Source/JavaScriptCore/parser/ParserTokens.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/ParserTokens.h	(working copy)
>@@ -57,6 +57,7 @@ enum JSTokenType {
>     FOR,
>     NEW,
>     VAR,
>+    LET,
>     CONSTTOKEN,
>     CONTINUE,
>     FUNCTION,
>Index: Source/JavaScriptCore/parser/SyntaxChecker.h
>===================================================================
>--- Source/JavaScriptCore/parser/SyntaxChecker.h	(revision 182773)
>+++ Source/JavaScriptCore/parser/SyntaxChecker.h	(working copy)
>@@ -163,8 +163,8 @@ public:
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int, int, int) { return NewExpr; }
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int) { return NewExpr; }
>     ExpressionType createConditionalExpr(const JSTokenLocation&, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
>-    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int) { return AssignmentExpr; }
>-    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&) { return AssignmentExpr; }
>+    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int, bool) { return AssignmentExpr; }
>+    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&, bool) { return AssignmentExpr; }
> #if ENABLE(ES6_CLASS_SYNTAX)
>     ClassExpression createClassExpr(const JSTokenLocation&, const Identifier&, ExpressionType, ExpressionType, PropertyList, PropertyList) { return ClassExpr; }
> #endif
>@@ -206,15 +206,16 @@ public:
>     int createClassDeclStatement(const JSTokenLocation&, ClassExpression,
>         const JSTextPosition&, const JSTextPosition&, int, int) { return StatementResult; }
> #endif
>-    int createBlockStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createBlockStatement(const JSTokenLocation&, int, int, int, IdentifierSet&, IdentifierSet&) { return StatementResult; }
>     int createExprStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int, int) { return StatementResult; }
>-    int createForLoop(const JSTokenLocation&, int, int, int, int, int, int) { return StatementResult; }
>-    int createForInLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>-    int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>+    int createForLoop(const JSTokenLocation&, int, int, int, int, int, int, IdentifierSet&, IdentifierSet&) { return StatementResult; }
>+    int createForInLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int, IdentifierSet&, IdentifierSet&) { return StatementResult; }
>+    int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int, IdentifierSet& , IdentifierSet&) { return StatementResult; }
>     int createEmptyStatement(const JSTokenLocation&) { return StatementResult; }
>     int createVarStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createLetStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createReturnStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
>Index: Source/JavaScriptCore/runtime/CodeCache.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CodeCache.cpp	(revision 182773)
>+++ Source/JavaScriptCore/runtime/CodeCache.cpp	(working copy)
>@@ -76,7 +76,7 @@ template <> struct CacheTypes<UnlinkedEv
> 
> template <class UnlinkedCodeBlockType, class ExecutableType>
> UnlinkedCodeBlockType* CodeCache::getGlobalCodeBlock(VM& vm, ExecutableType* executable, const SourceCode& source, JSParserBuiltinMode builtinMode,
>-    JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
>+    JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error, const IdentifierSet* variablesUnderTDZ)
> {
>     SourceCodeKey key = SourceCodeKey(source, String(), CacheTypes<UnlinkedCodeBlockType>::codeType, builtinMode, strictMode, thisTDZMode);
>     SourceCodeValue* cache = m_sourceCode.findCacheAndUpdateAge(key);
>@@ -109,7 +109,7 @@ UnlinkedCodeBlockType* CodeCache::getGlo
>     UnlinkedCodeBlockType* unlinkedCodeBlock = UnlinkedCodeBlockType::create(&vm, executable->executableInfo());
>     unlinkedCodeBlock->recordParse(rootNode->features(), rootNode->hasCapturedVariables(), rootNode->firstLine() - source.firstLine(), lineCount, unlinkedEndColumn);
> 
>-    auto generator = std::make_unique<BytecodeGenerator>(vm, rootNode.get(), unlinkedCodeBlock, debuggerMode, profilerMode);
>+    auto generator = std::make_unique<BytecodeGenerator>(vm, rootNode.get(), unlinkedCodeBlock, debuggerMode, profilerMode, variablesUnderTDZ);
>     error = generator->generate();
>     if (error.isValid())
>         return nullptr;
>@@ -123,12 +123,13 @@ UnlinkedCodeBlockType* CodeCache::getGlo
> 
> UnlinkedProgramCodeBlock* CodeCache::getProgramCodeBlock(VM& vm, ProgramExecutable* executable, const SourceCode& source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
> {
>-    return getGlobalCodeBlock<UnlinkedProgramCodeBlock>(vm, executable, source, builtinMode, strictMode, ThisTDZMode::CheckIfNeeded, debuggerMode, profilerMode, error);
>+    IdentifierSet dummy;
>+    return getGlobalCodeBlock<UnlinkedProgramCodeBlock>(vm, executable, source, builtinMode, strictMode, ThisTDZMode::CheckIfNeeded, debuggerMode, profilerMode, error, &dummy);
> }
> 
>-UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(VM& vm, EvalExecutable* executable, const SourceCode& source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
>+UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(VM& vm, EvalExecutable* executable, const SourceCode& source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error, const IdentifierSet* variablesUnderTDZ)
> {
>-    return getGlobalCodeBlock<UnlinkedEvalCodeBlock>(vm, executable, source, builtinMode, strictMode, thisTDZMode, debuggerMode, profilerMode, error);
>+    return getGlobalCodeBlock<UnlinkedEvalCodeBlock>(vm, executable, source, builtinMode, strictMode, thisTDZMode, debuggerMode, profilerMode, error, variablesUnderTDZ);
> }
> 
> // FIXME: There's no need to add the function's name to the key here. It's already in the source code.
>@@ -171,7 +172,9 @@ UnlinkedFunctionExecutable* CodeCache::g
>         return nullptr;
>     
>     body->setEndPosition(positionBeforeLastNewline);
>-    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&vm, source, body, UnlinkedNormalFunction);
>+    // FIXME: this may not be correct if we're compiling a Function constructor.
>+    IdentifierSet dummyTDZVariables;
>+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&vm, source, body, UnlinkedNormalFunction, dummyTDZVariables);
>     functionExecutable->m_nameValue.set(vm, functionExecutable, jsString(&vm, name.string()));
> 
>     m_sourceCode.addCache(key, SourceCodeValue(vm, functionExecutable, m_sourceCode.age()));
>Index: Source/JavaScriptCore/runtime/CodeCache.h
>===================================================================
>--- Source/JavaScriptCore/runtime/CodeCache.h	(revision 182773)
>+++ Source/JavaScriptCore/runtime/CodeCache.h	(working copy)
>@@ -255,7 +255,7 @@ public:
>     ~CodeCache();
> 
>     UnlinkedProgramCodeBlock* getProgramCodeBlock(VM&, ProgramExecutable*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, DebuggerMode, ProfilerMode, ParserError&);
>-    UnlinkedEvalCodeBlock* getEvalCodeBlock(VM&, EvalExecutable*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&);
>+    UnlinkedEvalCodeBlock* getEvalCodeBlock(VM&, EvalExecutable*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&, const IdentifierSet*);
>     UnlinkedFunctionExecutable* getFunctionExecutableFromGlobalCode(VM&, const Identifier&, const SourceCode&, ParserError&);
> 
>     void clear()
>@@ -265,7 +265,7 @@ public:
> 
> private:
>     template <class UnlinkedCodeBlockType, class ExecutableType> 
>-    UnlinkedCodeBlockType* getGlobalCodeBlock(VM&, ExecutableType*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&);
>+    UnlinkedCodeBlockType* getGlobalCodeBlock(VM&, ExecutableType*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&, const IdentifierSet*);
> 
>     CodeCacheMap m_sourceCode;
> };
>Index: Source/JavaScriptCore/runtime/Executable.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Executable.cpp	(revision 182773)
>+++ Source/JavaScriptCore/runtime/Executable.cpp	(working copy)
>@@ -347,7 +347,7 @@ JSObject* ScriptExecutable::prepareForEx
> 
> const ClassInfo EvalExecutable::s_info = { "EvalExecutable", &ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(EvalExecutable) };
> 
>-EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode& source, bool isInStrictContext, ThisTDZMode thisTDZMode)
>+EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode& source, bool isInStrictContext, ThisTDZMode thisTDZMode, const IdentifierSet* variablesUnderTDZ)
> {
>     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
>     if (!globalObject->evalEnabled()) {
>@@ -358,7 +358,7 @@ EvalExecutable* EvalExecutable::create(E
>     EvalExecutable* executable = new (NotNull, allocateCell<EvalExecutable>(*exec->heap())) EvalExecutable(exec, source, isInStrictContext);
>     executable->finishCreation(exec->vm());
> 
>-    UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject->createEvalCodeBlock(exec, executable, thisTDZMode);
>+    UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject->createEvalCodeBlock(exec, executable, thisTDZMode, variablesUnderTDZ);
>     if (!unlinkedEvalCode)
>         return 0;
> 
>Index: Source/JavaScriptCore/runtime/Executable.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Executable.h	(revision 182773)
>+++ Source/JavaScriptCore/runtime/Executable.h	(working copy)
>@@ -454,7 +454,7 @@ public:
>         return m_evalCodeBlock.get();
>     }
> 
>-    static EvalExecutable* create(ExecState*, const SourceCode&, bool isInStrictContext, ThisTDZMode);
>+    static EvalExecutable* create(ExecState*, const SourceCode&, bool isInStrictContext, ThisTDZMode, const IdentifierSet*);
> 
>     PassRefPtr<JITCode> generatedJITCode()
>     {
>Index: Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObject.cpp	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.cpp	(working copy)
>@@ -822,14 +822,14 @@ UnlinkedProgramCodeBlock* JSGlobalObject
>     return unlinkedCodeBlock;
> }
> 
>-UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, ThisTDZMode thisTDZMode)
>+UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, ThisTDZMode thisTDZMode, const IdentifierSet* variablesUnderTDZ)
> {
>     ParserError error;
>     JSParserStrictMode strictMode = executable->isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
>     DebuggerMode debuggerMode = hasDebugger() ? DebuggerOn : DebuggerOff;
>     ProfilerMode profilerMode = hasProfiler() ? ProfilerOn : ProfilerOff;
>     UnlinkedEvalCodeBlock* unlinkedCodeBlock = vm().codeCache()->getEvalCodeBlock(
>-        vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, strictMode, thisTDZMode, debuggerMode, profilerMode, error);
>+        vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, strictMode, thisTDZMode, debuggerMode, profilerMode, error, variablesUnderTDZ);
> 
>     if (hasDebugger())
>         debugger()->sourceParsed(callFrame, executable->source().provider(), error.line(), error.message());
>Index: Source/JavaScriptCore/runtime/JSGlobalObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObject.h	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.h	(working copy)
>@@ -31,6 +31,7 @@
> #include "JSSegmentedVariableObject.h"
> #include "JSWeakObjectMapRefInternal.h"
> #include "NumberPrototype.h"
>+#include "ParserModes.h"
> #include "RuntimeFlags.h"
> #include "SpecialPointer.h"
> #include "StringPrototype.h"
>@@ -602,7 +603,7 @@ public:
>     unsigned weakRandomInteger() { return m_weakRandom.getUint32(); }
> 
>     UnlinkedProgramCodeBlock* createProgramCodeBlock(CallFrame*, ProgramExecutable*, JSObject** exception);
>-    UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*, ThisTDZMode);
>+    UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*, ThisTDZMode, const IdentifierSet*);
> 
> protected:
>     struct GlobalPropertyInfo {
>Index: Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp	(working copy)
>@@ -571,7 +571,12 @@ EncodedJSValue JSC_HOST_CALL globalFuncE
>     }
> 
>     JSGlobalObject* calleeGlobalObject = exec->callee()->globalObject();
>-    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false, ThisTDZMode::CheckIfNeeded);
>+    CallFrame* callerFrame = exec->callerFrame();
>+    CodeBlock* callerCodeBlock = callerFrame->codeBlock();
>+    JSScope* callerScope = callerFrame->uncheckedR(callerCodeBlock->scopeRegister().offset()).Register::scope();
>+    IdentifierSet variablesUnderTDZ;
>+    JSScope::collectVariablesUnderTDZ(callerScope, variablesUnderTDZ);
>+    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false, ThisTDZMode::CheckIfNeeded, &variablesUnderTDZ);
>     if (!eval)
>         return JSValue::encode(jsUndefined());
> 
>Index: Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(working copy)
>@@ -65,6 +65,12 @@ public:
>         SymbolTable* symbolTable = codeBlock->symbolTable();
>         return create(vm, structure, currentScope, symbolTable);
>     }
>+
>+    static JSLexicalEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable)
>+    {
>+        Structure* structure = globalObject->activationStructure();
>+        return create(vm, structure, currentScope, symbolTable);
>+    }
>         
>     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
>     static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
>Index: Source/JavaScriptCore/runtime/JSScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.cpp	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSScope.cpp	(working copy)
>@@ -170,14 +170,14 @@ JSValue JSScope::resolve(ExecState* exec
>     }
> }
> 
>-ResolveOp JSScope::abstractResolve(ExecState* exec, bool hasTopActivation, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
>+ResolveOp JSScope::abstractResolve(ExecState* exec, unsigned depthOffset, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
> {
>     ResolveOp op(Dynamic, 0, 0, 0, 0, 0);
>     if (unlinkedType == Dynamic)
>         return op;
> 
>-    size_t depth = hasTopActivation ? 1 : 0;
>     bool needsVarInjectionChecks = JSC::needsVarInjectionChecks(unlinkedType);
>+    size_t depth = depthOffset;
>     for (; scope; scope = scope->next()) {
>         if (abstractAccess(exec, scope, ident, getOrPut, depth, needsVarInjectionChecks, op))
>             break;
>@@ -187,6 +187,22 @@ ResolveOp JSScope::abstractResolve(ExecS
>     return op;
> }
> 
>+void JSScope::collectVariablesUnderTDZ(JSScope* scope, IdentifierSet& result)
>+{
>+    for (; scope; scope = scope->next()) {
>+        JSLexicalEnvironment* lexicalEnvironment = jsDynamicCast<JSLexicalEnvironment*>(scope);
>+        if (!lexicalEnvironment) // Global object does not hold any lexical variables so we can ignore it.
>+            continue;
>+
>+        SymbolTable* symbolTable = lexicalEnvironment->symbolTable();
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto end = symbolTable->end(locker), iter = symbolTable->begin(locker); iter != end; ++iter) {
>+            if (iter->value.isLexicalScope())
>+                result.add(iter->key);
>+        }
>+    }
>+}
>+
> const char* resolveModeName(ResolveMode mode)
> {
>     static const char* const names[] = {
>Index: Source/JavaScriptCore/runtime/JSScope.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.h	(revision 182773)
>+++ Source/JavaScriptCore/runtime/JSScope.h	(working copy)
>@@ -27,6 +27,7 @@
> #define JSScope_h
> 
> #include "JSObject.h"
>+#include "ParserModes.h"
> 
> namespace JSC {
> 
>@@ -157,7 +158,9 @@ public:
>     static JSObject* objectAtScope(JSScope*);
> 
>     static JSValue resolve(ExecState*, JSScope*, const Identifier&);
>-    static ResolveOp abstractResolve(ExecState*, bool hasTopActivation, JSScope*, const Identifier&, GetOrPut, ResolveType);
>+    static ResolveOp abstractResolve(ExecState*, unsigned depthOffset, JSScope*, const Identifier&, GetOrPut, ResolveType);
>+
>+    static void collectVariablesUnderTDZ(JSScope*, IdentifierSet& result);
> 
>     static void visitChildren(JSCell*, SlotVisitor&);
> 
>Index: Source/JavaScriptCore/runtime/SymbolTable.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolTable.cpp	(revision 182773)
>+++ Source/JavaScriptCore/runtime/SymbolTable.cpp	(working copy)
>@@ -144,7 +144,7 @@ SymbolTable* SymbolTable::cloneScopePart
>             continue;
>         result->m_map.add(
>             iter->key,
>-            SymbolTableEntry(iter->value.varOffset(), iter->value.getAttributes()));
>+            SymbolTableEntry(iter->value.varOffset(), iter->value.getAttributes(), iter->value.isLexicalScope()));
>     }
>     
>     result->m_maxScopeOffset = m_maxScopeOffset;
>Index: Source/JavaScriptCore/runtime/SymbolTable.h
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolTable.h	(revision 182773)
>+++ Source/JavaScriptCore/runtime/SymbolTable.h	(working copy)
>@@ -169,14 +169,21 @@ public:
>         : m_bits(SlimFlag)
>     {
>         ASSERT(isValidVarOffset(offset));
>-        pack(offset, true, false, false);
>+        pack(offset, true, false, false, false);
>     }
> 
>     SymbolTableEntry(VarOffset offset, unsigned attributes)
>         : m_bits(SlimFlag)
>     {
>         ASSERT(isValidVarOffset(offset));
>-        pack(offset, true, attributes & ReadOnly, attributes & DontEnum);
>+        pack(offset, true, attributes & ReadOnly, attributes & DontEnum, false);
>+    }
>+
>+    SymbolTableEntry(VarOffset offset, unsigned attributes, bool isLexicalScope)
>+        : m_bits(SlimFlag)
>+    {
>+        ASSERT(isValidVarOffset(offset));
>+        pack(offset, true, attributes & ReadOnly, attributes & DontEnum, isLexicalScope);
>     }
>     
>     ~SymbolTableEntry()
>@@ -245,7 +252,7 @@ public:
>     
>     void setAttributes(unsigned attributes)
>     {
>-        pack(varOffset(), isWatchable(), attributes & ReadOnly, attributes & DontEnum);
>+        pack(varOffset(), isWatchable(), attributes & ReadOnly, attributes & DontEnum, isLexicalScope());
>     }
> 
>     bool isReadOnly() const
>@@ -262,13 +269,18 @@ public:
>     {
>         return bits() & DontEnumFlag;
>     }
>+
>+    bool isLexicalScope() const
>+    {
>+        return bits() & LexicalScopeFlag;
>+    }
>     
>     void disableWatching()
>     {
>         if (WatchpointSet* set = watchpointSet())
>             set->invalidate("Disabling watching in symbol table");
>         if (varOffset().isScope())
>-            pack(varOffset(), false, isReadOnly(), isDontEnum());
>+            pack(varOffset(), false, isReadOnly(), isDontEnum(), isLexicalScope());
>     }
>     
>     void prepareToWatch();
>@@ -302,16 +314,17 @@ public:
>     }
>     
> private:
>-    static const intptr_t SlimFlag = 0x1;
>-    static const intptr_t ReadOnlyFlag = 0x2;
>-    static const intptr_t DontEnumFlag = 0x4;
>-    static const intptr_t NotNullFlag = 0x8;
>-    static const intptr_t KindBitsMask = 0x30;
>-    static const intptr_t ScopeKindBits = 0x00;
>-    static const intptr_t UnwatchableScopeKindBits = 0x10;
>-    static const intptr_t StackKindBits = 0x20;
>-    static const intptr_t DirectArgumentKindBits = 0x30;
>-    static const intptr_t FlagBits = 6;
>+    static const intptr_t SlimFlag = 0x1;                  //0b0000001
>+    static const intptr_t ReadOnlyFlag = 0x2;              //0b0000010
>+    static const intptr_t DontEnumFlag = 0x4;              //0b0000100
>+    static const intptr_t NotNullFlag = 0x8;               //0b0001000
>+    static const intptr_t LexicalScopeFlag = 0x40;         //0b1000000
>+    static const intptr_t KindBitsMask = 0x30;             //0b0110000
>+    static const intptr_t ScopeKindBits = 0x00;            //0b0000000
>+    static const intptr_t UnwatchableScopeKindBits = 0x10; //0b0010000
>+    static const intptr_t StackKindBits = 0x20;            //0b0100000
>+    static const intptr_t DirectArgumentKindBits = 0x30;   //0b0110000
>+    static const intptr_t FlagBits = 7;                    
>     
>     class FatEntry {
>         WTF_MAKE_FAST_ALLOCATED;
>@@ -378,7 +391,7 @@ private:
> 
>     JS_EXPORT_PRIVATE void freeFatEntrySlow();
> 
>-    void pack(VarOffset offset, bool isWatchable, bool readOnly, bool dontEnum)
>+    void pack(VarOffset offset, bool isWatchable, bool readOnly, bool dontEnum, bool lexicalScope)
>     {
>         ASSERT(!isFat());
>         intptr_t& bitsRef = bits();
>@@ -388,6 +401,8 @@ private:
>             bitsRef |= ReadOnlyFlag;
>         if (dontEnum)
>             bitsRef |= DontEnumFlag;
>+        if (lexicalScope)
>+            bitsRef |= LexicalScopeFlag;
>         switch (offset.kind()) {
>         case VarKind::Scope:
>             if (isWatchable)
>Index: LayoutTests/js/keywords-and-reserved_words-expected.txt
>===================================================================
>--- LayoutTests/js/keywords-and-reserved_words-expected.txt	(revision 182773)
>+++ LayoutTests/js/keywords-and-reserved_words-expected.txt	(working copy)
>@@ -60,13 +60,14 @@ PASS classifyIdentifier("import") is "ke
> PASS classifyIdentifier("super") is "keyword"
> PASS classifyIdentifier("implements") is "strict"
> PASS classifyIdentifier("interface") is "strict"
>-PASS classifyIdentifier("let") is "strict"
> PASS classifyIdentifier("package") is "strict"
> PASS classifyIdentifier("private") is "strict"
> PASS classifyIdentifier("protected") is "strict"
> PASS classifyIdentifier("public") is "strict"
> PASS classifyIdentifier("static") is "strict"
> PASS classifyIdentifier("yield") is "strict"
>+PASS isKeyword("let") is false
>+PASS isStrictKeyword("let") is true
> PASS successfullyParsed is true
> 
> TEST COMPLETE
>Index: LayoutTests/js/reserved-words-strict-expected.txt
>===================================================================
>--- LayoutTests/js/reserved-words-strict-expected.txt	(revision 182773)
>+++ LayoutTests/js/reserved-words-strict-expected.txt	(working copy)
>@@ -6,7 +6,6 @@ On success, you will see a series of "PA
> SHOULD BE RESERVED:
> PASS isReserved('implements') is true
> PASS isReserved('interface') is true
>-PASS isReserved('let') is true
> PASS isReserved('package') is true
> PASS isReserved('private') is true
> PASS isReserved('protected') is true
>Index: LayoutTests/js/dom/reserved-words-as-property-expected.txt
>===================================================================
>--- LayoutTests/js/dom/reserved-words-as-property-expected.txt	(revision 182773)
>+++ LayoutTests/js/dom/reserved-words-as-property-expected.txt	(working copy)
>@@ -1353,18 +1353,18 @@ PASS ({ let: 42 }.let === 42) is true
> PASS (function(){({ let: 42 }.let === 42)}); true is true
> PASS ({ get let(){}, set let(x){}, parsedOkay: 42 }.parsedOkay === 42) is true
> PASS (function(){({ get let(){}, set let(x){}, parsedOkay: 42 }.parsedOkay === 42)}); true is true
>-PASS "use strict";var let; true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS (function(){"use strict";var let; true}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS "use strict";var let = 42; let === 42 threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS (function(){"use strict";var let = 42; let === 42}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS "use strict";function g(let){ "use strict"; }; true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS (function(){"use strict";function g(let){ "use strict"; }; true}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS "use strict";/let/.test(function g(let){ "use strict"; }) threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS (function(){"use strict";/let/.test(function g(let){ "use strict"; })}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS "use strict";try{}catch(let){}; true threw exception SyntaxError: Cannot use the reserved word 'let' as a catch variable name in strict mode..
>-PASS (function(){"use strict";try{}catch(let){}; true}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a catch variable name in strict mode..
>-PASS "use strict";function let(){ "use strict"; }; true threw exception SyntaxError: Cannot use the reserved word 'let' as a function name in strict mode..
>-PASS (function(){"use strict";function let(){ "use strict"; }; true}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a function name in strict mode..
>+PASS "use strict";var let; true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS (function(){"use strict";var let; true}); true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS "use strict";var let = 42; let === 42 threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS (function(){"use strict";var let = 42; let === 42}); true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS "use strict";function g(let){ "use strict"; }; true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS (function(){"use strict";function g(let){ "use strict"; }; true}); true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS "use strict";/let/.test(function g(let){ "use strict"; }) threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS (function(){"use strict";/let/.test(function g(let){ "use strict"; })}); true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS "use strict";try{}catch(let){}; true threw exception SyntaxError: Cannot use the keyword 'let' as a catch variable name..
>+PASS (function(){"use strict";try{}catch(let){}; true}); true threw exception SyntaxError: Cannot use the keyword 'let' as a catch variable name..
>+PASS "use strict";function let(){ "use strict"; }; true threw exception SyntaxError: Cannot use the keyword 'let' as a function name..
>+PASS (function(){"use strict";function let(){ "use strict"; }; true}); true threw exception SyntaxError: Cannot use the keyword 'let' as a function name..
> PASS "use strict";({ "let": 42 }.let === 42) is true
> PASS (function(){"use strict";({ "let": 42 }.let === 42)}); true is true
> PASS "use strict";({ let: 42 }.let === 42) is true
>Index: LayoutTests/js/script-tests/keywords-and-reserved_words.js
>===================================================================
>--- LayoutTests/js/script-tests/keywords-and-reserved_words.js	(revision 182773)
>+++ LayoutTests/js/script-tests/keywords-and-reserved_words.js	(working copy)
>@@ -104,10 +104,15 @@ shouldBe('classifyIdentifier("super")', 
> // Future Reserved Words, in strict mode only.
> shouldBe('classifyIdentifier("implements")', '"strict"');
> shouldBe('classifyIdentifier("interface")', '"strict"');
>-shouldBe('classifyIdentifier("let")', '"strict"');
> shouldBe('classifyIdentifier("package")', '"strict"');
> shouldBe('classifyIdentifier("private")', '"strict"');
> shouldBe('classifyIdentifier("protected")', '"strict"');
> shouldBe('classifyIdentifier("public")', '"strict"');
> shouldBe('classifyIdentifier("static")', '"strict"');
> shouldBe('classifyIdentifier("yield")', '"strict"');
>+
>+// This is in a class of its own because it's treated as a keyword
>+// in strict-mode and not a keyword in sloppy mode 
>+// (non-keyword in sloppy mode is temporary).
>+shouldBeFalse('isKeyword("let")');
>+shouldBeTrue('isStrictKeyword("let")');
>Index: LayoutTests/js/script-tests/reserved-words-strict.js
>===================================================================
>--- LayoutTests/js/script-tests/reserved-words-strict.js	(revision 182773)
>+++ LayoutTests/js/script-tests/reserved-words-strict.js	(working copy)
>@@ -16,7 +16,6 @@ function isReserved(word)
> 
> var reservedWords = [
>     "implements",
>-    "let",
>     "private",
>     "public",
>     "yield",

Actions: View | Formatted Diff | Diff

Attachments on bug 142944: 249945 | 249961 | 250169 | 250230 | 250533 | 250684 | 250714 | 250715 | 251081 | 251130 | 251133 | 251136 | 251409 | 251653 | 251913 | 252074 | 253066 | 253070 | 253115 | 253794 | 255536 | 255614 | 255622 | 255804 | 255806 | 255807 | 255830 | 255834 | 255835 | 255871 | 256033 | 256036 | 256226 | 256232 | 256233 | 256257 | 256264 | 256267 | 256433 | 256438 | 256445 | 256450 | 256465 | 256481 | 256658 | 256860