Attachment 256036 Details for Bug 142944 – patch

[patch] patch

b-backup.diff (text/plain), 318.43 KB, created by Saam Barati on 2015-07-02 14:18:30 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2015-07-02 14:18:30 PDT

Size: 318.43 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 186144)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,495 @@
>+2015-06-30  Saam barati  <saambarati1@gmail.com>
>+
>+        [ES6] implement block scoping to enable 'let'
>+        https://bugs.webkit.org/show_bug.cgi?id=142944
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * builtins/BuiltinExecutables.cpp:
>+        (JSC::BuiltinExecutables::createExecutableInternal):
>+        * bytecode/BytecodeList.json:
>+        This patch adds three new opcodes and adds new functionality to a
>+        fourth opcode:
>+        1) op_push_lexical_scope
>+        This opcode pushes a new JSLexicalEnvironment onto the scope stack
>+        2) op_pop_lexical_scope
>+        This opcode pops the top scope from the scope stack.
>+        3) op_get_from_scope
>+        This opcode is now modified to perform a TDZ check on its result.
>+        4) op_get_from_scope_no_tdz
>+        This opcode is the same as op_get_from_scope except we emit it
>+        when we have the static guarantee that we will not need a TDZ check.
>+        Various changes were made to ensure code sharing between these two opcodes.
>+
>+        * bytecode/BytecodeUseDef.h:
>+        (JSC::computeUsesForBytecodeOffset):
>+        (JSC::computeDefsForBytecodeOffset):
>+        * bytecode/CodeBlock.cpp:
>+        (JSC::CodeBlock::dumpBytecode):
>+        (JSC::CodeBlock::CodeBlock):
>+        (JSC::CodeBlock::finalizeUnconditionally):
>+        * bytecode/CodeBlock.h:
>+        (JSC::CodeBlock::setConstantRegisters):
>+        (JSC::CodeBlock::replaceConstant):
>+        CodeBlock now keeps a stack of symbol tables during bytecode linking 
>+        that models the runtime scope stack. This scope stack is used to determine
>+        the scope depth for JSScope::abstractResolve and is also used to look
>+        up local variables for op_put_to_scope with type LocalClosureVar.
>+
>+        * bytecode/EvalCodeCache.h:
>+        (JSC::EvalCodeCache::getSlow):
>+        * bytecode/UnlinkedCodeBlock.cpp:
>+        (JSC::generateFunctionCodeBlock):
>+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
>+        (JSC::UnlinkedFunctionExecutable::parameterCount):
>+        * bytecode/UnlinkedCodeBlock.h:
>+        Unlinked functions now know the variables that were under TDZ in their parent
>+        scope.
>+
>+        * bytecompiler/BytecodeGenerator.cpp:
>+        (JSC::BytecodeGenerator::generate):
>+        (JSC::BytecodeGenerator::BytecodeGenerator):
>+        (JSC::BytecodeGenerator::~BytecodeGenerator):
>+        (JSC::BytecodeGenerator::newRegister):
>+        (JSC::BytecodeGenerator::reclaimFreeRegisters):
>+        (JSC::BytecodeGenerator::newBlockScopeVariable):
>+        (JSC::BytecodeGenerator::newTemporary):
>+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
>+        (JSC::BytecodeGenerator::pushLexicalScope):
>+        (JSC::BytecodeGenerator::popLexicalScope):
>+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
>+        (JSC::BytecodeGenerator::variable):
>+        (JSC::BytecodeGenerator::variablePerSymbolTable):
>+        (JSC::BytecodeGenerator::createVariable):
>+        (JSC::BytecodeGenerator::emitResolveScope):
>+        (JSC::BytecodeGenerator::emitGetFromScope):
>+        (JSC::BytecodeGenerator::initializeVariable):
>+        (JSC::BytecodeGenerator::emitTDZCheck):
>+        (JSC::BytecodeGenerator::needsTDZCheck):
>+        (JSC::BytecodeGenerator::emitTDZCheckIfNecessary):
>+        (JSC::BytecodeGenerator::getVariablesUnderTDZ):
>+        (JSC::BytecodeGenerator::emitNewObject):
>+        (JSC::BytecodeGenerator::pushFinallyContext):
>+        (JSC::BytecodeGenerator::pushIteratorCloseContext):
>+        (JSC::BytecodeGenerator::emitComplexPopScopes):
>+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
>+        (JSC::BytecodeGenerator::calculateTargetScopeDepthForExceptionHandler):
>+        (JSC::BytecodeGenerator::emitThrowReferenceError):
>+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
>+        (JSC::BytecodeGenerator::emitEnumeration):
>+        (JSC::BytecodeGenerator::emitGetTemplateObject):
>+        * bytecompiler/BytecodeGenerator.h:
>+        (JSC::BytecodeGenerator::ignoredResult):
>+        (JSC::BytecodeGenerator::tempDestination):
>+        (JSC::BytecodeGenerator::lastOpcodeID):
>+        (JSC::BytecodeGenerator::makeFunction):
>+        (JSC::BytecodeGenerator::symbolTable):
>+        (JSC::BytecodeGenerator::shouldOptimizeLocals): Deleted.
>+        (JSC::BytecodeGenerator::canOptimizeNonLocals): Deleted.
>+        The heart of the changes in this patch are in the bytecode generator.
>+        The bytecode generator now keeps a stack of pairs of {symbol table, scope register}
>+        that models the runtime scope stack. This symbol table stack is used
>+        in resolving local variables.
>+
>+        Also, the bytecode generator handles pushing and popping of lexical scopes. 
>+        This is relatively straight forward:
>+        Captured 'let' variables end up in the JSLexicalEnvironment scope and non-captured
>+        variables end up on the stack. Some trickiness is involved in generating
>+        code for 'for' loops that have captured variables (I'm talking about variables in the loop
>+        header, not the loop body). Each iteration of the for loop ends up with 
>+        its own JSLexicalEnvironment. Static code must be generated in such a way 
>+        to create this runtime behavior. This is done by emitting instructions to 
>+        push and pop a lexical scope at the end of each loop and copying values
>+        from the previous loop's scope into the new scope. This code must also
>+        ensure that each loop iteration's scope refers to the same underlying 
>+        symbol table so that no scope is accidentally mistaken as being a singleton scope.
>+
>+        When the debugger is enabled, all lexically defined variables will end up in the
>+        JSLexicalEnvironment.
>+
>+        * bytecompiler/NodesCodegen.cpp:
>+        (JSC::ResolveNode::emitBytecode):
>+        (JSC::TaggedTemplateNode::emitBytecode):
>+        (JSC::EvalFunctionCallNode::emitBytecode):
>+        (JSC::FunctionCallResolveNode::emitBytecode):
>+        (JSC::PostfixNode::emitResolve):
>+        (JSC::DeleteResolveNode::emitBytecode):
>+        (JSC::TypeOfResolveNode::emitBytecode):
>+        (JSC::PrefixNode::emitResolve):
>+        (JSC::ReadModifyResolveNode::emitBytecode):
>+        (JSC::AssignResolveNode::emitBytecode):
>+        (JSC::BlockNode::emitBytecode):
>+        (JSC::EmptyVarExpression::emitBytecode):
>+        (JSC::ForNode::emitBytecode):
>+        (JSC::ForInNode::emitMultiLoopBytecode):
>+        (JSC::ForOfNode::emitBytecode):
>+        (JSC::SwitchNode::emitBytecode):
>+        (JSC::BindingNode::bindValue):
>+        * debugger/DebuggerCallFrame.cpp:
>+        (JSC::DebuggerCallFrame::evaluate):
>+        * debugger/DebuggerScope.cpp:
>+        (JSC::DebuggerScope::getOwnPropertySlot):
>+        (JSC::DebuggerScope::put):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::handlePutById):
>+        (JSC::DFG::ByteCodeParser::handleTDZCheck):
>+        (JSC::DFG::ByteCodeParser::prepareToParseBlock):
>+        (JSC::DFG::ByteCodeParser::parseBlock):
>+        * dfg/DFGCapabilities.cpp:
>+        (JSC::DFG::capabilityLevel):
>+        * dfg/DFGNode.h:
>+        (JSC::DFG::Node::castConstant):
>+        (JSC::DFG::Node::initializationValueForActivation):
>+        (JSC::DFG::Node::containsMovHint):
>+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
>+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
>+        CreateActivation nodes now have a second OpInfo that tracks the 
>+        initial value that needs to be placed in the activation. The empty 
>+        TDZ value for push_lexical_scope and undefined for create_lexical_environment. 
>+        This initial value is also used in allocation sinking to create proper bottom
>+        values for all scope variables. It's also used to determine which operation
>+        to call when allocating a JSLexicalEnvironment on the slow path.
>+
>+        * dfg/DFGOperations.cpp:
>+        * dfg/DFGOperations.h:
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
>+        * ftl/FTLLowerDFGToLLVM.cpp:
>+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateActivation):
>+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeCreateActivation):
>+        * ftl/FTLOperations.cpp:
>+        (JSC::FTL::operationMaterializeObjectInOSR):
>+        * jit/JIT.cpp:
>+        (JSC::JIT::privateCompileMainPass):
>+        (JSC::JIT::privateCompileSlowCases):
>+        * jit/JIT.h:
>+        * jit/JITInlines.h:
>+        (JSC::JIT::callOperation):
>+        * jit/JITOpcodes.cpp:
>+        (JSC::JIT::emit_op_catch):
>+        (JSC::JIT::emit_op_push_lexical_scope):
>+        (JSC::JIT::emit_op_pop_lexical_scope):
>+        (JSC::JIT::emit_op_switch_imm):
>+        (JSC::JIT::emitSlow_op_create_this):
>+        (JSC::JIT::emitTDZCheck):
>+        (JSC::JIT::emit_op_check_tdz):
>+        (JSC::JIT::emitSlow_op_check_tdz):
>+        * jit/JITOpcodes32_64.cpp:
>+        (JSC::JIT::emit_op_catch):
>+        (JSC::JIT::emit_op_push_lexical_scope):
>+        (JSC::JIT::emit_op_pop_lexical_scope):
>+        (JSC::JIT::emit_op_switch_imm):
>+        (JSC::JIT::emitSlow_op_to_this):
>+        (JSC::JIT::emitTDZCheck):
>+        (JSC::JIT::emit_op_check_tdz):
>+        (JSC::JIT::emitSlow_op_check_tdz):
>+        * jit/JITOperations.cpp:
>+        * jit/JITOperations.h:
>+        * jit/JITPropertyAccess.cpp:
>+        (JSC::JIT::emitGetClosureVar):
>+        (JSC::JIT::emitGetFromScope):
>+        (JSC::JIT::emit_op_get_from_scope_no_tdz):
>+        (JSC::JIT::emit_op_get_from_scope):
>+        (JSC::JIT::emitSlowGetFromScopeCommon):
>+        (JSC::JIT::emitSlow_op_get_from_scope_no_tdz):
>+        (JSC::JIT::emitSlow_op_get_from_scope):
>+        (JSC::JIT::emitPutGlobalProperty):
>+        * jit/JITPropertyAccess32_64.cpp:
>+        (JSC::JIT::emitGetClosureVar):
>+        (JSC::JIT::emitGetFromScope):
>+        (JSC::JIT::emit_op_get_from_scope_no_tdz):
>+        (JSC::JIT::emit_op_get_from_scope):
>+        (JSC::JIT::emitSlowGetFromScopeCommon):
>+        (JSC::JIT::emitSlow_op_get_from_scope_no_tdz):
>+        (JSC::JIT::emitSlow_op_get_from_scope):
>+        (JSC::JIT::emitPutGlobalProperty):
>+        * llint/LLIntSlowPaths.cpp:
>+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
>+        * llint/LLIntSlowPaths.h:
>+        * llint/LowLevelInterpreter.asm:
>+        * llint/LowLevelInterpreter32_64.asm:
>+        * llint/LowLevelInterpreter64.asm:
>+        * parser/ASTBuilder.h:
>+        (JSC::ASTBuilder::createConditionalExpr):
>+        (JSC::ASTBuilder::createAssignResolve):
>+        (JSC::ASTBuilder::createClassDeclStatement):
>+        (JSC::ASTBuilder::createBlockStatement):
>+        (JSC::ASTBuilder::createIfStatement):
>+        (JSC::ASTBuilder::createForLoop):
>+        (JSC::ASTBuilder::createForInLoop):
>+        (JSC::ASTBuilder::createForOfLoop):
>+        (JSC::ASTBuilder::isBindingNode):
>+        (JSC::ASTBuilder::createVarStatement):
>+        (JSC::ASTBuilder::createLetStatement):
>+        (JSC::ASTBuilder::createEmptyVarExpression):
>+        (JSC::ASTBuilder::createReturnStatement):
>+        (JSC::ASTBuilder::createTryStatement):
>+        (JSC::ASTBuilder::createSwitchStatement):
>+        (JSC::ASTBuilder::appendObjectPatternEntry):
>+        (JSC::ASTBuilder::createBindingLocation):
>+        (JSC::ASTBuilder::setEndOffset):
>+        (JSC::ASTBuilder::makeAssignNode):
>+        * parser/Keywords.table:
>+        * parser/NodeConstructors.h:
>+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
>+        (JSC::AssignResolveNode::AssignResolveNode):
>+        (JSC::VarStatementNode::VarStatementNode):
>+        (JSC::EmptyVarExpression::EmptyVarExpression):
>+        (JSC::WhileNode::WhileNode):
>+        (JSC::ForNode::ForNode):
>+        (JSC::CaseBlockNode::CaseBlockNode):
>+        (JSC::SwitchNode::SwitchNode):
>+        (JSC::ConstDeclNode::ConstDeclNode):
>+        (JSC::BlockNode::BlockNode):
>+        (JSC::EnumerationNode::EnumerationNode):
>+        (JSC::ForInNode::ForInNode):
>+        (JSC::ForOfNode::ForOfNode):
>+        (JSC::ObjectPatternNode::create):
>+        (JSC::BindingNode::create):
>+        (JSC::BindingNode::BindingNode):
>+        * parser/Nodes.cpp:
>+        (JSC::ScopeNode::ScopeNode):
>+        (JSC::ProgramNode::ProgramNode):
>+        (JSC::EvalNode::EvalNode):
>+        (JSC::FunctionNode::FunctionNode):
>+        (JSC::FunctionNode::finishParsing):
>+        (JSC::LexicalNode::LexicalNode):
>+        * parser/Nodes.h:
>+        (JSC::invert):
>+        (JSC::LexicalNode::LexicalNode):
>+        (JSC::LexicalNode::lexicalVariables):
>+        (JSC::LexicalNode::lexicalCaptures):
>+        (JSC::ProgramNode::startColumn):
>+        (JSC::ProgramNode::endColumn):
>+        (JSC::EvalNode::startColumn):
>+        (JSC::EvalNode::endColumn):
>+        (JSC::BindingNode::boundProperty):
>+        (JSC::BindingNode::divotStart):
>+        (JSC::BindingNode::divotEnd):
>+        There is a new class called 'LexicalNode' that has the
>+        necessary fields to model a lexical scope. Multiple
>+        AST nodes now also inherit from LexicalNode.
>+
>+        * parser/Parser.cpp:
>+        (JSC::Parser<LexerType>::parseInner):
>+        (JSC::Parser<LexerType>::parseSourceElements):
>+        (JSC::Parser<LexerType>::parseVariableDeclaration):
>+        (JSC::Parser<LexerType>::parseWhileStatement):
>+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
>+        (JSC::Parser<LexerType>::createBindingPattern):
>+        (JSC::Parser<LexerType>::tryParseDeconstructionPatternExpression):
>+        (JSC::Parser<LexerType>::parseDeconstructionPattern):
>+        (JSC::Parser<LexerType>::parseForStatement):
>+        (JSC::Parser<LexerType>::parseSwitchStatement):
>+        (JSC::Parser<LexerType>::parseTryStatement):
>+        (JSC::Parser<LexerType>::parseBlockStatement):
>+        (JSC::Parser<LexerType>::parseStatement):
>+        (JSC::Parser<LexerType>::parseFunctionInfo):
>+        (JSC::Parser<LexerType>::parseClass):
>+        (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
>+        (JSC::Parser<LexerType>::parseAssignmentExpression):
>+        (JSC::Parser<LexerType>::parsePrimaryExpression):
>+        (JSC::Parser<LexerType>::parseVarDeclaration): Deleted.
>+        (JSC::Parser<LexerType>::parseVarDeclarationList): Deleted.
>+        * parser/Parser.h:
>+        (JSC::Scope::Scope):
>+        (JSC::Scope::setIsFunction):
>+        (JSC::Scope::isFunction):
>+        (JSC::Scope::isFunctionBoundary):
>+        (JSC::Scope::setIsLexicalScope):
>+        (JSC::Scope::isLexicalScope):
>+        (JSC::Scope::lexicallyDeclaredVariables):
>+        (JSC::Scope::lexicallyCapturedVariables):
>+        (JSC::Scope::computeLexicallyCapturedVariablesAndPurgeCandidates):
>+        (JSC::Scope::declareCallee):
>+        (JSC::Scope::declareVariable):
>+        (JSC::Scope::declareLexicalVariable):
>+        (JSC::Scope::hasDeclaredVariable):
>+        (JSC::Scope::hasLexicallyDeclaredVariable):
>+        (JSC::Scope::hasDeclaredParameter):
>+        (JSC::Scope::declareWrite):
>+        (JSC::Scope::preventAllVariableDeclarations):
>+        (JSC::Scope::preventVarDeclarations):
>+        (JSC::Scope::allowsVarDeclarations):
>+        (JSC::Scope::allowsLexicalDeclarations):
>+        (JSC::Scope::declareParameter):
>+        (JSC::Scope::useVariable):
>+        (JSC::Scope::setNeedsFullActivation):
>+        (JSC::Scope::needsFullActivation):
>+        (JSC::Scope::hasDirectSuper):
>+        (JSC::Scope::setNeedsSuperBinding):
>+        (JSC::Scope::collectFreeVariables):
>+        (JSC::Scope::getCapturedVars):
>+        (JSC::Scope::copyCapturedVariablesToVector):
>+        (JSC::Parser::closedVariables):
>+        (JSC::Parser::AllowInOverride::AllowInOverride):
>+        (JSC::Parser::AutoCleanupLexicalScope::AutoCleanupLexicalScope):
>+        (JSC::Parser::AutoCleanupLexicalScope::~AutoCleanupLexicalScope):
>+        (JSC::Parser::AutoCleanupLexicalScope::setIsValid):
>+        (JSC::Parser::AutoCleanupLexicalScope::isValid):
>+        (JSC::Parser::AutoCleanupLexicalScope::setPopped):
>+        (JSC::Parser::AutoCleanupLexicalScope::scope):
>+        (JSC::Parser::currentScope):
>+        (JSC::Parser::pushScope):
>+        (JSC::Parser::popScopeInternal):
>+        (JSC::Parser::popScope):
>+        (JSC::Parser::declareVariable):
>+        (JSC::Parser::hasDeclaredVariable):
>+        (JSC::Parser::hasDeclaredParameter):
>+        (JSC::Parser::declareWrite):
>+        (JSC::Parser::findCachedFunctionInfo):
>+        (JSC::Parser::continueIsValid):
>+        (JSC::Parser::pushLabel):
>+        (JSC::Parser::popLabel):
>+        (JSC::Parser::getLabel):
>+        (JSC::Parser::isLETMaskedAsIDENT):
>+        (JSC::Parser::restoreState):
>+        (JSC::Parser<LexerType>::parse):
>+        (JSC::Scope::preventNewDecls): Deleted.
>+        (JSC::Scope::allowsNewDecls): Deleted.
>+        (JSC::Scope::getCapturedVariables): Deleted.
>+        There are basic parser changes that now allow for the 'let'
>+        keyword. The trickiest change is how we will still treat 'let' 
>+        as an identifier for sloppy-mode code.
>+
>+        The most significant change to the parser made for this patch
>+        is appropriating the Scope struct to also also model a lexical 
>+        scope. Changes were made in how we track captured variables to 
>+        account for this. In general, I think some of this code could 
>+        benefit from a slight refactoring to make things cleaner.
>+
>+        * parser/ParserModes.h:
>+        * parser/ParserTokens.h:
>+        * parser/SyntaxChecker.h:
>+        (JSC::SyntaxChecker::createNewExpr):
>+        (JSC::SyntaxChecker::createConditionalExpr):
>+        (JSC::SyntaxChecker::createAssignResolve):
>+        (JSC::SyntaxChecker::createEmptyVarExpression):
>+        (JSC::SyntaxChecker::createClassExpr):
>+        (JSC::SyntaxChecker::createClassDeclStatement):
>+        (JSC::SyntaxChecker::createBlockStatement):
>+        (JSC::SyntaxChecker::createExprStatement):
>+        (JSC::SyntaxChecker::createIfStatement):
>+        (JSC::SyntaxChecker::createForLoop):
>+        (JSC::SyntaxChecker::createForInLoop):
>+        (JSC::SyntaxChecker::createForOfLoop):
>+        (JSC::SyntaxChecker::createEmptyStatement):
>+        (JSC::SyntaxChecker::createVarStatement):
>+        (JSC::SyntaxChecker::createLetStatement):
>+        (JSC::SyntaxChecker::createReturnStatement):
>+        (JSC::SyntaxChecker::createBreakStatement):
>+        (JSC::SyntaxChecker::createContinueStatement):
>+        (JSC::SyntaxChecker::createTryStatement):
>+        (JSC::SyntaxChecker::createSwitchStatement):
>+        (JSC::SyntaxChecker::createWhileStatement):
>+        (JSC::SyntaxChecker::createWithStatement):
>+        (JSC::SyntaxChecker::createDoWhileStatement):
>+        (JSC::SyntaxChecker::operatorStackPop):
>+        * runtime/CodeCache.cpp:
>+        (JSC::CodeCache::getGlobalCodeBlock):
>+        (JSC::CodeCache::getProgramCodeBlock):
>+        (JSC::CodeCache::getEvalCodeBlock):
>+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
>+        * runtime/CodeCache.h:
>+        (JSC::CodeCache::clear):
>+        * runtime/CommonSlowPaths.cpp:
>+        (JSC::SLOW_PATH_DECL):
>+        * runtime/ExceptionHelpers.cpp:
>+        (JSC::createErrorForInvalidGlobalAssignment):
>+        (JSC::createTDZError):
>+        (JSC::throwOutOfMemoryError):
>+        * runtime/ExceptionHelpers.h:
>+        * runtime/Executable.cpp:
>+        (JSC::EvalExecutable::create):
>+        * runtime/Executable.h:
>+        * runtime/JSCJSValue.h:
>+        (JSC::jsUndefined):
>+        (JSC::jsTDZValue):
>+        (JSC::jsBoolean):
>+        * runtime/JSEnvironmentRecord.h:
>+        (JSC::JSEnvironmentRecord::finishCreationUninitialized):
>+        (JSC::JSEnvironmentRecord::finishCreation):
>+        * runtime/JSGlobalObject.cpp:
>+        (JSC::JSGlobalObject::createProgramCodeBlock):
>+        (JSC::JSGlobalObject::createEvalCodeBlock):
>+        * runtime/JSGlobalObject.h:
>+        (JSC::JSGlobalObject::weakRandomInteger):
>+        * runtime/JSGlobalObjectFunctions.cpp:
>+        (JSC::globalFuncEval):
>+        * runtime/JSLexicalEnvironment.cpp:
>+        (JSC::JSLexicalEnvironment::symbolTableGet):
>+        (JSC::JSLexicalEnvironment::getOwnPropertySlot):
>+        * runtime/JSLexicalEnvironment.h:
>+        (JSC::JSLexicalEnvironment::create):
>+        (JSC::JSLexicalEnvironment::createStructure):
>+        Lexical environments now take an initial value to prefill
>+        their slots with. This is either undefined for function
>+        'var' environments and the TDZ empty value for lexical
>+        environments.
>+
>+        * runtime/JSScope.cpp:
>+        (JSC::JSScope::resolve):
>+        (JSC::JSScope::abstractResolve):
>+        (JSC::JSScope::collectVariablesUnderTDZ):
>+        (JSC::resolveModeName):
>+        * runtime/JSScope.h:
>+        * runtime/SymbolTable.cpp:
>+        (JSC::SymbolTable::cloneScopePart):
>+        * runtime/SymbolTable.h:
>+        (JSC::SymbolTableEntry::SymbolTableEntry):
>+        (JSC::SymbolTableEntry::~SymbolTableEntry):
>+        (JSC::SymbolTableEntry::setAttributes):
>+        (JSC::SymbolTableEntry::isReadOnly):
>+        (JSC::SymbolTableEntry::isDontEnum):
>+        (JSC::SymbolTableEntry::isLexicallyScoped):
>+        (JSC::SymbolTableEntry::disableWatching):
>+        (JSC::SymbolTableEntry::pack):
>+        SymbolTableEntry now uses an extra bit to
>+        determine if it corresponds to a lexical variable.
>+
>+        * runtime/WriteBarrier.h:
>+        (JSC::WriteBarrierBase<Unknown>::get):
>+        (JSC::WriteBarrierBase<Unknown>::clear):
>+        (JSC::WriteBarrierBase<Unknown>::setUndefined):
>+        (JSC::WriteBarrierBase<Unknown>::setStartingValue):
>+        (JSC::WriteBarrierBase<Unknown>::isNumber):
>+        (JSC::WriteBarrierBase<Unknown>::isObject):
>+        (JSC::WriteBarrierBase<Unknown>::isNull):
>+        * tests/stress/activation-sink-default-value-tdz-error.js: Added.
>+        (shouldThrowTDZ):
>+        (bar):
>+        (foo.cap):
>+        * tests/stress/activation-sink-osrexit-default-value-tdz-error.js: Added.
>+        (shouldThrowTDZ):
>+        (bar):
>+        * tests/stress/activation-sink-osrexit-default-value.js:
>+        * tests/stress/lexical-let-exception-handling.js: Added.
>+        (truth):
>+        (assert):
>+        (.):
>+        * tests/stress/lexical-let-global-not-captured-variables.js: Added.
>+        (truth):
>+        (assert):
>+        (foo):
>+        (.let.capY):
>+        * tests/stress/lexical-let-loop-semantics.js: Added.
>+        (truth):
>+        (assert):
>+        (shouldThrowTDZ):
>+        (.):
>+        * tests/stress/lexical-let-semantics.js: Added.
>+        (truth):
>+        (assert):
>+        (let.globalFunction):
>+        (let.retGlobalNumberCaptured):
>+        (let.setGlobalNumberCaptured):
>+        (.):
>+        * tests/stress/lexical-let-tdz.js: Added.
>+        (truth):
>+        (assert):
>+        (shouldThrowTDZ):
>+        (.):
>+
> 2015-06-30  Basile Clement  <basile_clement@apple.com>
> 
>         Allow object allocation sinking through GetScope, GetExecutable and SkipScope nodes
>Index: Source/JavaScriptCore/CMakeLists.txt
>===================================================================
>--- Source/JavaScriptCore/CMakeLists.txt	(revision 186105)
>+++ Source/JavaScriptCore/CMakeLists.txt	(working copy)
>@@ -382,6 +382,7 @@ set(JavaScriptCore_SOURCES
>     parser/SourceCode.cpp
>     parser/SourceProvider.cpp
>     parser/SourceProviderCache.cpp
>+    parser/VariableEnvironment.cpp
> 
>     profiler/LegacyProfiler.cpp
>     profiler/Profile.cpp
>Index: Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj	(revision 186105)
>+++ Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj	(working copy)
>@@ -657,6 +657,7 @@
>     <ClCompile Include="..\parser\SourceCode.cpp" />
>     <ClCompile Include="..\parser\SourceProvider.cpp" />
>     <ClCompile Include="..\parser\SourceProviderCache.cpp" />
>+    <ClCompile Include="..\parser\VariableEnvironment.cpp" />
>     <ClCompile Include="..\profiler\LegacyProfiler.cpp" />
>     <ClCompile Include="..\profiler\Profile.cpp" />
>     <ClCompile Include="..\profiler\ProfileGenerator.cpp" />
>@@ -1435,6 +1436,7 @@
>     <ClInclude Include="..\parser\SourceProviderCache.h" />
>     <ClInclude Include="..\parser\SourceProviderCacheItem.h" />
>     <ClInclude Include="..\parser\SyntaxChecker.h" />
>+    <ClInclude Include="..\parser\VariableEnvironment.h" />
>     <ClInclude Include="..\profiler\CallIdentifier.h" />
>     <ClInclude Include="..\profiler\LegacyProfiler.h" />
>     <ClInclude Include="..\profiler\Profile.h" />
>Index: Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters	(revision 186105)
>+++ Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters	(working copy)
>@@ -459,6 +459,9 @@
>     <ClCompile Include="..\parser\SourceProviderCache.cpp">
>       <Filter>parser</Filter>
>     </ClCompile>
>+    <ClCompile Include="..\parser\VariableEnvironment.cpp">
>+      <Filter>parser</Filter>
>+    </ClCompile>
>     <ClCompile Include="..\profiler\LegacyProfiler.cpp">
>       <Filter>profiler</Filter>
>     </ClCompile>
>@@ -2472,6 +2475,9 @@
>     <ClInclude Include="..\parser\SyntaxChecker.h">
>       <Filter>parser</Filter>
>     </ClInclude>
>+    <ClInclude Include="..\parser\VariableEnvironment.h">
>+      <Filter>parser</Filter>
>+    </ClInclude>
>     <ClInclude Include="..\profiler\CallIdentifier.h">
>       <Filter>profiler</Filter>
>     </ClInclude>
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 186105)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -945,6 +945,7 @@
> 		4340A4851A9051AF00D73CCA /* MathCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 4340A4831A9051AF00D73CCA /* MathCommon.h */; };
> 		4443AE3316E188D90076F110 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
> 		451539B912DC994500EF7AC4 /* Yarr.h in Headers */ = {isa = PBXBuildFile; fileRef = 451539B812DC994500EF7AC4 /* Yarr.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		525F239D1B459CF700FD39C4 /* VariableEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 525F239C1B459CF700FD39C4 /* VariableEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		52678F8E1A031009006A306D /* BasicBlockLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52678F8C1A031009006A306D /* BasicBlockLocation.cpp */; };
> 		52678F8F1A031009006A306D /* BasicBlockLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 52678F8D1A031009006A306D /* BasicBlockLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		52678F911A04177C006A306D /* ControlFlowProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 52678F901A04177C006A306D /* ControlFlowProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -1016,6 +1017,7 @@
> 		70ECA6071AFDBEA200449739 /* TemplateRegistry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70ECA6021AFDBEA200449739 /* TemplateRegistry.cpp */; };
> 		70ECA6081AFDBEA200449739 /* TemplateRegistry.h in Headers */ = {isa = PBXBuildFile; fileRef = 70ECA6031AFDBEA200449739 /* TemplateRegistry.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		70ECA6091AFDBEA200449739 /* TemplateRegistryKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 70ECA6041AFDBEA200449739 /* TemplateRegistryKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		79FE9B8D1B45D6C30093FAF4 /* VariableEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79FE9B8C1B45D6C30093FAF4 /* VariableEnvironment.cpp */; };
> 		7C008CD2186F8A9300955C24 /* JSPromiseFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C008CD0186F8A9300955C24 /* JSPromiseFunctions.cpp */; };
> 		7C008CD3186F8A9300955C24 /* JSPromiseFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 7C008CD1186F8A9300955C24 /* JSPromiseFunctions.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		7C008CDA187124BB00955C24 /* JSPromiseDeferred.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C008CD8187124BB00955C24 /* JSPromiseDeferred.cpp */; };
>@@ -2658,6 +2660,7 @@
> 		45E12D8806A49B0F00E9DF84 /* jsc.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = jsc.cpp; sourceTree = "<group>"; tabWidth = 4; };
> 		51F0EB6105C86C6B00E6DF1B /* Foundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Foundation.framework; path = /System/Library/Frameworks/Foundation.framework; sourceTree = "<absolute>"; };
> 		51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libobjc.dylib; path = /usr/lib/libobjc.dylib; sourceTree = "<absolute>"; };
>+		525F239C1B459CF700FD39C4 /* VariableEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VariableEnvironment.h; sourceTree = "<group>"; };
> 		52678F8C1A031009006A306D /* BasicBlockLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BasicBlockLocation.cpp; sourceTree = "<group>"; };
> 		52678F8D1A031009006A306D /* BasicBlockLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BasicBlockLocation.h; sourceTree = "<group>"; };
> 		52678F901A04177C006A306D /* ControlFlowProfiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ControlFlowProfiler.h; sourceTree = "<group>"; };
>@@ -2759,6 +2762,7 @@
> 		70ECA6021AFDBEA200449739 /* TemplateRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TemplateRegistry.cpp; sourceTree = "<group>"; };
> 		70ECA6031AFDBEA200449739 /* TemplateRegistry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemplateRegistry.h; sourceTree = "<group>"; };
> 		70ECA6041AFDBEA200449739 /* TemplateRegistryKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemplateRegistryKey.h; sourceTree = "<group>"; };
>+		79FE9B8C1B45D6C30093FAF4 /* VariableEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VariableEnvironment.cpp; sourceTree = "<group>"; };
> 		7C008CD0186F8A9300955C24 /* JSPromiseFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = JSPromiseFunctions.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
> 		7C008CD1186F8A9300955C24 /* JSPromiseFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPromiseFunctions.h; sourceTree = "<group>"; };
> 		7C008CD8187124BB00955C24 /* JSPromiseDeferred.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPromiseDeferred.cpp; sourceTree = "<group>"; };
>@@ -4324,6 +4328,8 @@
> 				E49DC15112EF272200184A1F /* SourceProviderCache.h */,
> 				E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */,
> 				A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */,
>+				525F239C1B459CF700FD39C4 /* VariableEnvironment.h */,
>+				79FE9B8C1B45D6C30093FAF4 /* VariableEnvironment.cpp */,
> 			);
> 			path = parser;
> 			sourceTree = "<group>";
>@@ -5621,6 +5627,7 @@
> 				0F898F321B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h in Headers */,
> 				86D3B2C410156BDE002865E7 /* ARMAssembler.h in Headers */,
> 				0FE050281AA9095600D33B33 /* ScopedArguments.h in Headers */,
>+				525F239D1B459CF700FD39C4 /* VariableEnvironment.h in Headers */,
> 				52C0611F1AA51E1C00B4ADBA /* RuntimeType.h in Headers */,
> 				FE4D55B81AE716CA0052E459 /* IterationStatus.h in Headers */,
> 				FE5068651AE246390009DAB7 /* DeferredSourceDump.h in Headers */,
>@@ -7064,6 +7071,7 @@
> 				969A07960ED1D3AE00F1F681 /* CodeBlock.cpp in Sources */,
> 				0F8F94401667633000D61971 /* CodeBlockHash.cpp in Sources */,
> 				0FC97F33182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.cpp in Sources */,
>+				79FE9B8D1B45D6C30093FAF4 /* VariableEnvironment.cpp in Sources */,
> 				0FD8A31317D4326C00CA2C40 /* CodeBlockSet.cpp in Sources */,
> 				A77F1821164088B200640A47 /* CodeCache.cpp in Sources */,
> 				0F8F9446166764F100D61971 /* CodeOrigin.cpp in Sources */,
>Index: Source/JavaScriptCore/builtins/BuiltinExecutables.cpp
>===================================================================
>--- Source/JavaScriptCore/builtins/BuiltinExecutables.cpp	(revision 186105)
>+++ Source/JavaScriptCore/builtins/BuiltinExecutables.cpp	(working copy)
>@@ -103,7 +103,8 @@ UnlinkedFunctionExecutable* BuiltinExecu
>             continue;
>     }
>     body->overrideName(name);
>-    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&m_vm, source, body, kind, WTF::move(sourceOverride));
>+    VariableEnvironment dummyTDZVariables;
>+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&m_vm, source, body, kind, dummyTDZVariables, WTF::move(sourceOverride));
>     functionExecutable->m_nameValue.set(m_vm, functionExecutable, jsString(&m_vm, name.string()));
>     return functionExecutable;
> }
>Index: Source/JavaScriptCore/bytecode/BytecodeList.json
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeList.json	(revision 186105)
>+++ Source/JavaScriptCore/bytecode/BytecodeList.json	(working copy)
>@@ -106,6 +106,7 @@
>             { "name" : "op_strcat", "length" : 4 },
>             { "name" : "op_to_primitive", "length" : 3 },
>             { "name" : "op_resolve_scope", "length" : 7 },
>+            { "name" : "op_get_from_scope_no_tdz", "length" : 8 },
>             { "name" : "op_get_from_scope", "length" : 8 },
>             { "name" : "op_put_to_scope", "length" : 7 },
>             { "name" : "op_get_from_arguments", "length" : 5 },
>@@ -113,6 +114,8 @@
>             { "name" : "op_push_with_scope", "length" : 3 },
>             { "name" : "op_pop_scope", "length" : 2 },
>             { "name" : "op_push_name_scope", "length" : 5 },
>+            { "name" : "op_push_lexical_scope", "length" : 4 },
>+            { "name" : "op_pop_lexical_scope", "length" : 2 },
>             { "name" : "op_catch", "length" : 3 },
>             { "name" : "op_throw", "length" : 2 },
>             { "name" : "op_throw_static_error", "length" : 3 },
>Index: Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(revision 186105)
>+++ Source/JavaScriptCore/bytecode/BytecodeUseDef.h	(working copy)
>@@ -58,6 +58,7 @@ void computeUsesForBytecodeOffset(
>     case op_to_this:
>     case op_check_tdz:
>     case op_pop_scope:
>+    case op_pop_lexical_scope:
>     case op_profile_will_call:
>     case op_profile_did_call:
>     case op_profile_type:
>@@ -122,8 +123,10 @@ void computeUsesForBytecodeOffset(
>     case op_init_global_const:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_get_from_scope:
>+    case op_get_from_scope_no_tdz:
>     case op_to_primitive:
>     case op_get_by_id:
>     case op_get_by_id_out_of_line:
>@@ -298,8 +301,10 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_enumerator_structure_pname:
>     case op_enumerator_generic_pname:
>     case op_pop_scope:
>+    case op_pop_lexical_scope:
>     case op_push_name_scope:
>     case op_push_with_scope:
>+    case op_push_lexical_scope:
>     case op_resolve_scope:
>     case op_strcat:
>     case op_to_primitive:
>@@ -312,6 +317,7 @@ void computeDefsForBytecodeOffset(CodeBl
>     case op_new_func_exp:
>     case op_call_varargs:
>     case op_construct_varargs:
>+    case op_get_from_scope_no_tdz:
>     case op_get_from_scope:
>     case op_call:
>     case op_call_eval:
>Index: Source/JavaScriptCore/bytecode/CodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.cpp	(revision 186105)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.cpp	(working copy)
>@@ -1473,6 +1473,11 @@ void CodeBlock::dumpBytecode(
>             printLocationOpAndRegisterOperand(out, exec, location, it, "pop_scope", r0);
>             break;
>         }
>+        case op_pop_lexical_scope: {
>+            int r0 = (++it)->u.operand;
>+            printLocationOpAndRegisterOperand(out, exec, location, it, "pop_lexical_scope", r0);
>+            break;
>+        }
>         case op_push_name_scope: {
>             int dst = (++it)->u.operand;
>             int r1 = (++it)->u.operand;
>@@ -1482,6 +1487,14 @@ void CodeBlock::dumpBytecode(
>             out.printf("%s, %s, %s, %s", registerName(dst).data(), registerName(r1).data(), constantName(k0).data(), (scopeType == JSNameScope::FunctionNameScope) ? "functionScope" : ((scopeType == JSNameScope::CatchScope) ? "catchScope" : "unknownScopeType"));
>             break;
>         }
>+        case op_push_lexical_scope: {
>+            int dst = (++it)->u.operand;
>+            int scope = (++it)->u.operand;
>+            int symbolTable = (++it)->u.operand;
>+            printLocationAndOp(out, exec, location, it, "push_lexical_scope");
>+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(scope).data(), registerName(symbolTable).data());
>+            break;
>+        }
>         case op_catch: {
>             int r0 = (++it)->u.operand;
>             int r1 = (++it)->u.operand;
>@@ -1536,14 +1549,15 @@ void CodeBlock::dumpBytecode(
>             ++it;
>             break;
>         }
>-        case op_get_from_scope: {
>+        case op_get_from_scope:
>+        case op_get_from_scope_no_tdz: {
>             int r0 = (++it)->u.operand;
>             int r1 = (++it)->u.operand;
>             int id0 = (++it)->u.operand;
>             ResolveModeAndType modeAndType = ResolveModeAndType((++it)->u.operand);
>             ++it; // Structure
>             int operand = (++it)->u.operand; // Operand
>-            printLocationAndOp(out, exec, location, it, "get_from_scope");
>+            printLocationAndOp(out, exec, location, it, opcode == op_get_from_scope_no_tdz ? "get_from_scope_no_tdz" : "get_from_scope");
>             out.print(registerName(r0), ", ", registerName(r1));
>             if (static_cast<unsigned>(id0) == UINT_MAX)
>                 out.print(", anonymous");
>@@ -1875,6 +1889,10 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>     UnlinkedInstructionStream::Reader instructionReader(unlinkedCodeBlock->instructions());
> 
>     Vector<Instruction, 0, UnsafeVectorOverflow> instructions(instructionCount);
>+
>+    Vector<SymbolTable*> symbolTableStack;
>+    HashSet<int, WTF::IntHash<int>, WTF::UnsignedWithZeroKeyHashTraits<int>> clonedConstantSymbolTables;
>+
>     for (unsigned i = 0; !instructionReader.atEnd(); ) {
>         const UnlinkedInstruction* pc = instructionReader.next();
> 
>@@ -1979,12 +1997,45 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             break;
>         }
> 
>+        case op_push_lexical_scope: {
>+            int constantIndex = pc[3].u.operand;
>+            SymbolTable* unlinkedTable = jsCast<SymbolTable*>(getConstant(constantIndex));
>+            RELEASE_ASSERT(unlinkedTable->scopeSize());
>+            // Different push_lexical_scope instructions may refer to the same symbol table. 
>+            // This is used for ES6's 'for' loops each having a separate activation. We will 
>+            // create two push_lexical_scope instructions for a given loop to implement this feature, 
>+            // but both instructions should rely on the same underlying symbol table so that the 
>+            // loop's scope isn't mistakenly inferred as a singleton scope. We can cache our results 
>+            // so we don't have extraneous calls to SymbolTable::cloneScopePart().
>+            SymbolTable* linkedTable;
>+            auto addResult = clonedConstantSymbolTables.add(constantIndex);
>+            if (addResult.isNewEntry) {
>+                linkedTable = unlinkedTable->cloneScopePart(*m_vm);
>+                replaceConstant(constantIndex, linkedTable);
>+            } else
>+                linkedTable = unlinkedTable;
>+            symbolTableStack.append(linkedTable);
>+            break;
>+        }
>+
>+        case op_create_lexical_environment: {
>+            if (symbolTable()->scopeSize())
>+                RELEASE_ASSERT(didCloneSymbolTable);
>+            symbolTableStack.append(symbolTable());
>+            break;
>+        }
>+
>+        case op_pop_lexical_scope: {
>+            symbolTableStack.removeLast();
>+            break;
>+        }
>+
>         case op_resolve_scope: {
>             const Identifier& ident = identifier(pc[3].u.operand);
>             ResolveType type = static_cast<ResolveType>(pc[4].u.operand);
>             RELEASE_ASSERT(type != LocalClosureVar);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, type);
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, type);
>             instructions[i + 4].u.operand = op.type;
>             instructions[i + 5].u.operand = op.depth;
>             if (op.lexicalEnvironment)
>@@ -1992,7 +2043,8 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             break;
>         }
> 
>-        case op_get_from_scope: {
>+        case op_get_from_scope:
>+        case op_get_from_scope_no_tdz: {
>             ValueProfile* profile = &m_valueProfiles[pc[opLength - 1].u.operand];
>             ASSERT(profile->m_bytecodeOffset == -1);
>             profile->m_bytecodeOffset = i;
>@@ -2008,7 +2060,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[3].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Get, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Get, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -2025,13 +2077,20 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             if (modeAndType.type() == LocalClosureVar) {
>                 // Only do watching if the property we're putting to is not anonymous.
>                 if (static_cast<unsigned>(pc[2].u.operand) != UINT_MAX) {
>-                    RELEASE_ASSERT(didCloneSymbolTable);
>                     const Identifier& ident = identifier(pc[2].u.operand);
>-                    ConcurrentJITLocker locker(m_symbolTable->m_lock);
>-                    SymbolTable::Map::iterator iter = m_symbolTable->find(locker, ident.impl());
>-                    ASSERT(iter != m_symbolTable->end(locker));
>-                    iter->value.prepareToWatch();
>-                    instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                    bool found = false;
>+                    for (unsigned stackIdx = symbolTableStack.size(); stackIdx--; ) {
>+                        SymbolTable* symbolTable = symbolTableStack[stackIdx];
>+                        ConcurrentJITLocker locker(symbolTable->m_lock);
>+                        SymbolTable::Map::iterator iter = symbolTable->find(locker, ident.impl());
>+                        if (iter != symbolTable->end(locker)) {
>+                            iter->value.prepareToWatch();
>+                            instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
>+                            found = true;
>+                            break;
>+                        }
>+                    }
>+                    RELEASE_ASSERT(found);
>                 } else
>                     instructions[i + 5].u.watchpointSet = nullptr;
>                 break;
>@@ -2039,7 +2098,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
> 
>             const Identifier& ident = identifier(pc[2].u.operand);
> 
>-            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, Put, modeAndType.type());
>+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, Put, modeAndType.type());
> 
>             instructions[i + 4].u.operand = ResolveModeAndType(modeAndType.mode(), op.type).operand();
>             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks)
>@@ -2071,7 +2130,7 @@ CodeBlock::CodeBlock(ScriptExecutable* o
>             case ProfileTypeBytecodeGetFromScope: {
>                 const Identifier& ident = identifier(pc[4].u.operand);
>                 ResolveType type = static_cast<ResolveType>(pc[5].u.operand);
>-                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), needsActivation(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
>+                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), symbolTableStack.size(), scope, ident, (flag == ProfileTypeBytecodeGetFromScope ? Get : Put), type);
> 
>                 // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
>                 // https://bugs.webkit.org/show_bug.cgi?id=135184
>@@ -2599,6 +2658,7 @@ void CodeBlock::finalizeUnconditionally(
>                 break;
>             }
>             case op_get_from_scope:
>+            case op_get_from_scope_no_tdz:
>             case op_put_to_scope: {
>                 ResolveModeAndType modeAndType =
>                     ResolveModeAndType(curInstruction[4].u.operand);
>Index: Source/JavaScriptCore/bytecode/CodeBlock.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/CodeBlock.h	(revision 186105)
>+++ Source/JavaScriptCore/bytecode/CodeBlock.h	(working copy)
>@@ -937,6 +937,12 @@ private:
>         m_constantsSourceCodeRepresentation = constantsSourceCodeRepresentation;
>     }
> 
>+    void replaceConstant(int index, JSValue value)
>+    {
>+        ASSERT(isConstantRegisterIndex(index) && static_cast<size_t>(index - FirstConstantRegisterIndex) < m_constantRegisters.size());
>+        m_constantRegisters[index - FirstConstantRegisterIndex].set(m_globalObject->vm(), m_ownerExecutable.get(), value);
>+    }
>+
>     void dumpBytecode(
>         PrintStream&, ExecState*, const Instruction* begin, const Instruction*&,
>         const StubInfoMap& = StubInfoMap(), const CallLinkInfoMap& = CallLinkInfoMap());
>Index: Source/JavaScriptCore/bytecode/EvalCodeCache.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/EvalCodeCache.h	(revision 186105)
>+++ Source/JavaScriptCore/bytecode/EvalCodeCache.h	(working copy)
>@@ -52,7 +52,9 @@ namespace JSC {
>         
>         EvalExecutable* getSlow(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, ThisTDZMode thisTDZMode, const String& evalSource, JSScope* scope)
>         {
>-            EvalExecutable* evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext, thisTDZMode);
>+            VariableEnvironment variablesUnderTDZ;
>+            JSScope::collectVariablesUnderTDZ(scope, variablesUnderTDZ);
>+            EvalExecutable* evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext, thisTDZMode, &variablesUnderTDZ);
>             if (!evalExecutable)
>                 return 0;
> 
>Index: Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp	(revision 186105)
>+++ Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp	(working copy)
>@@ -43,7 +43,7 @@
> 
> namespace JSC {
> 
>-static_assert(sizeof(UnlinkedFunctionExecutable) <= 128, "UnlinkedFunctionExecutable should fit in a 128-byte cell.");
>+static_assert(sizeof(UnlinkedFunctionExecutable) <= 256, "UnlinkedFunctionExecutable should fit in a 256-byte cell.");
> 
> const ClassInfo UnlinkedFunctionExecutable::s_info = { "UnlinkedFunctionExecutable", 0, 0, CREATE_METHOD_TABLE(UnlinkedFunctionExecutable) };
> const ClassInfo UnlinkedCodeBlock::s_info = { "UnlinkedCodeBlock", 0, 0, CREATE_METHOD_TABLE(UnlinkedCodeBlock) };
>@@ -73,14 +73,14 @@ static UnlinkedFunctionCodeBlock* genera
>     
>     UnlinkedFunctionCodeBlock* result = UnlinkedFunctionCodeBlock::create(&vm, FunctionCode,
>         ExecutableInfo(function->needsActivation(), function->usesEval(), function->isStrictMode(), kind == CodeForConstruct, functionKind == UnlinkedBuiltinFunction, executable->constructorKind()));
>-    auto generator(std::make_unique<BytecodeGenerator>(vm, function.get(), result, debuggerMode, profilerMode));
>+    auto generator(std::make_unique<BytecodeGenerator>(vm, function.get(), result, debuggerMode, profilerMode, executable->parentScopeTDZVariables()));
>     error = generator->generate();
>     if (error.isValid())
>         return nullptr;
>     return result;
> }
> 
>-UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM* vm, Structure* structure, const SourceCode& source, RefPtr<SourceProvider>&& sourceOverride, FunctionBodyNode* node, UnlinkedFunctionKind kind)
>+UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM* vm, Structure* structure, const SourceCode& source, RefPtr<SourceProvider>&& sourceOverride, FunctionBodyNode* node, UnlinkedFunctionKind kind, VariableEnvironment& parentScopeTDZVariables)
>     : Base(*vm, structure)
>     , m_name(node->ident())
>     , m_inferredName(node->inferredName())
>@@ -104,6 +104,7 @@ UnlinkedFunctionExecutable::UnlinkedFunc
>     , m_functionMode(node->functionMode())
> {
>     ASSERT(m_constructorKind == static_cast<unsigned>(node->constructorKind()));
>+    m_parentScopeTDZVariables.swap(parentScopeTDZVariables);
> }
> 
> size_t UnlinkedFunctionExecutable::parameterCount() const
>Index: Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h	(revision 186105)
>+++ Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h	(working copy)
>@@ -38,6 +38,7 @@
> #include "RegExp.h"
> #include "SpecialPointer.h"
> #include "SymbolTable.h"
>+#include "VariableEnvironment.h"
> #include "VirtualRegister.h"
> 
> #include <wtf/RefCountedArray.h>
>@@ -107,10 +108,10 @@ public:
>     typedef JSCell Base;
>     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
> 
>-    static UnlinkedFunctionExecutable* create(VM* vm, const SourceCode& source, FunctionBodyNode* node, UnlinkedFunctionKind unlinkedFunctionKind, RefPtr<SourceProvider>&& sourceOverride = nullptr)
>+    static UnlinkedFunctionExecutable* create(VM* vm, const SourceCode& source, FunctionBodyNode* node, UnlinkedFunctionKind unlinkedFunctionKind, VariableEnvironment& parentScopeTDZVariables, RefPtr<SourceProvider>&& sourceOverride = nullptr)
>     {
>         UnlinkedFunctionExecutable* instance = new (NotNull, allocateCell<UnlinkedFunctionExecutable>(vm->heap))
>-            UnlinkedFunctionExecutable(vm, vm->unlinkedFunctionExecutableStructure.get(), source, WTF::move(sourceOverride), node, unlinkedFunctionKind);
>+            UnlinkedFunctionExecutable(vm, vm->unlinkedFunctionExecutableStructure.get(), source, WTF::move(sourceOverride), node, unlinkedFunctionKind, parentScopeTDZVariables);
>         instance->finishCreation(*vm);
>         return instance;
>     }
>@@ -170,9 +171,10 @@ public:
> 
>     bool isBuiltinFunction() const { return m_isBuiltinFunction; }
>     bool isClassConstructorFunction() const { return constructorKind() != ConstructorKind::None; }
>+    const VariableEnvironment* parentScopeTDZVariables() const { return &m_parentScopeTDZVariables; }
> 
> private:
>-    UnlinkedFunctionExecutable(VM*, Structure*, const SourceCode&, RefPtr<SourceProvider>&& sourceOverride, FunctionBodyNode*, UnlinkedFunctionKind);
>+    UnlinkedFunctionExecutable(VM*, Structure*, const SourceCode&, RefPtr<SourceProvider>&& sourceOverride, FunctionBodyNode*, UnlinkedFunctionKind, VariableEnvironment&);
>     WriteBarrier<UnlinkedFunctionCodeBlock> m_codeBlockForCall;
>     WriteBarrier<UnlinkedFunctionCodeBlock> m_codeBlockForConstruct;
> 
>@@ -183,6 +185,7 @@ private:
>     WriteBarrier<SymbolTable> m_symbolTableForConstruct;
>     RefPtr<FunctionParameters> m_parameters;
>     RefPtr<SourceProvider> m_sourceOverride;
>+    VariableEnvironment m_parentScopeTDZVariables;
>     unsigned m_firstLineOffset;
>     unsigned m_lineCount;
>     unsigned m_unlinkedFunctionNameStart;
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 186105)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
>@@ -76,18 +76,31 @@ ParserError BytecodeGenerator::generate(
>         entry.second->bindValue(*this, entry.first.get());
>     }
> 
>+    pushLexicalScope(m_scopeNode);
>+
>     {
>         RefPtr<RegisterID> temp = newTemporary();
>-        RefPtr<RegisterID> globalScope = scopeRegister(); // FIXME: With lexical scoping, this won't always be the global object: https://bugs.webkit.org/show_bug.cgi?id=142944 
>+        RefPtr<RegisterID> globalScope;
>         for (auto functionPair : m_functionsToInitialize) {
>             FunctionBodyNode* functionBody = functionPair.first;
>             FunctionVariableType functionType = functionPair.second;
>             emitNewFunction(temp.get(), functionBody);
>             if (functionType == NormalFunctionVariable)
>                 initializeVariable(variable(functionBody->ident()) , temp.get());
>-            else if (functionType == GlobalFunctionVariable)
>+            else if (functionType == GlobalFunctionVariable) {
>+                if (!globalScope) {
>+                    if (m_symbolTableStack.isEmpty() || !m_symbolTableStack.first().second) {
>+                        // We haven't allocated a lexical scope on top of the global object, so scopeRegister() will correspond to the global scope.
>+                        globalScope = scopeRegister();
>+                    } else {
>+                        ASSERT(m_scopeNode->lexicalVariables().hasCapturedVariables());
>+                        RefPtr<RegisterID> globalObjectScope = emitResolveScope(nullptr, Variable(functionBody->ident()));
>+                        globalScope = newBlockScopeVariable();
>+                        emitMove(globalScope.get(), globalObjectScope.get());
>+                    }
>+                }
>                 emitPutToScope(globalScope.get(), Variable(functionBody->ident()), temp.get(), ThrowIfNotFound);
>-            else
>+            } else
>                 RELEASE_ASSERT_NOT_REACHED();
>         }
>     }
>@@ -148,7 +161,7 @@ ParserError BytecodeGenerator::generate(
>     return ParserError(ParserError::ErrorNone);
> }
> 
>-BytecodeGenerator::BytecodeGenerator(VM& vm, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>+BytecodeGenerator::BytecodeGenerator(VM& vm, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode, const VariableEnvironment* parentScopeTDZVariables)
>     : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
>     , m_shouldEmitProfileHooks(Options::forceProfilerBytecodeGeneration() || profilerMode == ProfilerOn)
>     , m_scopeNode(programNode)
>@@ -157,6 +170,8 @@ BytecodeGenerator::BytecodeGenerator(VM&
>     , m_codeType(GlobalCode)
>     , m_vm(&vm)
> {
>+    ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables->size());
>+
>     for (auto& constantRegister : m_linkTimeConstantRegisters)
>         constantRegister = nullptr;
> 
>@@ -179,7 +194,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
> 
> }
> 
>-BytecodeGenerator::BytecodeGenerator(VM& vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>+BytecodeGenerator::BytecodeGenerator(VM& vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode, const VariableEnvironment* parentScopeTDZVariables)
>     : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
>     , m_shouldEmitProfileHooks(Options::forceProfilerBytecodeGeneration() || profilerMode == ProfilerOn)
>     , m_symbolTable(codeBlock->symbolTable())
>@@ -495,9 +510,12 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         instructions().append(0);
>         instructions().append(0);
>     }
>+
>+    m_symbolTableStack.append(SymbolTableStackEntry(Strong<SymbolTable>(*m_vm, m_symbolTable), m_lexicalEnvironmentRegister));
>+    m_TDZStack.append(parentScopeTDZVariables);
> }
> 
>-BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode)
>+BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode, const VariableEnvironment* parentScopeTDZVariables)
>     : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
>     , m_shouldEmitProfileHooks(Options::forceProfilerBytecodeGeneration() || profilerMode == ProfilerOn)
>     , m_symbolTable(codeBlock->symbolTable())
>@@ -530,6 +548,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
>         variables.append(varStack[i].first);
>     }
>     codeBlock->adoptVariables(variables);
>+    m_TDZStack.append(parentScopeTDZVariables);
> }
> 
> BytecodeGenerator::~BytecodeGenerator()
>@@ -564,12 +583,23 @@ RegisterID* BytecodeGenerator::newRegist
>     return &m_calleeRegisters.last();
> }
> 
>-RegisterID* BytecodeGenerator::newTemporary()
>+void BytecodeGenerator::reclaimFreeRegisters()
> {
>-    // Reclaim free register IDs.
>     while (m_calleeRegisters.size() && !m_calleeRegisters.last().refCount())
>         m_calleeRegisters.removeLast();
>-        
>+}
>+
>+RegisterID* BytecodeGenerator::newBlockScopeVariable()
>+{
>+    reclaimFreeRegisters();
>+
>+    return newRegister();
>+}
>+
>+RegisterID* BytecodeGenerator::newTemporary()
>+{
>+    reclaimFreeRegisters();
>+
>     RegisterID* result = newRegister();
>     result->setTemporary();
>     return result;
>@@ -1219,6 +1249,182 @@ RegisterID* BytecodeGenerator::emitLoadG
>     return m_globalObjectRegister;
> }
> 
>+void BytecodeGenerator::pushLexicalScope(LexicalNode* node, RegisterID** constantSymbolTableResult)
>+{
>+    VariableEnvironment& environment = node->lexicalVariables();
>+    if (!environment.size())
>+        return;
>+
>+    if (m_shouldEmitDebugHooks)
>+        environment.markAllVariablesAsCaptured();
>+
>+    Strong<SymbolTable> symbolTable(*m_vm, SymbolTable::create(*m_vm));
>+    bool hasCapturedVariables = false;
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto entry : environment) {
>+            SymbolTableEntry symbolTableEntry = symbolTable->get(locker, entry.key.get());
>+            ASSERT(symbolTableEntry.isNull());
>+
>+            VarKind varKind = entry.value.isCaptured() ? VarKind::Scope : VarKind::Stack;
>+            VarOffset varOffset;
>+            if (varKind == VarKind::Scope) {
>+                varOffset = VarOffset(symbolTable->takeNextScopeOffset(locker));
>+                hasCapturedVariables = true;
>+            } else {
>+                ASSERT(varKind == VarKind::Stack);
>+                RegisterID* local = newBlockScopeVariable();
>+                local->ref();
>+                varOffset = VarOffset(local->virtualRegister());
>+            }
>+            // FIXME: Make this work with 'const' variables: https://bugs.webkit.org/show_bug.cgi?id=31813 
>+            SymbolTableEntry newEntry(varOffset, 0, true);
>+            symbolTable->add(locker, entry.key.get(), newEntry);
>+        }
>+    }
>+
>+    RegisterID* newScope = nullptr;
>+    if (hasCapturedVariables) {
>+        newScope = newBlockScopeVariable();
>+        newScope->ref();
>+
>+        RegisterID* constantSymbolTable = addConstantValue(symbolTable->cloneScopePart(*m_vm));
>+        if (constantSymbolTableResult)
>+            *constantSymbolTableResult = constantSymbolTable;
>+
>+        emitOpcode(op_push_lexical_scope);
>+        instructions().append(newScope->index());
>+        instructions().append(scopeRegister()->index());
>+        instructions().append(constantSymbolTable->index());
>+
>+        emitMove(scopeRegister(), newScope);
>+    }
>+
>+    m_symbolTableStack.append(SymbolTableStackEntry(symbolTable, newScope));
>+    m_TDZStack.append(&environment);
>+    // Prefill stack variables with the TDZ empty value.
>+    // Scope variables will be initialized to the TDZ empty value when JSLexicalEnvironment is allocated.
>+    for (auto entry : environment) {
>+        SymbolTableEntry symbolTableEntry = symbolTable->get(entry.key.get());
>+        ASSERT(!symbolTableEntry.isNull());
>+        VarOffset offset = symbolTableEntry.varOffset();
>+        if (offset.isScope()) {
>+            ASSERT(newScope);
>+            continue;
>+        }
>+        ASSERT(offset.isStack());
>+        emitMoveEmptyValue(&registerFor(offset.stackOffset()));
>+    }
>+}
>+
>+void BytecodeGenerator::popLexicalScope(LexicalNode* node)
>+{
>+    VariableEnvironment& environment = node->lexicalVariables();
>+    if (!environment.size())
>+        return;
>+
>+    if (m_shouldEmitDebugHooks)
>+        environment.markAllVariablesAsCaptured();
>+
>+    SymbolTableStackEntry stackEntry = m_symbolTableStack.takeLast();
>+    Strong<SymbolTable> symbolTable = stackEntry.first;
>+    ConcurrentJITLocker locker(symbolTable->m_lock);
>+    bool hasCapturedVariables = false;
>+    for (auto entry : environment) {
>+        if (entry.value.isCaptured()) {
>+            hasCapturedVariables = true;
>+            continue;
>+        }
>+        SymbolTableEntry symbolTableEntry = symbolTable->get(locker, entry.key.get());
>+        ASSERT(!symbolTableEntry.isNull());
>+        VarOffset offset = symbolTableEntry.varOffset();
>+        ASSERT(offset.isStack());
>+        RegisterID* local = &registerFor(offset.stackOffset());
>+        local->deref();
>+    }
>+
>+    if (hasCapturedVariables) {
>+        RELEASE_ASSERT(stackEntry.second);
>+        stackEntry.second->deref();
>+        emitOpcode(op_pop_lexical_scope);
>+        instructions().append(scopeRegister()->index());
>+    }
>+
>+    RELEASE_ASSERT(m_TDZStack.last() == &environment);
>+    m_TDZStack.removeLast();
>+}
>+
>+void BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration(LexicalNode* node, RegisterID* loopSymbolTable)
>+{
>+    VariableEnvironment& environment = node->lexicalVariables();
>+    if (m_shouldEmitDebugHooks)
>+        environment.markAllVariablesAsCaptured();
>+    if (!environment.hasCapturedVariables())
>+        return;
>+
>+    RELEASE_ASSERT(loopSymbolTable);
>+
>+    // This function needs to do setup for a for loop's activation if any of
>+    // the for loop's lexically declared variables are captured (that is, variables
>+    // declared in the loop header, not the loop body). This function needs to
>+    // make a copy of the current activation and copy the values from the previous
>+    // activation into the new activation because each iteration of a for loop
>+    // gets a new activation.
>+
>+    SymbolTableStackEntry stackEntry = m_symbolTableStack.last();
>+    Strong<SymbolTable> symbolTable = stackEntry.first;
>+    RegisterID* loopScope = stackEntry.second;
>+    ASSERT(symbolTable->scopeSize());
>+    ASSERT(loopScope);
>+    Vector<std::pair<RegisterID*, Identifier>> activationValuesToCopyOver;
>+
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        activationValuesToCopyOver.reserveInitialCapacity(symbolTable->scopeSize());
>+
>+        for (auto end = symbolTable->end(locker), ptr = symbolTable->begin(locker); ptr != end; ++ptr) {
>+            if (!ptr->value.varOffset().isScope())
>+                continue;
>+
>+            RefPtr<UniquedStringImpl> ident = ptr->key;
>+            Identifier identifier = Identifier::fromUid(m_vm, ident.get());
>+
>+            RegisterID* transitionValue = newBlockScopeVariable();
>+            transitionValue->ref();
>+            emitGetFromScope(transitionValue, loopScope, variableForLocalEntry(identifier, ptr->value), DoNotThrowIfNotFound, DoesNotNeedTDZCheck);
>+            activationValuesToCopyOver.uncheckedAppend(std::make_pair(transitionValue, identifier));
>+        }
>+    }
>+
>+    // We need this dynamic behavior of the executing code to ensure
>+    // each loop iteration has a new activation object. (It's pretty ugly).
>+    // Also, this new activation needs to be assigned to the same register
>+    // as the previous scope because the loop body is compiled under
>+    // the assumption that the scope's register index is constant even
>+    // though the value in that register will change on each loop iteration.
>+    emitOpcode(op_pop_lexical_scope);
>+    instructions().append(scopeRegister()->index());
>+
>+    emitOpcode(op_push_lexical_scope);
>+    instructions().append(loopScope->index());
>+    instructions().append(scopeRegister()->index());
>+    instructions().append(loopSymbolTable->index());
>+
>+    emitMove(scopeRegister(), loopScope);
>+
>+    {
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto pair : activationValuesToCopyOver) {
>+            const Identifier& identifier = pair.second;
>+            SymbolTableEntry entry = symbolTable->get(locker, identifier.impl());
>+            RELEASE_ASSERT(!entry.isNull());
>+            RegisterID* transitionValue = pair.first;
>+            emitPutToScope(loopScope, variableForLocalEntry(identifier, entry), transitionValue, DoNotThrowIfNotFound);
>+            transitionValue->deref();
>+        }
>+    }
>+}
>+
> Variable BytecodeGenerator::variable(const Identifier& property)
> {
>     if (property == propertyNames().thisIdentifier) {
>@@ -1227,20 +1433,19 @@ Variable BytecodeGenerator::variable(con
>             ReadOnly, Variable::SpecialVariable);
>     }
>     
>-    if (!shouldOptimizeLocals())
>-        return Variable(property);
>-    
>-    SymbolTableEntry entry = symbolTable().get(property.impl());
>-    if (entry.isNull())
>-        return Variable(property);
>-    
>-    if (entry.varOffset().isScope() && m_localScopeDepth) {
>-        // FIXME: We should be able to statically resolve through our local scopes.
>-        // https://bugs.webkit.org/show_bug.cgi?id=141885
>+    if (m_localScopeDepth)
>         return Variable(property);
>+
>+    for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+        Strong<SymbolTable> symbolTable = m_symbolTableStack[i].first;
>+        SymbolTableEntry entry = symbolTable->get(property.impl());
>+        if (entry.isNull())
>+            continue;
>+        
>+        return variableForLocalEntry(property, entry);
>     }
>-    
>-    return variableForLocalEntry(property, entry);
>+
>+    return Variable(property);
> }
> 
> Variable BytecodeGenerator::variablePerSymbolTable(const Identifier& property)
>@@ -1271,7 +1476,6 @@ void BytecodeGenerator::createVariable(
>     ExistingVariableMode existingVariableMode)
> {
>     ASSERT(property != propertyNames().thisIdentifier);
>-    
>     ConcurrentJITLocker locker(symbolTable().m_lock);
>     SymbolTableEntry entry = symbolTable().get(locker, property.impl());
>     
>@@ -1348,7 +1552,19 @@ RegisterID* BytecodeGenerator::emitResol
>         // don't do that already is that m_lexicalEnvironment is required by ConstDeclNode. ConstDeclNode
>         // requires weird things because it is a shameful pile of nonsense, but block scoping would make
>         // that code sensible and obviate the need for us to do bad things.
>-        return m_lexicalEnvironmentRegister;
>+        for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+            Strong<SymbolTable> symbolTable = m_symbolTableStack[i].first;
>+            SymbolTableEntry entry = symbolTable->get(variable.ident().impl());
>+            if (entry.isNull())
>+                continue;
>+            
>+            RegisterID* scope = m_symbolTableStack[i].second; 
>+            RELEASE_ASSERT(scope);
>+            return scope;
>+        }
>+
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return nullptr;
>         
>     case VarKind::Invalid:
>         // Indicates non-local resolution.
>@@ -1373,7 +1589,7 @@ RegisterID* BytecodeGenerator::emitResol
>     return nullptr;
> }
> 
>-RegisterID* BytecodeGenerator::emitGetFromScope(RegisterID* dst, RegisterID* scope, const Variable& variable, ResolveMode resolveMode)
>+RegisterID* BytecodeGenerator::emitGetFromScope(RegisterID* dst, RegisterID* scope, const Variable& variable, ResolveMode resolveMode, GetFromScopeTDZCheck check)
> {
>     switch (variable.offset().kind()) {
>     case VarKind::Stack:
>@@ -1393,7 +1609,11 @@ RegisterID* BytecodeGenerator::emitGetFr
>         m_codeBlock->addPropertyAccessInstruction(instructions().size());
>         
>         // get_from_scope dst, scope, id, ResolveModeAndType, Structure, Operand
>-        UnlinkedValueProfile profile = emitProfiledOpcode(op_get_from_scope);
>+        UnlinkedValueProfile profile; 
>+        if (check == MayNeedTDZCheck && needsTDZCheck(variable))
>+            profile = emitProfiledOpcode(op_get_from_scope);
>+        else 
>+            profile = emitProfiledOpcode(op_get_from_scope_no_tdz);
>         instructions().append(kill(dst));
>         instructions().append(scope->index());
>         instructions().append(addConstant(variable.ident()));
>@@ -1448,26 +1668,8 @@ RegisterID* BytecodeGenerator::emitPutTo
> 
> RegisterID* BytecodeGenerator::initializeVariable(const Variable& variable, RegisterID* value)
> {
>-    RegisterID* scope;
>-    switch (variable.offset().kind()) {
>-    case VarKind::Stack:
>-        scope = nullptr;
>-        break;
>-        
>-    case VarKind::DirectArgument:
>-        scope = argumentsRegister();
>-        break;
>-        
>-    case VarKind::Scope:
>-        scope = scopeRegister();
>-        break;
>-        
>-    default:
>-        RELEASE_ASSERT_NOT_REACHED();
>-        scope = nullptr;
>-        break;
>-    }
>-
>+    RELEASE_ASSERT(variable.offset().kind() != VarKind::Invalid);
>+    RegisterID* scope = emitResolveScope(nullptr, variable);
>     return emitPutToScope(scope, variable, value, ThrowIfNotFound);
> }
> 
>@@ -1691,6 +1893,38 @@ void BytecodeGenerator::emitTDZCheck(Reg
>     instructions().append(target->index());
> }
> 
>+bool BytecodeGenerator::needsTDZCheck(const Variable& variable)
>+{
>+    // FIXME: When allowing 'let' in sloppy mode, we need to consider other factors here such as 'eval'.
>+    for (unsigned i = m_TDZStack.size(); i--;) {
>+        const VariableEnvironment* identifiers = m_TDZStack[i];
>+        if (identifiers->contains(variable.ident().impl()))
>+            return true;
>+    }
>+
>+    return false;
>+}
>+
>+void BytecodeGenerator::emitTDZCheckIfNecessary(const Variable& variable, RegisterID* target, RegisterID* scope)
>+{
>+    if (needsTDZCheck(variable)) {
>+        if (target)
>+            emitTDZCheck(target);
>+        else {
>+            RELEASE_ASSERT(!variable.isLocal() && scope);
>+            emitGetFromScope(newTemporary(), scope, variable, DoNotThrowIfNotFound, MayNeedTDZCheck); // get_from_scope will perform the TDZ check.
>+        }
>+    }
>+}
>+
>+void BytecodeGenerator::getVariablesUnderTDZ(VariableEnvironment& result)
>+{
>+    for (auto identifierSet : m_TDZStack) {
>+        for (auto entry : *identifierSet)
>+            result.add(entry.key);
>+    }
>+}
>+
> RegisterID* BytecodeGenerator::emitNewObject(RegisterID* dst)
> {
>     size_t begin = instructions().size();
>@@ -2227,6 +2461,7 @@ void BytecodeGenerator::pushFinallyConte
>         static_cast<unsigned>(m_forInContextStack.size()),
>         static_cast<unsigned>(m_tryContextStack.size()),
>         static_cast<unsigned>(m_labelScopes.size()),
>+        static_cast<unsigned>(m_symbolTableStack.size()),
>         m_finallyDepth,
>         m_localScopeDepth
>     };
>@@ -2252,6 +2487,7 @@ void BytecodeGenerator::pushIteratorClos
>         static_cast<unsigned>(m_forInContextStack.size()),
>         static_cast<unsigned>(m_tryContextStack.size()),
>         static_cast<unsigned>(m_labelScopes.size()),
>+        static_cast<unsigned>(m_symbolTableStack.size()),
>         m_finallyDepth,
>         m_localScopeDepth
>     };
>@@ -2399,6 +2635,7 @@ void BytecodeGenerator::emitComplexPopSc
>         Vector<SwitchInfo> savedSwitchContextStack;
>         Vector<std::unique_ptr<ForInContext>> savedForInContextStack;
>         Vector<TryContext> poppedTryContexts;
>+        Vector<SymbolTableStackEntry> savedSymbolTableStack;
>         LabelScopeStore savedLabelScopes;
>         while (topScope > bottomScope && topScope->isFinallyBlock) {
>             RefPtr<Label> beforeFinally = emitLabel(newLabel().get());
>@@ -2411,6 +2648,7 @@ void BytecodeGenerator::emitComplexPopSc
>             bool flipForIns = finallyContext.forInContextStackSize != m_forInContextStack.size();
>             bool flipTries = finallyContext.tryContextStackSize != m_tryContextStack.size();
>             bool flipLabelScopes = finallyContext.labelScopesSize != m_labelScopes.size();
>+            bool flipSymbolTableStack = finallyContext.symbolTableStackSize != m_symbolTableStack.size();
>             int topScopeIndex = -1;
>             int bottomScopeIndex = -1;
>             if (flipScopes) {
>@@ -2445,6 +2683,10 @@ void BytecodeGenerator::emitComplexPopSc
>                 while (m_labelScopes.size() > finallyContext.labelScopesSize)
>                     m_labelScopes.removeLast();
>             }
>+            if (flipSymbolTableStack) {
>+                savedSymbolTableStack = m_symbolTableStack;
>+                m_symbolTableStack.shrink(finallyContext.symbolTableStackSize);
>+            }
>             int savedFinallyDepth = m_finallyDepth;
>             m_finallyDepth = finallyContext.finallyDepth;
>             int savedDynamicScopeDepth = m_localScopeDepth;
>@@ -2482,6 +2724,8 @@ void BytecodeGenerator::emitComplexPopSc
>             }
>             if (flipLabelScopes)
>                 m_labelScopes = savedLabelScopes;
>+            if (flipSymbolTableStack)
>+                m_symbolTableStack = savedSymbolTableStack;
>             m_finallyDepth = savedFinallyDepth;
>             m_localScopeDepth = savedDynamicScopeDepth;
>             
>@@ -2542,7 +2786,7 @@ void BytecodeGenerator::popTryAndEmitCat
>     m_tryContextStack.removeLast();
>     
>     emitLabel(tryRange.tryData->target.get());
>-    tryRange.tryData->targetScopeDepth = m_localScopeDepth;
>+    tryRange.tryData->targetScopeDepth = calculateTargetScopeDepthForExceptionHandler();
>     tryRange.tryData->handlerType = handlerType;
> 
>     emitOpcode(op_catch);
>@@ -2550,6 +2794,27 @@ void BytecodeGenerator::popTryAndEmitCat
>     instructions().append(thrownValueRegister->index());
> }
> 
>+int BytecodeGenerator::calculateTargetScopeDepthForExceptionHandler() const
>+{
>+    int depth = m_localScopeDepth;
>+
>+    for (unsigned i = m_symbolTableStack.size(); i--; ) {
>+        RegisterID* scope = m_symbolTableStack[i].second; 
>+        if (scope)
>+            depth++;
>+    }
>+
>+    // Currently, we're maintaing compatibility with how things are done and letting the exception handling
>+    // code take into consideration the base activation of the function. There is no reason we shouldn't 
>+    // be able to calculate the exact depth here and let the exception handler not worry if there is a base
>+    // activation or not.
>+    if (m_lexicalEnvironmentRegister)
>+        depth--;
>+
>+    ASSERT(depth >= 0);
>+    return depth;
>+}
>+
> void BytecodeGenerator::emitThrowReferenceError(const String& message)
> {
>     emitOpcode(op_throw_static_error);
>@@ -2726,7 +2991,7 @@ void BytecodeGenerator::emitReadOnlyExce
>     instructions().append(false);
> }
>     
>-void BytecodeGenerator::emitEnumeration(ThrowableExpressionData* node, ExpressionNode* subjectNode, const std::function<void(BytecodeGenerator&, RegisterID*)>& callBack)
>+void BytecodeGenerator::emitEnumeration(ThrowableExpressionData* node, ExpressionNode* subjectNode, const std::function<void(BytecodeGenerator&, RegisterID*)>& callBack, LexicalNode* forLoopNode, RegisterID* forLoopSymbolTable)
> {
>     RefPtr<RegisterID> subject = newTemporary();
>     emitNode(subject.get(), subjectNode);
>@@ -2788,6 +3053,9 @@ void BytecodeGenerator::emitEnumeration(
>         }
> 
>         emitLabel(scope->continueTarget());
>+        if (forLoopNode)
>+            prepareLexicalScopeForNextForLoopIteration(forLoopNode, forLoopSymbolTable);
>+
>         {
>             emitIteratorNext(value.get(), iterator.get(), node);
>             emitJumpIfTrue(emitGetById(newTemporary(), value.get(), propertyNames().done), loopDone.get());
>@@ -2824,7 +3092,7 @@ RegisterID* BytecodeGenerator::emitGetTe
>         getTemplateObject = newTemporary();
>         RefPtr<RegisterID> scope = newTemporary();
>         moveToDestinationIfNeeded(scope.get(), emitResolveScope(scope.get(), var));
>-        emitGetFromScope(getTemplateObject.get(), scope.get(), var, ThrowIfNotFound);
>+        emitGetFromScope(getTemplateObject.get(), scope.get(), var, ThrowIfNotFound, DoesNotNeedTDZCheck);
>     }
> 
>     CallArguments arguments(*this, nullptr);
>Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 186105)
>+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
>@@ -91,6 +91,7 @@ namespace JSC {
>         unsigned forInContextStackSize;
>         unsigned tryContextStackSize;
>         unsigned labelScopesSize;
>+        unsigned symbolTableStackSize;
>         int finallyDepth;
>         int dynamicScopeDepth;
>     };
>@@ -251,6 +252,11 @@ namespace JSC {
>         ProfileTypeBytecodeFunctionReturnStatement
>     };
> 
>+    enum GetFromScopeTDZCheck {
>+        MayNeedTDZCheck,
>+        DoesNotNeedTDZCheck
>+    };
>+
>     class BytecodeGenerator {
>         WTF_MAKE_FAST_ALLOCATED;
>         WTF_MAKE_NONCOPYABLE(BytecodeGenerator);
>@@ -258,9 +264,9 @@ namespace JSC {
>         typedef DeclarationStacks::VarStack VarStack;
>         typedef DeclarationStacks::FunctionStack FunctionStack;
> 
>-        BytecodeGenerator(VM&, ProgramNode*, UnlinkedProgramCodeBlock*, DebuggerMode, ProfilerMode);
>-        BytecodeGenerator(VM&, FunctionNode*, UnlinkedFunctionCodeBlock*, DebuggerMode, ProfilerMode);
>-        BytecodeGenerator(VM&, EvalNode*, UnlinkedEvalCodeBlock*, DebuggerMode, ProfilerMode);
>+        BytecodeGenerator(VM&, ProgramNode*, UnlinkedProgramCodeBlock*, DebuggerMode, ProfilerMode, const VariableEnvironment*);
>+        BytecodeGenerator(VM&, FunctionNode*, UnlinkedFunctionCodeBlock*, DebuggerMode, ProfilerMode, const VariableEnvironment*);
>+        BytecodeGenerator(VM&, EvalNode*, UnlinkedEvalCodeBlock*, DebuggerMode, ProfilerMode, const VariableEnvironment*);
> 
>         ~BytecodeGenerator();
>         
>@@ -310,6 +316,13 @@ namespace JSC {
> 
>         RegisterID* ignoredResult() { return &m_ignoredResultRegister; }
> 
>+        // This will be allocated in the temporary region of registers, but it will
>+        // not be marked as a temporary. This will ensure that finalDestination() does
>+        // not overwrite a block scope variable that it mistakes as a temporary. These
>+        // registers can be (and are) reclaimed when the lexical scope they belong to
>+        // is no longer on the symbol table stack.
>+        RegisterID* newBlockScopeVariable();
>+
>         // Returns a place to write intermediate values of an operation
>         // which reuses dst if it is safe to do so.
>         RegisterID* tempDestination(RegisterID* dst)
>@@ -450,6 +463,8 @@ namespace JSC {
> 
>         RegisterID* emitCreateThis(RegisterID* dst);
>         void emitTDZCheck(RegisterID* target);
>+        bool needsTDZCheck(const Variable&);
>+        void emitTDZCheckIfNecessary(const Variable&, RegisterID* target, RegisterID* scope);
>         RegisterID* emitNewObject(RegisterID* dst);
>         RegisterID* emitNewArray(RegisterID* dst, ElementNode*, unsigned length); // stops at first elision
> 
>@@ -503,7 +518,7 @@ namespace JSC {
>         void emitCallDefineProperty(RegisterID* newObj, RegisterID* propertyNameRegister,
>             RegisterID* valueRegister, RegisterID* getterRegister, RegisterID* setterRegister, unsigned options, const JSTextPosition&);
> 
>-        void emitEnumeration(ThrowableExpressionData* enumerationNode, ExpressionNode* subjectNode, const std::function<void(BytecodeGenerator&, RegisterID*)>& callBack);
>+        void emitEnumeration(ThrowableExpressionData* enumerationNode, ExpressionNode* subjectNode, const std::function<void(BytecodeGenerator&, RegisterID*)>& callBack, LexicalNode* = nullptr, RegisterID* forLoopSymbolTable = nullptr);
> 
> #if ENABLE(ES6_TEMPLATE_LITERAL_SYNTAX)
>         RegisterID* emitGetTemplateObject(RegisterID* dst, TaggedTemplateNode*);
>@@ -519,7 +534,7 @@ namespace JSC {
>         ResolveType resolveType();
>         RegisterID* emitResolveConstantLocal(RegisterID* dst, const Variable&);
>         RegisterID* emitResolveScope(RegisterID* dst, const Variable&);
>-        RegisterID* emitGetFromScope(RegisterID* dst, RegisterID* scope, const Variable&, ResolveMode);
>+        RegisterID* emitGetFromScope(RegisterID* dst, RegisterID* scope, const Variable&, ResolveMode, GetFromScopeTDZCheck);
>         RegisterID* emitPutToScope(RegisterID* scope, const Variable&, RegisterID* value, ResolveMode);
>         RegisterID* initializeVariable(const Variable&, RegisterID* value);
> 
>@@ -605,7 +620,12 @@ namespace JSC {
> 
>         OpcodeID lastOpcodeID() const { return m_lastOpcodeID; }
> 
>+        void pushLexicalScope(LexicalNode*, RegisterID** constantSymbolTableResult = nullptr);
>+        void popLexicalScope(LexicalNode*);
>+        void prepareLexicalScopeForNextForLoopIteration(LexicalNode*, RegisterID* loopSymbolTable);
>+
>     private:
>+        void reclaimFreeRegisters();
>         Variable variableForLocalEntry(const Identifier&, const SymbolTableEntry&);
> 
>         void emitOpcode(OpcodeID);
>@@ -677,9 +697,13 @@ namespace JSC {
>         
>         UnlinkedFunctionExecutable* makeFunction(FunctionBodyNode* body)
>         {
>-            return UnlinkedFunctionExecutable::create(m_vm, m_scopeNode->source(), body, isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction);
>+            VariableEnvironment variablesUnderTDZ;
>+            getVariablesUnderTDZ(variablesUnderTDZ);
>+            return UnlinkedFunctionExecutable::create(m_vm, m_scopeNode->source(), body, isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction, variablesUnderTDZ);
>         }
> 
>+        void getVariablesUnderTDZ(VariableEnvironment&);
>+
>         RegisterID* emitConstructVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, RegisterID* profileHookRegister, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
>         RegisterID* emitCallVarargs(OpcodeID, RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, RegisterID* profileHookRegister, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
> 
>@@ -691,31 +715,6 @@ namespace JSC {
> 
>         SymbolTable& symbolTable() { return *m_symbolTable; }
> 
>-        bool shouldOptimizeLocals()
>-        {
>-            if (m_codeType != FunctionCode)
>-                return false;
>-
>-            if (m_localScopeDepth)
>-                return false;
>-
>-            return true;
>-        }
>-
>-        bool canOptimizeNonLocals()
>-        {
>-            if (m_localScopeDepth)
>-                return false;
>-
>-            if (m_codeType == EvalCode)
>-                return false;
>-
>-            if (m_codeType == FunctionCode && m_codeBlock->usesEval())
>-                return false;
>-
>-            return true;
>-        }
>-
>         RegisterID* emitThrowExpressionTooDeepException();
> 
>     private:
>@@ -725,6 +724,9 @@ namespace JSC {
>         bool m_shouldEmitProfileHooks;
> 
>         SymbolTable* m_symbolTable { nullptr };
>+        typedef std::pair<Strong<SymbolTable>, RegisterID*> SymbolTableStackEntry;
>+        Vector<SymbolTableStackEntry> m_symbolTableStack;
>+        Vector<const VariableEnvironment*> m_TDZStack;
> 
>         ScopeNode* const m_scopeNode;
>         Strong<UnlinkedCodeBlock> m_codeBlock;
>@@ -752,6 +754,8 @@ namespace JSC {
>         int m_localScopeDepth { 0 };
>         const CodeType m_codeType;
> 
>+        int calculateTargetScopeDepthForExceptionHandler() const;
>+
>         Vector<ControlFlowContext, 0, UnsafeVectorOverflow> m_scopeContextStack;
>         Vector<SwitchInfo> m_switchContextStack;
>         Vector<std::unique_ptr<ForInContext>> m_forInContextStack;
>Index: Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(revision 186105)
>+++ Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp	(working copy)
>@@ -196,6 +196,7 @@ RegisterID* ResolveNode::emitBytecode(By
> {
>     Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (dst == generator.ignoredResult())
>             return nullptr;
>         if (generator.vm()->typeProfiler()) {
>@@ -209,7 +210,7 @@ RegisterID* ResolveNode::emitBytecode(By
>     generator.emitExpressionInfo(divot, m_start, divot);
>     RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
>     RegisterID* finalDest = generator.finalDestination(dst);
>-    RegisterID* result = generator.emitGetFromScope(finalDest, scope.get(), var, ThrowIfNotFound);
>+    RegisterID* result = generator.emitGetFromScope(finalDest, scope.get(), var, ThrowIfNotFound, MayNeedTDZCheck);
>     if (generator.vm()->typeProfiler()) {
>         generator.emitProfileType(finalDest, var.isResolved() ? ProfileTypeBytecodeGetFromLocalScope : ProfileTypeBytecodeGetFromScope, &m_ident);
>         generator.emitTypeProfilerExpressionInfo(m_position, JSTextPosition(-1, m_position.offset + m_ident.length(), -1));
>@@ -288,7 +289,7 @@ RegisterID* TaggedTemplateNode::emitByte
>             JSTextPosition newDivot = divotStart() + identifier.length();
>             generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
>             generator.moveToDestinationIfNeeded(base.get(), generator.emitResolveScope(base.get(), var));
>-            generator.emitGetFromScope(tag.get(), base.get(), var, ThrowIfNotFound);
>+            generator.emitGetFromScope(tag.get(), base.get(), var, ThrowIfNotFound, DoesNotNeedTDZCheck);
>         }
>     } else if (m_tag->isBracketAccessorNode()) {
>         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(m_tag);
>@@ -701,7 +702,7 @@ RegisterID* EvalFunctionCallNode::emitBy
>     generator.moveToDestinationIfNeeded(
>         callArguments.thisRegister(),
>         generator.emitResolveScope(callArguments.thisRegister(), var));
>-    generator.emitGetFromScope(func.get(), callArguments.thisRegister(), var, ThrowIfNotFound);
>+    generator.emitGetFromScope(func.get(), callArguments.thisRegister(), var, ThrowIfNotFound, DoesNotNeedTDZCheck);
>     return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), callArguments, divot(), divotStart(), divotEnd());
> }
> 
>@@ -737,6 +738,7 @@ RegisterID* FunctionCallResolveNode::emi
> 
>     Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         RefPtr<RegisterID> func = generator.emitMove(generator.tempDestination(dst), local);
>         RefPtr<RegisterID> returnValue = generator.finalDestination(dst, func.get());
>         CallArguments callArguments(generator, m_args);
>@@ -760,7 +762,7 @@ RegisterID* FunctionCallResolveNode::emi
>     generator.moveToDestinationIfNeeded(
>         callArguments.thisRegister(),
>         generator.emitResolveScope(callArguments.thisRegister(), var));
>-    generator.emitGetFromScope(func.get(), callArguments.thisRegister(), var, ThrowIfNotFound);
>+    generator.emitGetFromScope(func.get(), callArguments.thisRegister(), var, ThrowIfNotFound, MayNeedTDZCheck);
>     RegisterID* ret = generator.emitCall(returnValue.get(), func.get(), expectedFunction, callArguments, divot(), divotStart(), divotEnd());
>     if (generator.vm()->typeProfiler()) {
>         generator.emitProfileType(returnValue.get(), ProfileTypeBytecodeDoesNotHaveGlobalID, nullptr);
>@@ -1058,6 +1060,7 @@ RegisterID* PostfixNode::emitResolve(Byt
> 
>     Variable var = generator.variable(ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         RefPtr<RegisterID> localReg = local;
>         if (var.isReadOnly()) {
>             generator.emitReadOnlyExceptionIfNeeded();
>@@ -1079,7 +1082,7 @@ RegisterID* PostfixNode::emitResolve(Byt
> 
>     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>     RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>-    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
>+    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound, MayNeedTDZCheck);
>     RefPtr<RegisterID> oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
>     generator.emitPutToScope(scope.get(), var, value.get(), ThrowIfNotFound);
>     if (generator.vm()->typeProfiler()) {
>@@ -1159,6 +1162,7 @@ RegisterID* PostfixNode::emitBytecode(By
> 
> RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
> {
>+    // FIXME: When supporting lexical variables outside strict mode, this should emit TDZ checks.
>     Variable var = generator.variable(m_ident);
>     if (var.local())
>         return generator.emitLoad(generator.finalDestination(dst), false);
>@@ -1221,13 +1225,14 @@ RegisterID* TypeOfResolveNode::emitBytec
> {
>     Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (dst == generator.ignoredResult())
>             return 0;
>         return generator.emitTypeOf(generator.finalDestination(dst), local);
>     }
> 
>     RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
>-    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
>+    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound, MayNeedTDZCheck);
>     if (dst == generator.ignoredResult())
>         return 0;
>     return generator.emitTypeOf(generator.finalDestination(dst, scope.get()), value.get());
>@@ -1255,6 +1260,7 @@ RegisterID* PrefixNode::emitResolve(Byte
> 
>     Variable var = generator.variable(ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         RefPtr<RegisterID> localReg = local;
>         if (var.isReadOnly()) {
>             generator.emitReadOnlyExceptionIfNeeded();
>@@ -1274,7 +1280,7 @@ RegisterID* PrefixNode::emitResolve(Byte
> 
>     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>     RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
>-    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
>+    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound, MayNeedTDZCheck);
>     emitIncOrDec(generator, value.get(), m_operator);
>     generator.emitPutToScope(scope.get(), var, value.get(), ThrowIfNotFound);
>     if (generator.vm()->typeProfiler()) {
>@@ -1772,6 +1778,7 @@ RegisterID* ReadModifyResolveNode::emitB
>     JSTextPosition newDivot = divotStart() + m_ident.length();
>     Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local()) {
>+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (var.isReadOnly()) {
>             generator.emitReadOnlyExceptionIfNeeded();
>             return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
>@@ -1796,7 +1803,7 @@ RegisterID* ReadModifyResolveNode::emitB
> 
>     generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
>     RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>-    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
>+    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound, MayNeedTDZCheck);
>     RefPtr<RegisterID> result = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
>     RegisterID* returnResult = generator.emitPutToScope(scope.get(), var, result.get(), ThrowIfNotFound);
>     if (generator.vm()->typeProfiler()) {
>@@ -1812,6 +1819,8 @@ RegisterID* AssignResolveNode::emitBytec
> {
>     Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local()) {
>+        if (m_assignmentContext == AssignmentExpressionContext)
>+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (var.isReadOnly()) {
>             generator.emitReadOnlyExceptionIfNeeded();
>             return generator.emitNode(dst, m_right);
>@@ -1833,6 +1842,8 @@ RegisterID* AssignResolveNode::emitBytec
>     if (generator.isStrictMode())
>         generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>     RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>+    if (m_assignmentContext == AssignmentExpressionContext)
>+        generator.emitTDZCheckIfNecessary(var, nullptr, scope.get());
>     if (dst == generator.ignoredResult())
>         dst = 0;
>     RefPtr<RegisterID> result = generator.emitNode(dst, m_right);
>@@ -2035,7 +2046,9 @@ void BlockNode::emitBytecode(BytecodeGen
> {
>     if (!m_statements)
>         return;
>+    generator.pushLexicalScope(this);
>     m_statements->emitBytecode(generator, dst);
>+    generator.popLexicalScope(this);
> }
> 
> // ------------------------------ EmptyStatementNode ---------------------------
>@@ -2074,21 +2087,37 @@ void VarStatementNode::emitBytecode(Byte
> 
> RegisterID* EmptyVarExpression::emitBytecode(BytecodeGenerator& generator, RegisterID*)
> {
>+    Variable var = generator.variable(m_ident);
>+    RefPtr<RegisterID> scope;
>+    RefPtr<RegisterID> value;
>+    // Lexical declarations like 'let' must move undefined into their variables so we don't
>+    // get TDZ errors for situations like this: `let x; x;`
>+    if (m_declarationType == LexicalDeclaration) {
>+        if (RegisterID* local = var.local())
>+            generator.emitLoad(local, jsUndefined());
>+        else {
>+            scope = generator.emitResolveScope(nullptr, var);
>+            value = generator.emitLoad(nullptr, jsUndefined());
>+            generator.emitPutToScope(scope.get(), var, value.get(), generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound);
>+        }
>+    }
>+
>+    // It's safe to return null here because this node will always be a child node of VarStatementNode which ignores our return value.
>     if (!generator.vm()->typeProfiler())
>         return nullptr;
> 
>-    Variable var = generator.variable(m_ident);
>     if (RegisterID* local = var.local())
>         generator.emitProfileType(local, ProfileTypeBytecodeHasGlobalID, nullptr);
>     else {
>-        RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
>-        RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
>+        if (m_declarationType != LexicalDeclaration) {
>+            scope = generator.emitResolveScope(nullptr, var);
>+            value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound, DoesNotNeedTDZCheck);
>+        }
>         generator.emitProfileType(value.get(), var.isResolved() ? ProfileTypeBytecodeGetFromLocalScope : ProfileTypeBytecodeGetFromScope, &m_ident);
>     }
> 
>     generator.emitTypeProfilerExpressionInfo(position(), JSTextPosition(-1, position().offset + m_ident.length(), -1));
> 
>-    // It's safe to return null here because this node will always be a child node of VarStatementNode which ignores our return value.
>     return nullptr;
> }
> 
>@@ -2218,6 +2247,13 @@ void ForNode::emitBytecode(BytecodeGener
> {
>     LabelScopePtr scope = generator.newLabelScope(LabelScope::Loop);
> 
>+    // FIXME: We can optimize TDZ checks here because once a for loop's
>+    // header has executed, it is guaranteed that inside the body of the
>+    // loop that the loop header's lexical variables will no longer
>+    // be under TDZ.
>+    RegisterID* forLoopSymbolTable;
>+    generator.pushLexicalScope(this, &forLoopSymbolTable);
>+
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
> 
>     if (m_expr1)
>@@ -2235,6 +2271,7 @@ void ForNode::emitBytecode(BytecodeGener
> 
>     generator.emitLabel(scope->continueTarget());
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
>+    generator.prepareLexicalScopeForNextForLoopIteration(this, forLoopSymbolTable);
>     if (m_expr3)
>         generator.emitNode(generator.ignoredResult(), m_expr3);
> 
>@@ -2244,6 +2281,7 @@ void ForNode::emitBytecode(BytecodeGener
>         generator.emitJump(topOfLoop.get());
> 
>     generator.emitLabel(scope->breakTarget());
>+    generator.popLexicalScope(this);
>     generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
> }
> 
>@@ -2351,6 +2389,9 @@ void ForInNode::emitMultiLoopBytecode(By
> 
>     RefPtr<Label> end = generator.newLabel();
> 
>+    RegisterID* forLoopSymbolTable;
>+    generator.pushLexicalScope(this, &forLoopSymbolTable);
>+
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
> 
>     RefPtr<RegisterID> base = generator.newTemporary();
>@@ -2384,6 +2425,7 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitJumpIfFalse(result.get(), scope->continueTarget());
> 
>         generator.emitToIndexString(propertyName.get(), i.get());
>+
>         this->emitLoopHeader(generator, propertyName.get());
> 
>         generator.emitProfileControlFlow(profilerStartOffset);
>@@ -2395,6 +2437,7 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitProfileControlFlow(profilerEndOffset);
> 
>         generator.emitLabel(scope->continueTarget());
>+        generator.prepareLexicalScopeForNextForLoopIteration(this, forLoopSymbolTable);
>         generator.emitInc(i.get());
>         generator.emitJump(loopStart.get());
> 
>@@ -2432,6 +2475,7 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitProfileControlFlow(profilerEndOffset);
> 
>         generator.emitLabel(scope->continueTarget());
>+        generator.prepareLexicalScopeForNextForLoopIteration(this, forLoopSymbolTable);
>         generator.emitInc(enumeratorIndex.get());
>         generator.emitEnumeratorStructurePropertyName(propertyName.get(), enumerator.get(), enumeratorIndex.get());
>         generator.emitJump(loopStart.get());
>@@ -2467,6 +2511,7 @@ void ForInNode::emitMultiLoopBytecode(By
>         generator.emitNode(dst, m_statement);
> 
>         generator.emitLabel(scope->continueTarget());
>+        generator.prepareLexicalScopeForNextForLoopIteration(this, forLoopSymbolTable);
>         generator.emitInc(enumeratorIndex.get());
>         generator.emitEnumeratorGenericPropertyName(propertyName.get(), enumerator.get(), enumeratorIndex.get());
>         generator.emitJump(loopStart.get());
>@@ -2478,6 +2523,7 @@ void ForInNode::emitMultiLoopBytecode(By
> 
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
>     generator.emitLabel(end.get());
>+    generator.popLexicalScope(this);
>     generator.emitProfileControlFlow(profilerEndOffset);
> }
> 
>@@ -2494,6 +2540,8 @@ void ForOfNode::emitBytecode(BytecodeGen
>         return;
>     }
> 
>+    RegisterID* forLoopSymbolTable;
>+    generator.pushLexicalScope(this, &forLoopSymbolTable);
>     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
>     auto extractor = [this, dst](BytecodeGenerator& generator, RegisterID* value)
>     {
>@@ -2543,7 +2591,8 @@ void ForOfNode::emitBytecode(BytecodeGen
>         generator.emitProfileControlFlow(m_statement->startOffset());
>         generator.emitNode(dst, m_statement);
>     };
>-    generator.emitEnumeration(this, m_expr, extractor);
>+    generator.emitEnumeration(this, m_expr, extractor, this, forLoopSymbolTable);
>+    generator.popLexicalScope(this);
>     generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
> }
> 
>@@ -2818,7 +2867,10 @@ void SwitchNode::emitBytecode(BytecodeGe
>     LabelScopePtr scope = generator.newLabelScope(LabelScope::Switch);
> 
>     RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
>+
>+    generator.pushLexicalScope(this);
>     m_block->emitBytecodeForBlock(generator, r0.get(), dst);
>+    generator.popLexicalScope(this);
> 
>     generator.emitLabel(scope->breakTarget());
>     generator.emitProfileControlFlow(endOffset());
>@@ -3320,6 +3372,8 @@ void BindingNode::bindValue(BytecodeGene
> {
>     Variable var = generator.variable(m_boundProperty);
>     if (RegisterID* local = var.local()) {
>+        if (m_bindingContext == DoesNeedTDZCheck)
>+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
>         if (var.isReadOnly()) {
>             generator.emitReadOnlyExceptionIfNeeded();
>             return;
>@@ -3333,6 +3387,8 @@ void BindingNode::bindValue(BytecodeGene
>         generator.emitExpressionInfo(divotEnd(), divotStart(), divotEnd());
>     RegisterID* scope = generator.emitResolveScope(nullptr, var);
>     generator.emitExpressionInfo(divotEnd(), divotStart(), divotEnd());
>+    if (m_bindingContext == DoesNeedTDZCheck)
>+        generator.emitTDZCheckIfNecessary(var, nullptr, scope);
>     generator.emitPutToScope(scope, var, value, generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound);
>     if (generator.vm()->typeProfiler()) {
>         generator.emitProfileType(value, var.isResolved() ? ProfileTypeBytecodePutToLocalScope : ProfileTypeBytecodePutToScope, &m_boundProperty);
>Index: Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
>===================================================================
>--- Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(revision 186105)
>+++ Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(working copy)
>@@ -192,7 +192,11 @@ JSValue DebuggerCallFrame::evaluate(cons
>     VM& vm = callFrame->vm();
>     auto& codeBlock = *callFrame->codeBlock();
>     ThisTDZMode thisTDZMode = codeBlock.unlinkedCodeBlock()->constructorKind() == ConstructorKind::Derived ? ThisTDZMode::AlwaysCheck : ThisTDZMode::CheckIfNeeded;
>-    EvalExecutable* eval = EvalExecutable::create(callFrame, makeSource(script), codeBlock.isStrictMode(), thisTDZMode);
>+
>+    VariableEnvironment variablesUnderTDZ;
>+    JSScope::collectVariablesUnderTDZ(scope()->jsScope(), variablesUnderTDZ);
>+
>+    EvalExecutable* eval = EvalExecutable::create(callFrame, makeSource(script), codeBlock.isStrictMode(), thisTDZMode, &variablesUnderTDZ);
>     if (vm.exception()) {
>         exception = vm.exception();
>         vm.clearException();
>Index: Source/JavaScriptCore/debugger/DebuggerScope.cpp
>===================================================================
>--- Source/JavaScriptCore/debugger/DebuggerScope.cpp	(revision 186105)
>+++ Source/JavaScriptCore/debugger/DebuggerScope.cpp	(working copy)
>@@ -26,10 +26,12 @@
> #include "config.h"
> #include "DebuggerScope.h"
> 
>+#include "Exception.h"
> #include "JSLexicalEnvironment.h"
> #include "JSCInlines.h"
> #include "JSNameScope.h"
> #include "JSWithScope.h"
>+#include "NativeErrorConstructor.h"
> 
> namespace JSC {
> 
>@@ -86,7 +88,18 @@ bool DebuggerScope::getOwnPropertySlot(J
>     // does not presently need to distinguish between what's owned at each level in the
>     // prototype chain. Hence, we'll invoke getPropertySlot() on the wrapped scope here
>     // instead of getOwnPropertySlot().
>-    return thisObject->getPropertySlot(exec, propertyName, slot);
>+    ASSERT(!exec->vm().exception());
>+    bool result = thisObject->getPropertySlot(exec, propertyName, slot);
>+    if (exec->vm().exception()) {
>+        // We hit a scope property that has the TDZ empty value. This caused a TDZ exception.
>+        ASSERT(exec->vm().exception()->value().asCell()->structure()->classInfo() == exec->lexicalGlobalObject()->typeErrorConstructor()->errorStructure()->classInfo());
>+        exec->vm().clearException();
>+        // Currently, returning false here causes the inspector to show this 
>+        // variable as being 'undefined'. This is not ideal and we should fix it.
>+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=144977
>+        return false;
>+    }
>+    return result;
> }
> 
> void DebuggerScope::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
>Index: Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(revision 186105)
>+++ Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp	(working copy)
>@@ -214,6 +214,7 @@ private:
>         Node* base, unsigned identifierNumber, Node* value, const PutByIdStatus&,
>         bool isDirect);
>     void emitChecks(const ConstantStructureCheckVector&);
>+    void handleTDZCheck(VirtualRegister);
> 
>     void prepareToParseBlock();
>     void clearCaches();
>@@ -2570,6 +2571,11 @@ void ByteCodeParser::handlePutById(
>     } }
> }
> 
>+void ByteCodeParser::handleTDZCheck(VirtualRegister operand)
>+{
>+    addToGraph(CheckNotEmpty, get(operand));
>+}
>+
> void ByteCodeParser::prepareToParseBlock()
> {
>     clearCaches();
>@@ -2903,8 +2909,7 @@ bool ByteCodeParser::parseBlock(unsigned
>         }
> 
>         case op_check_tdz: {
>-            Node* op = get(VirtualRegister(currentInstruction[1].u.operand));
>-            addToGraph(CheckNotEmpty, op);
>+            handleTDZCheck(VirtualRegister(currentInstruction[1].u.operand));
>             NEXT_OPCODE(op_check_tdz);
>         }
> 
>@@ -3482,7 +3487,8 @@ bool ByteCodeParser::parseBlock(unsigned
>             NEXT_OPCODE(op_resolve_scope);
>         }
> 
>-        case op_get_from_scope: {
>+        case op_get_from_scope:
>+        case op_get_from_scope_no_tdz: {
>             int dst = currentInstruction[1].u.operand;
>             int scope = currentInstruction[2].u.operand;
>             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
>@@ -3504,6 +3510,7 @@ bool ByteCodeParser::parseBlock(unsigned
>             UNUSED_PARAM(watchpoints); // We will use this in the future. For now we set it as a way of documenting the fact that that's what index 5 is in GlobalVar mode.
> 
>             JSGlobalObject* globalObject = m_inlineStackTop->m_codeBlock->globalObject();
>+            SetMode setMode = opcodeID == op_get_from_scope ? ImmediateSetWithFlush : NormalSet;
> 
>             switch (resolveType) {
>             case GlobalProperty:
>@@ -3513,12 +3520,12 @@ bool ByteCodeParser::parseBlock(unsigned
>                 if (status.state() != GetByIdStatus::Simple
>                     || status.numVariants() != 1
>                     || status[0].structureSet().size() != 1) {
>-                    set(VirtualRegister(dst), addToGraph(GetByIdFlush, OpInfo(identifierNumber), OpInfo(prediction), get(VirtualRegister(scope))));
>+                    set(VirtualRegister(dst), addToGraph(GetByIdFlush, OpInfo(identifierNumber), OpInfo(prediction), get(VirtualRegister(scope))), setMode);
>                     break;
>                 }
>                 Node* base = cellConstantWithStructureCheck(globalObject, status[0].structureSet().onlyStructure());
>                 addToGraph(Phantom, get(VirtualRegister(scope)));
>-                set(VirtualRegister(dst), handleGetByOffset(prediction, base, status[0].structureSet(), identifierNumber, operand));
>+                set(VirtualRegister(dst), handleGetByOffset(prediction, base, status[0].structureSet(), identifierNumber, operand), setMode);
>                 break;
>             }
>             case GlobalVar:
>@@ -3578,13 +3585,13 @@ bool ByteCodeParser::parseBlock(unsigned
>                     JSValue value = pointer->get();
>                     if (value) {
>                         m_graph.watchpoints().addLazily(watchpointSet);
>-                        set(VirtualRegister(dst), weakJSConstant(value));
>+                        set(VirtualRegister(dst), weakJSConstant(value), setMode);
>                         break;
>                     }
>                 }
>                 
>                 SpeculatedType prediction = getPrediction();
>-                set(VirtualRegister(dst), addToGraph(GetGlobalVar, OpInfo(operand), OpInfo(prediction)));
>+                set(VirtualRegister(dst), addToGraph(GetGlobalVar, OpInfo(operand), OpInfo(prediction)), setMode);
>                 break;
>             }
>             case LocalClosureVar:
>@@ -3606,19 +3613,24 @@ bool ByteCodeParser::parseBlock(unsigned
>                 // prediction, we'd otherwise think that it has to exit. Then when it did execute, we
>                 // would recompile. But if we can fold it here, we avoid the exit.
>                 if (JSValue value = m_graph.tryGetConstantClosureVar(scopeNode, ScopeOffset(operand))) {
>-                    set(VirtualRegister(dst), weakJSConstant(value));
>+                    set(VirtualRegister(dst), weakJSConstant(value), setMode);
>                     break;
>                 }
>                 SpeculatedType prediction = getPrediction();
>                 set(VirtualRegister(dst),
>-                    addToGraph(GetClosureVar, OpInfo(operand), OpInfo(prediction), scopeNode));
>+                    addToGraph(GetClosureVar, OpInfo(operand), OpInfo(prediction), scopeNode), setMode);
>                 break;
>             }
>             case Dynamic:
>                 RELEASE_ASSERT_NOT_REACHED();
>                 break;
>             }
>-            NEXT_OPCODE(op_get_from_scope);
>+
>+            if (opcodeID == op_get_from_scope) {
>+                handleTDZCheck(VirtualRegister(dst));
>+                NEXT_OPCODE(op_get_from_scope);
>+            } else
>+                NEXT_OPCODE(op_get_from_scope_no_tdz);
>         }
> 
>         case op_put_to_scope: {
>@@ -3729,12 +3741,33 @@ bool ByteCodeParser::parseBlock(unsigned
>             
>         case op_create_lexical_environment: {
>             FrozenValue* symbolTable = m_graph.freezeStrong(m_graph.symbolTableFor(currentNodeOrigin().semantic));
>-            Node* lexicalEnvironment = addToGraph(CreateActivation, OpInfo(symbolTable), get(VirtualRegister(currentInstruction[2].u.operand)));
>+            FrozenValue* initialValue = m_graph.freezeStrong(jsUndefined());
>+            Node* lexicalEnvironment = addToGraph(CreateActivation, OpInfo(symbolTable), OpInfo(initialValue), get(VirtualRegister(currentInstruction[2].u.operand)));
>             set(VirtualRegister(currentInstruction[1].u.operand), lexicalEnvironment);
>             set(VirtualRegister(currentInstruction[2].u.operand), lexicalEnvironment);
>             NEXT_OPCODE(op_create_lexical_environment);
>         }
>-            
>+
>+        case op_push_lexical_scope: {
>+            VirtualRegister symbolTableRegister(currentInstruction[3].u.operand);
>+            ASSERT(symbolTableRegister.isConstant());
>+            FrozenValue* symbolTable = m_graph.freezeStrong(m_inlineStackTop->m_codeBlock->getConstant(symbolTableRegister.offset()));
>+            FrozenValue* initialValue = m_graph.freezeStrong(jsTDZValue());
>+            Node* scope = get(VirtualRegister(currentInstruction[2].u.operand));
>+            Node* lexicalEnvironment = addToGraph(CreateActivation, OpInfo(symbolTable), OpInfo(initialValue), scope);
>+            set(VirtualRegister(currentInstruction[1].u.operand), lexicalEnvironment);
>+            addToGraph(Phantom, scope);
>+            NEXT_OPCODE(op_push_lexical_scope);
>+        }
>+
>+        case op_pop_lexical_scope: {
>+            Node* currentScope = get(VirtualRegister(currentInstruction[1].u.operand));
>+            Node* newScope = addToGraph(SkipScope, currentScope);
>+            set(VirtualRegister(currentInstruction[1].u.operand), newScope);
>+            addToGraph(Phantom, currentScope);
>+            NEXT_OPCODE(op_pop_lexical_scope);
>+        }
>+
>         case op_get_scope: {
>             // Help the later stages a bit by doing some small constant folding here. Note that this
>             // only helps for the first basic block. It's extremely important not to constant fold
>Index: Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(revision 186105)
>+++ Source/JavaScriptCore/dfg/DFGCapabilities.cpp	(working copy)
>@@ -195,6 +195,7 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_switch_char:
>     case op_in:
>     case op_get_scope:
>+    case op_get_from_scope_no_tdz:
>     case op_get_from_scope:
>     case op_get_enumerable_length:
>     case op_has_generic_property:
>@@ -208,6 +209,8 @@ CapabilityLevel capabilityLevel(OpcodeID
>     case op_new_func:
>     case op_new_func_exp:
>     case op_create_lexical_environment:
>+    case op_push_lexical_scope:
>+    case op_pop_lexical_scope:
>         return CanCompileAndInline;
> 
>     case op_put_to_scope: {
>Index: Source/JavaScriptCore/dfg/DFGNode.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGNode.h	(revision 186105)
>+++ Source/JavaScriptCore/dfg/DFGNode.h	(working copy)
>@@ -720,6 +720,12 @@ struct Node {
>         RELEASE_ASSERT(result);
>         return result;
>     }
>+
>+    JSValue initializationValueForActivation() const
>+    {
>+        ASSERT(op() == CreateActivation);
>+        return bitwise_cast<FrozenValue*>(m_opInfo2)->value();
>+    }
>      
>     bool containsMovHint()
>     {
>Index: Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp	(revision 186105)
>+++ Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp	(working copy)
>@@ -595,15 +595,15 @@ private:
> 
>                         {
>                             SymbolTable* symbolTable = node->castOperand<SymbolTable*>();
>-                            Node* undefined = m_insertionSet.insertConstant(
>-                                nodeIndex + 1, node->origin, jsUndefined());
>+                            Node* initialValue = m_insertionSet.insertConstant(
>+                                nodeIndex + 1, node->origin, node->initializationValueForActivation());
>                             ConcurrentJITLocker locker(symbolTable->m_lock);
>                             for (auto iter = symbolTable->begin(locker), end = symbolTable->end(locker); iter != end; ++iter) {
>                                 m_insertionSet.insert(
>                                     nodeIndex + 1,
>                                     PromotedHeapLocation(
>                                         ClosureVarPLoc, node, iter->value.scopeOffset().offset()).createHint(
>-                                        m_graph, node->origin, undefined));
>+                                        m_graph, node->origin, initialValue));
>                             }
>                         }
> 
>Index: Source/JavaScriptCore/dfg/DFGOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.cpp	(revision 186105)
>+++ Source/JavaScriptCore/dfg/DFGOperations.cpp	(working copy)
>@@ -766,7 +766,14 @@ JSCell* JIT_OPERATION operationCreateAct
> {
>     VM& vm = exec->vm();
>     NativeCallFrameTracer tracer(&vm, exec);
>-    return JSLexicalEnvironment::create(vm, structure, scope, table);
>+    return JSLexicalEnvironment::create(vm, structure, scope, table, jsUndefined());
>+}
>+
>+JSCell* JIT_OPERATION operationCreateActivationDirectTDZ(ExecState* exec, Structure* structure, JSScope* scope, SymbolTable* table)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+    return JSLexicalEnvironment::create(vm, structure, scope, table, jsTDZValue());
> }
> 
> JSCell* JIT_OPERATION operationCreateDirectArguments(ExecState* exec, Structure* structure, int32_t length, int32_t minCapacity)
>Index: Source/JavaScriptCore/dfg/DFGOperations.h
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGOperations.h	(revision 186105)
>+++ Source/JavaScriptCore/dfg/DFGOperations.h	(working copy)
>@@ -97,6 +97,7 @@ size_t JIT_OPERATION operationRegExpTest
> size_t JIT_OPERATION operationCompareStrictEqCell(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
> size_t JIT_OPERATION operationCompareStrictEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
> JSCell* JIT_OPERATION operationCreateActivationDirect(ExecState*, Structure*, JSScope*, SymbolTable*);
>+JSCell* JIT_OPERATION operationCreateActivationDirectTDZ(ExecState*, Structure*, JSScope*, SymbolTable*);
> JSCell* JIT_OPERATION operationCreateDirectArguments(ExecState*, Structure*, int32_t length, int32_t minCapacity);
> JSCell* JIT_OPERATION operationCreateDirectArgumentsDuringExit(ExecState*, InlineCallFrame*, JSFunction*, int32_t argumentCount);
> JSCell* JIT_OPERATION operationCreateScopedArguments(ExecState*, Structure*, Register* argumentStart, int32_t length, JSFunction* callee, JSLexicalEnvironment*);
>Index: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(revision 186105)
>+++ Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp	(working copy)
>@@ -4641,6 +4641,9 @@ void SpeculativeJIT::compileCreateActiva
>         
>     SpeculateCellOperand scope(this, node->child1());
>     GPRReg scopeGPR = scope.gpr();
>+    JSValue initializationValue = node->initializationValueForActivation();
>+    ASSERT(initializationValue.isUndefined() || initializationValue == jsTDZValue());
>+    auto operation = initializationValue.isUndefined() ? operationCreateActivationDirect : operationCreateActivationDirectTDZ; 
>     
>     if (table->singletonScope()->isStillValid()) {
>         GPRFlushedCallResult result(this);
>@@ -4648,7 +4651,7 @@ void SpeculativeJIT::compileCreateActiva
>         
>         flushRegisters();
>         
>-        callOperation(operationCreateActivationDirect, resultGPR, structure, scopeGPR, table);
>+        callOperation(operation, resultGPR, structure, scopeGPR, table);
>         cellResult(resultGPR, node);
>         return;
>     }
>@@ -4672,17 +4675,17 @@ void SpeculativeJIT::compileCreateActiva
>         TrustedImmPtr(table),
>         JITCompiler::Address(resultGPR, JSLexicalEnvironment::offsetOfSymbolTable()));
>         
>-    // Must initialize all members to undefined.
>+    // Must initialize all members to undefined or the TDZ empty value.
>     for (unsigned i = 0; i < table->scopeSize(); ++i) {
>         m_jit.storeTrustedValue(
>-            jsUndefined(),
>+            initializationValue,
>             JITCompiler::Address(
>                 resultGPR, JSLexicalEnvironment::offsetOfVariable(ScopeOffset(i))));
>     }
> 
>     addSlowPathGenerator(
>         slowPathCall(
>-            slowPath, this, operationCreateActivationDirect, resultGPR, structure, scopeGPR, table));
>+            slowPath, this, operation, resultGPR, structure, scopeGPR, table));
> 
>     cellResult(resultGPR, node);
> }
>Index: Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp	(revision 186105)
>+++ Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp	(working copy)
>@@ -3055,10 +3055,12 @@ private:
>         LValue scope = lowCell(m_node->child1());
>         SymbolTable* table = m_node->castOperand<SymbolTable*>();
>         Structure* structure = m_graph.globalObjectFor(m_node->origin.semantic)->activationStructure();
>-        
>+        JSValue initializationValue = m_node->initializationValueForActivation();
>+        ASSERT(initializationValue.isUndefined() || initializationValue == jsTDZValue());
>+        auto operation = initializationValue.isUndefined() ? operationCreateActivationDirect : operationCreateActivationDirectTDZ; 
>         if (table->singletonScope()->isStillValid()) {
>             LValue callResult = vmCall(
>-                m_out.operation(operationCreateActivationDirect), m_callFrame, weakPointer(structure),
>+                m_out.operation(operation), m_callFrame, weakPointer(structure),
>                 scope, weakPointer(table));
>             setJSValue(callResult);
>             return;
>@@ -3079,7 +3081,7 @@ private:
>         
>         for (unsigned i = 0; i < table->scopeSize(); ++i) {
>             m_out.store64(
>-                m_out.constInt64(JSValue::encode(jsUndefined())),
>+                m_out.constInt64(JSValue::encode(initializationValue)),
>                 fastObject, m_heaps.JSEnvironmentRecord_variables[i]);
>         }
>         
>@@ -3088,7 +3090,7 @@ private:
>         
>         m_out.appendTo(slowPath, continuation);
>         LValue callResult = vmCall(
>-            m_out.operation(operationCreateActivationDirect), m_callFrame, weakPointer(structure),
>+            m_out.operation(operation), m_callFrame, weakPointer(structure),
>             scope, weakPointer(table));
>         ValueFromBlock slowResult = m_out.anchor(callResult);
>         m_out.jump(continuation);
>@@ -5412,6 +5414,10 @@ private:
>         m_out.jump(continuation);
> 
>         m_out.appendTo(slowPath, continuation);
>+        // We could also validly call operationCreateActivationDirectTDZ here because we ensure allocation
>+        // sinking explictly sets bottom values for all field members. 
>+        // FIXME: It may be worth creating an operation that calls a constructor on JSLexicalEnvironment that 
>+        // doesn't initialize every slot because we are guaranteed to do that here.
>         LValue callResult = vmCall(
>             m_out.operation(operationCreateActivationDirect), m_callFrame, weakPointer(structure),
>             scope, weakPointer(table));
>Index: Source/JavaScriptCore/ftl/FTLOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/ftl/FTLOperations.cpp	(revision 186105)
>+++ Source/JavaScriptCore/ftl/FTLOperations.cpp	(working copy)
>@@ -130,7 +130,10 @@ extern "C" JSCell* JIT_OPERATION operati
>             materialization->origin(), exec->codeBlock());
>         Structure* structure = codeBlock->globalObject()->activationStructure();
> 
>-        JSLexicalEnvironment* result = JSLexicalEnvironment::create(vm, structure, scope, table);
>+        // It doesn't matter what values we initialize as bottom values inside the activation constructor because
>+        // activation sinking will set bottom values for each slot.
>+        // FIXME: Slight optimization would be to create a constructor that doesn't initialize all slots.
>+        JSLexicalEnvironment* result = JSLexicalEnvironment::create(vm, structure, scope, table, jsUndefined());
> 
>         RELEASE_ASSERT(materialization->properties().size() - 2 == table->scopeSize());
>         // Figure out what to populate the activation with
>Index: Source/JavaScriptCore/jit/JIT.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.cpp	(revision 186105)
>+++ Source/JavaScriptCore/jit/JIT.cpp	(working copy)
>@@ -273,6 +273,8 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_profile_control_flow)
>         DEFINE_OP(op_push_name_scope)
>         DEFINE_OP(op_push_with_scope)
>+        DEFINE_OP(op_push_lexical_scope)
>+        DEFINE_OP(op_pop_lexical_scope)
>         case op_put_by_id_out_of_line:
>         case op_put_by_id_transition_direct:
>         case op_put_by_id_transition_normal:
>@@ -306,6 +308,7 @@ void JIT::privateCompileMainPass()
>         DEFINE_OP(op_to_primitive)
> 
>         DEFINE_OP(op_resolve_scope)
>+        DEFINE_OP(op_get_from_scope_no_tdz)
>         DEFINE_OP(op_get_from_scope)
>         DEFINE_OP(op_put_to_scope)
>         DEFINE_OP(op_get_from_arguments)
>@@ -439,6 +442,7 @@ void JIT::privateCompileSlowCases()
>         DEFINE_SLOWCASE_OP(op_get_direct_pname)
> 
>         DEFINE_SLOWCASE_OP(op_resolve_scope)
>+        DEFINE_SLOWCASE_OP(op_get_from_scope_no_tdz)
>         DEFINE_SLOWCASE_OP(op_get_from_scope)
>         DEFINE_SLOWCASE_OP(op_put_to_scope)
> 
>Index: Source/JavaScriptCore/jit/JIT.h
>===================================================================
>--- Source/JavaScriptCore/jit/JIT.h	(revision 186105)
>+++ Source/JavaScriptCore/jit/JIT.h	(working copy)
>@@ -534,6 +534,8 @@ namespace JSC {
>         void emit_op_profile_control_flow(Instruction*);
>         void emit_op_push_name_scope(Instruction*);
>         void emit_op_push_with_scope(Instruction*);
>+        void emit_op_push_lexical_scope(Instruction*);
>+        void emit_op_pop_lexical_scope(Instruction*);
>         void emit_op_put_by_id(Instruction*);
>         void emit_op_put_by_index(Instruction*);
>         void emit_op_put_by_val(Instruction*);
>@@ -625,11 +627,14 @@ namespace JSC {
>         void emitSlow_op_get_direct_pname(Instruction*, Vector<SlowCaseEntry>::iterator&);
> 
>         void emit_op_resolve_scope(Instruction*);
>+        void emit_op_get_from_scope_no_tdz(Instruction*);
>         void emit_op_get_from_scope(Instruction*);
>         void emit_op_put_to_scope(Instruction*);
>         void emit_op_get_from_arguments(Instruction*);
>         void emit_op_put_to_arguments(Instruction*);
>         void emitSlow_op_resolve_scope(Instruction*, Vector<SlowCaseEntry>::iterator&);
>+        void emitSlowGetFromScopeCommon(Instruction*, Vector<SlowCaseEntry>::iterator&);
>+        void emitSlow_op_get_from_scope_no_tdz(Instruction*, Vector<SlowCaseEntry>::iterator&);
>         void emitSlow_op_get_from_scope(Instruction*, Vector<SlowCaseEntry>::iterator&);
>         void emitSlow_op_put_to_scope(Instruction*, Vector<SlowCaseEntry>::iterator&);
> 
>@@ -639,6 +644,7 @@ namespace JSC {
>         void emitVarInjectionCheck(bool needsVarInjectionChecks);
>         void emitResolveClosure(int dst, int scope, bool needsVarInjectionChecks, unsigned depth);
>         void emitLoadWithStructureCheck(int scope, Structure** structureSlot);
>+        void emitGetFromScope(Instruction*);
>         void emitGetGlobalProperty(uintptr_t* operandSlot);
>         void emitGetGlobalVar(uintptr_t operand);
>         void emitGetClosureVar(int scope, uintptr_t operand);
>@@ -651,6 +657,8 @@ namespace JSC {
> 
>         void emitPutIntToCallFrameHeader(RegisterID from, JSStack::CallFrameHeaderEntry);
> 
>+        void emitTDZCheck(int operand);
>+
>         JSValue getConstantOperand(int src);
>         bool isOperandConstantImmediateInt(int src);
>         bool isOperandConstantImmediateChar(int src);
>@@ -716,6 +724,7 @@ namespace JSC {
>         MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EPc, int, Instruction*);
>         MacroAssembler::Call callOperation(J_JITOperation_EZ, int, int32_t);
>         MacroAssembler::Call callOperation(J_JITOperation_EZZ, int, int32_t, int32_t);
>+        MacroAssembler::Call callOperation(J_JITOperation_ESymtabZ, int, SymbolTable*, int32_t);
>         MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, size_t);
>         MacroAssembler::Call callOperation(S_JITOperation_ECC, RegisterID, RegisterID);
>         MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID);
>Index: Source/JavaScriptCore/jit/JITInlines.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITInlines.h	(revision 186105)
>+++ Source/JavaScriptCore/jit/JITInlines.h	(working copy)
>@@ -295,6 +295,12 @@ ALWAYS_INLINE MacroAssembler::Call JIT::
>     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
> }
> 
>+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESymtabZ operation, int dst, SymbolTable* symbolTable, int32_t arg2)
>+{
>+    setupArgumentsWithExecState(TrustedImmPtr(symbolTable), TrustedImm32(arg2));
>+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
>+}
>+
> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_ECC operation, RegisterID regOp1, RegisterID regOp2)
> {
>     setupArgumentsWithExecState(regOp1, regOp2);
>Index: Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(revision 186105)
>+++ Source/JavaScriptCore/jit/JITOpcodes32_64.cpp	(working copy)
>@@ -845,6 +845,21 @@ void JIT::emit_op_catch(Instruction* cur
>     emitStore(thrownValue, regT1, regT0);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand;
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+}
>+
>+void JIT::emit_op_pop_lexical_scope(Instruction* currentInstruction)
>+{
>+    int scopeSrcAndDst = currentInstruction[1].u.operand;
>+    emitLoadPayload(scopeSrcAndDst, regT0);
>+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
>+    emitStoreCell(scopeSrcAndDst, regT0);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>@@ -1002,12 +1017,17 @@ void JIT::emitSlow_op_to_this(Instructio
>     slowPathCall.call();
> }
> 
>-void JIT::emit_op_check_tdz(Instruction* currentInstruction)
>+void JIT::emitTDZCheck(int operand)
> {
>-    emitLoadTag(currentInstruction[1].u.operand, regT0);
>+    emitLoadTag(operand, regT0);
>     addSlowCase(branch32(Equal, regT0, TrustedImm32(JSValue::EmptyValueTag)));
> }
> 
>+void JIT::emit_op_check_tdz(Instruction* currentInstruction)
>+{
>+    emitTDZCheck(currentInstruction[1].u.operand);
>+}
>+
> void JIT::emitSlow_op_check_tdz(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
> {
>     linkSlowCase(iter);
>Index: Source/JavaScriptCore/jit/JITOpcodes.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOpcodes.cpp	(revision 186105)
>+++ Source/JavaScriptCore/jit/JITOpcodes.cpp	(working copy)
>@@ -535,6 +535,22 @@ void JIT::emit_op_catch(Instruction* cur
>     emitPutVirtualRegister(currentInstruction[2].u.operand);
> }
> 
>+void JIT::emit_op_push_lexical_scope(Instruction* currentInstruction)
>+{
>+    int dst = currentInstruction[1].u.operand;
>+    int scope = currentInstruction[2].u.operand; 
>+    callOperation(operationPushLexicalScope, dst, jsCast<SymbolTable*>(getConstantOperand(currentInstruction[3].u.operand)), scope);
>+    return;
>+}
>+
>+void JIT::emit_op_pop_lexical_scope(Instruction* currentInstruction)
>+{
>+    int scopeSrcAndDst = currentInstruction[1].u.operand;
>+    emitGetVirtualRegister(scopeSrcAndDst, regT0);
>+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
>+    emitStoreCell(scopeSrcAndDst, regT0);
>+}
>+
> void JIT::emit_op_switch_imm(Instruction* currentInstruction)
> {
>     size_t tableIndex = currentInstruction[1].u.operand;
>@@ -745,12 +761,17 @@ void JIT::emitSlow_op_create_this(Instru
>     slowPathCall.call();
> }
> 
>-void JIT::emit_op_check_tdz(Instruction* currentInstruction)
>+void JIT::emitTDZCheck(int operand)
> {
>-    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
>+    emitGetVirtualRegister(operand, regT0);
>     addSlowCase(branchTest64(Zero, regT0));
> }
> 
>+void JIT::emit_op_check_tdz(Instruction* currentInstruction)
>+{
>+    emitTDZCheck(currentInstruction[1].u.operand);
>+}
>+
> void JIT::emitSlow_op_check_tdz(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
> {
>     linkSlowCase(iter);
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 186105)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -1443,6 +1443,17 @@ void JIT_OPERATION operationPushWithScop
>     exec->uncheckedR(dst) = JSWithScope::create(exec, o, currentScope);
> }
> 
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState* exec, SymbolTable* symbolTable, int32_t scopeReg)
>+{
>+    VM& vm = exec->vm();
>+    NativeCallFrameTracer tracer(&vm, exec);
>+
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable, jsTDZValue());
>+
>+    return JSValue::encode(newScope);
>+}
>+
> void JIT_OPERATION operationPopScope(ExecState* exec, int32_t scopeReg)
> {
>     VM& vm = exec->vm();
>@@ -1495,7 +1506,7 @@ JSCell* JIT_OPERATION operationCreateAct
> {
>     VM& vm = exec->vm();
>     NativeCallFrameTracer tracer(&vm, exec);
>-    JSLexicalEnvironment* lexicalEnvironment = JSLexicalEnvironment::create(vm, exec, currentScope, exec->codeBlock());
>+    JSLexicalEnvironment* lexicalEnvironment = JSLexicalEnvironment::create(vm, exec, currentScope, exec->codeBlock(), jsUndefined());
>     return lexicalEnvironment;
> }
> 
>@@ -1856,6 +1867,8 @@ EncodedJSValue JIT_OPERATION operationGe
> 
>     PropertySlot slot(scope);
>     if (!scope->getPropertySlot(exec, ident, slot)) {
>+        if (exec->vm().exception())
>+            return JSValue::encode(jsUndefined()); // JSLexicalEnvironment threw a TDZ error. We should give that higher priority than ThrowIfNotFound.
>         if (modeAndType.mode() == ThrowIfNotFound)
>             vm.throwException(exec, createUndefinedVariableError(exec, ident));
>         return JSValue::encode(jsUndefined());
>Index: Source/JavaScriptCore/jit/JITOperations.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.h	(revision 186105)
>+++ Source/JavaScriptCore/jit/JITOperations.h	(working copy)
>@@ -126,6 +126,7 @@ typedef EncodedJSValue JIT_OPERATION (*J
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZ)(ExecState*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZIcfZ)(ExecState*, int32_t, InlineCallFrame*, int32_t);
> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EZZ)(ExecState*, int32_t, int32_t);
>+typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_ESymtabZ)(ExecState*, SymbolTable*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_E)(ExecState*);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EZ)(ExecState*, int32_t);
> typedef JSCell* JIT_OPERATION (*C_JITOperation_EC)(ExecState*, JSCell*);
>@@ -313,6 +314,7 @@ void JIT_OPERATION operationPutGetterSet
> void JIT_OPERATION operationPushCatchScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushFunctionNameScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationPushWithScope(ExecState*, int32_t, EncodedJSValue) WTF_INTERNAL;
>+EncodedJSValue JIT_OPERATION operationPushLexicalScope(ExecState*, SymbolTable*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationPopScope(ExecState*, int32_t) WTF_INTERNAL;
> void JIT_OPERATION operationProfileDidCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
> void JIT_OPERATION operationProfileWillCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
>Index: Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp	(revision 186105)
>+++ Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp	(working copy)
>@@ -41,6 +41,7 @@
> #include "RepatchBuffer.h"
> #include "ResultType.h"
> #include "SamplingTool.h"
>+#include "SlowPathCall.h"
> #include <wtf/StringPrintStream.h>
> 
> 
>@@ -710,7 +711,7 @@ void JIT::emitGetClosureVar(int scope, u
>     load32(Address(regT0, JSEnvironmentRecord::offsetOfVariables() + operand * sizeof(Register) + PayloadOffset), regT0);
> }
> 
>-void JIT::emit_op_get_from_scope(Instruction* currentInstruction)
>+void JIT::emitGetFromScope(Instruction* currentInstruction)
> {
>     int dst = currentInstruction[1].u.operand;
>     int scope = currentInstruction[2].u.operand;
>@@ -744,18 +745,48 @@ void JIT::emit_op_get_from_scope(Instruc
>     emitStore(dst, regT1, regT0);
> }
> 
>-void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
>+void JIT::emit_op_get_from_scope_no_tdz(Instruction* currentInstruction)
>+{
>+    emitGetFromScope(currentInstruction);
>+}
>+
>+void JIT::emit_op_get_from_scope(Instruction* currentInstruction)
>+{
>+    emitGetFromScope(currentInstruction);
>+    emitTDZCheck(currentInstruction[1].u.operand);
>+}
>+
>+void JIT::emitSlowGetFromScopeCommon(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
> {
>     int dst = currentInstruction[1].u.operand;
>     ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
>+    OpcodeID opcode = m_interpreter->getOpcodeID(currentInstruction[0].u.opcode);
> 
>-    if (resolveType == GlobalVar || resolveType == ClosureVar)
>+    if (resolveType == GlobalVar || resolveType == ClosureVar) {
>+        if (opcode == op_get_from_scope) {
>+            linkSlowCase(iter); // TDZ check failure.
>+            JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_throw_tdz_error);
>+            slowPathCall.call();
>+        }
>         return;
>+    }
> 
>     linkSlowCase(iter);
>+    if (opcode == op_get_from_scope)
>+        linkSlowCase(iter); // TDZ check failure.
>     callOperation(WithProfile, operationGetFromScope, dst, currentInstruction);
> }
> 
>+void JIT::emitSlow_op_get_from_scope_no_tdz(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
>+{
>+    emitSlowGetFromScopeCommon(currentInstruction, iter);
>+}
>+
>+void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
>+{
>+    emitSlowGetFromScopeCommon(currentInstruction, iter);
>+}
>+
> void JIT::emitPutGlobalProperty(uintptr_t* operandSlot, int value)
> {
>     emitLoad(value, regT3, regT2);
>Index: Source/JavaScriptCore/jit/JITPropertyAccess.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITPropertyAccess.cpp	(revision 186105)
>+++ Source/JavaScriptCore/jit/JITPropertyAccess.cpp	(working copy)
>@@ -43,6 +43,7 @@
> #include "SamplingTool.h"
> #include "ScopedArguments.h"
> #include "ScopedArgumentsTable.h"
>+#include "SlowPathCall.h"
> #include <wtf/StringPrintStream.h>
> 
> 
>@@ -678,7 +679,7 @@ void JIT::emitGetClosureVar(int scope, u
>     loadPtr(Address(regT0, JSEnvironmentRecord::offsetOfVariables() + operand * sizeof(Register)), regT0);
> }
> 
>-void JIT::emit_op_get_from_scope(Instruction* currentInstruction)
>+void JIT::emitGetFromScope(Instruction* currentInstruction)
> {
>     int dst = currentInstruction[1].u.operand;
>     int scope = currentInstruction[2].u.operand;
>@@ -712,20 +713,50 @@ void JIT::emit_op_get_from_scope(Instruc
>     emitValueProfilingSite();
> }
> 
>-void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
>+void JIT::emit_op_get_from_scope_no_tdz(Instruction* currentInstruction)
>+{
>+    emitGetFromScope(currentInstruction);
>+}
>+
>+void JIT::emit_op_get_from_scope(Instruction* currentInstruction)
>+{
>+    emitGetFromScope(currentInstruction);
>+    emitTDZCheck(currentInstruction[1].u.operand);
>+}
>+
>+void JIT::emitSlowGetFromScopeCommon(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
> {
>     int dst = currentInstruction[1].u.operand;
>     ResolveType resolveType = ResolveModeAndType(currentInstruction[4].u.operand).type();
>+    OpcodeID opcode = m_interpreter->getOpcodeID(currentInstruction[0].u.opcode);
> 
>-    if (resolveType == GlobalVar || resolveType == ClosureVar)
>+    if (resolveType == GlobalVar || resolveType == ClosureVar) {
>+        if (opcode == op_get_from_scope) {
>+            linkSlowCase(iter);
>+            JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_throw_tdz_error);
>+            slowPathCall.call();
>+        }
>         return;
>+    }
> 
>     if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
>         linkSlowCase(iter);
>     linkSlowCase(iter);
>+    if (opcode == op_get_from_scope)
>+        linkSlowCase(iter); // TDZ check.
>     callOperation(WithProfile, operationGetFromScope, dst, currentInstruction);
> }
> 
>+void JIT::emitSlow_op_get_from_scope_no_tdz(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
>+{
>+    emitSlowGetFromScopeCommon(currentInstruction, iter);
>+}
>+
>+void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
>+{
>+    emitSlowGetFromScopeCommon(currentInstruction, iter);
>+}
>+
> void JIT::emitPutGlobalProperty(uintptr_t* operandSlot, int value)
> {
>     emitGetVirtualRegister(value, regT2);
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 186105)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -32,6 +32,7 @@
> #include "CommonSlowPathsExceptions.h"
> #include "Error.h"
> #include "ErrorHandlingScope.h"
>+#include "Exception.h"
> #include "ExceptionFuzz.h"
> #include "GetterSetter.h"
> #include "HostCallReturnValue.h"
>@@ -505,7 +506,7 @@ LLINT_SLOW_PATH_DECL(slow_path_create_le
> #endif
>     int scopeReg = pc[2].u.operand;
>     JSScope* scope = exec->uncheckedR(scopeReg).Register::scope();
>-    JSLexicalEnvironment* lexicalEnvironment = JSLexicalEnvironment::create(vm, exec, scope, exec->codeBlock());
>+    JSLexicalEnvironment* lexicalEnvironment = JSLexicalEnvironment::create(vm, exec, scope, exec->codeBlock(), jsUndefined());
>     LLINT_RETURN(JSValue(lexicalEnvironment));
> }
> 
>@@ -1320,6 +1321,25 @@ LLINT_SLOW_PATH_DECL(slow_path_push_name
>     LLINT_END();
> }
> 
>+LLINT_SLOW_PATH_DECL(slow_path_push_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[2].u.operand;
>+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
>+    SymbolTable* symbolTable = jsCast<SymbolTable*>(LLINT_OP_C(3).jsValue());
>+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable, jsTDZValue());
>+    LLINT_RETURN(newScope);
>+}
>+
>+LLINT_SLOW_PATH_DECL(slow_path_pop_lexical_scope)
>+{
>+    LLINT_BEGIN();
>+    int scopeReg = pc[1].u.operand;
>+    JSScope* scope = exec->uncheckedR(scopeReg).Register::scope();
>+    exec->uncheckedR(scopeReg) = scope->next();
>+    LLINT_END();
>+}
>+
> LLINT_SLOW_PATH_DECL(slow_path_throw)
> {
>     LLINT_BEGIN();
>@@ -1397,6 +1417,8 @@ LLINT_SLOW_PATH_DECL(slow_path_get_from_
> 
>     PropertySlot slot(scope);
>     if (!scope->getPropertySlot(exec, ident, slot)) {
>+        if (exec->vm().exception())
>+            LLINT_THROW(asObject(exec->vm().exception()->value())); // JSLexicalEnvironment threw a TDZ error. That has higher priority than ThrowIfNotFound.
>         if (modeAndType.mode() == ThrowIfNotFound)
>             LLINT_RETURN(exec->vm().throwException(exec, createUndefinedVariableError(exec, ident)));
>         LLINT_RETURN(jsUndefined());
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.h
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.h	(revision 186105)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.h	(working copy)
>@@ -110,6 +110,8 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_name_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_lexical_scope);
>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_lexical_scope);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_handle_watchdog_timer);
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(revision 186105)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(working copy)
>@@ -791,14 +791,19 @@ _llint_op_new_object:
>     dispatch(4)
> 
> 
>-_llint_op_check_tdz:
>+macro checkTDZ(operandOffsetFromInstructionToCheck, finish)
>     traceExecution()
>-    loadpFromInstruction(1, t0)
>-    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opNotTDZ
>+    loadisFromInstruction(operandOffsetFromInstructionToCheck, t0)
>+    loadConstantOrVariableTag(t0, t1)
>+    bineq t1, EmptyValueTag, .opNotTDZ
>     callSlowPath(_slow_path_throw_tdz_error)
> 
> .opNotTDZ:
>-    dispatch(2)
>+    finish()
>+end
>+
>+_llint_op_check_tdz:
>+    checkTDZ(1, macro() dispatch(2) end)
> 
> 
> _llint_op_mov:
>@@ -2166,7 +2171,7 @@ macro getClosureVar()
>     storei t2, PayloadOffset[cfr, t0, 8]
> end
> 
>-_llint_op_get_from_scope:
>+macro getFromScope(tdzCheckIfNecessary)
>     traceExecution()
>     loadisFromInstruction(4, t0)
>     andi ResolveModeMask, t0
>@@ -2175,29 +2180,34 @@ _llint_op_get_from_scope:
>     bineq t0, GlobalProperty, .gGlobalVar
>     loadWithStructureCheck(2, .gDynamic)
>     getProperty()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gGlobalVar:
>     bineq t0, GlobalVar, .gClosureVar
>     getGlobalVar()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gClosureVar:
>     bineq t0, ClosureVar, .gGlobalPropertyWithVarInjectionChecks
>     loadVariable(2, t2, t1, t0)
>     getClosureVar()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gGlobalPropertyWithVarInjectionChecks:
>     bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
>     loadWithStructureCheck(2, .gDynamic)
>     getProperty()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gGlobalVarWithVarInjectionChecks:
>     bineq t0, GlobalVarWithVarInjectionChecks, .gClosureVarWithVarInjectionChecks
>     varInjectionCheck(.gDynamic)
>     getGlobalVar()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gClosureVarWithVarInjectionChecks:
>@@ -2205,11 +2215,13 @@ _llint_op_get_from_scope:
>     varInjectionCheck(.gDynamic)
>     loadVariable(2, t2, t1, t0)
>     getClosureVar()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gDynamic:
>-    callSlowPath(_llint_slow_path_get_from_scope)
>+    callSlowPath(_llint_slow_path_get_from_scope) # Slow path handles the TDZ check for us.
>     dispatch(8)
>+end
> 
> 
> macro putProperty()
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 186105)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -676,15 +676,19 @@ _llint_op_new_object:
>     dispatch(4)
> 
> 
>-_llint_op_check_tdz:
>+macro checkTDZ(operandOffsetFromInstructionToCheck, finish)
>     traceExecution()
>-    loadpFromInstruction(1, t0)
>-    loadq [cfr, t0, 8], t0
>-    bqneq t0, ValueEmpty, .opNotTDZ
>+    loadisFromInstruction(operandOffsetFromInstructionToCheck, t0)
>+    loadConstantOrVariable(t0, t1)
>+    bqneq t1, ValueEmpty, .opNotTDZ
>     callSlowPath(_slow_path_throw_tdz_error)
> 
> .opNotTDZ:
>-    dispatch(2)
>+    finish()
>+end
>+
>+_llint_op_check_tdz:
>+    checkTDZ(1, macro() dispatch(2) end)
> 
> 
> _llint_op_mov:
>@@ -2032,7 +2036,7 @@ macro getClosureVar()
>     storeq t0, [cfr, t1, 8]
> end
> 
>-_llint_op_get_from_scope:
>+macro getFromScope(tdzCheckIfNecessary)
>     traceExecution()
>     loadisFromInstruction(4, t0)
>     andi ResolveModeMask, t0
>@@ -2041,29 +2045,34 @@ _llint_op_get_from_scope:
>     bineq t0, GlobalProperty, .gGlobalVar
>     loadWithStructureCheck(2, .gDynamic)
>     getProperty()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gGlobalVar:
>     bineq t0, GlobalVar, .gClosureVar
>     getGlobalVar()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gClosureVar:
>     bineq t0, ClosureVar, .gGlobalPropertyWithVarInjectionChecks
>     loadVariable(2, t0)
>     getClosureVar()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gGlobalPropertyWithVarInjectionChecks:
>     bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
>     loadWithStructureCheck(2, .gDynamic)
>     getProperty()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gGlobalVarWithVarInjectionChecks:
>     bineq t0, GlobalVarWithVarInjectionChecks, .gClosureVarWithVarInjectionChecks
>     varInjectionCheck(.gDynamic)
>     getGlobalVar()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gClosureVarWithVarInjectionChecks:
>@@ -2071,11 +2080,13 @@ _llint_op_get_from_scope:
>     varInjectionCheck(.gDynamic)
>     loadVariable(2, t0)
>     getClosureVar()
>+    tdzCheckIfNecessary()
>     dispatch(8)
> 
> .gDynamic:
>-    callSlowPath(_llint_slow_path_get_from_scope)
>+    callSlowPath(_llint_slow_path_get_from_scope) # Slow path handles the TDZ check for us.
>     dispatch(8)
>+end
> 
> 
> macro putProperty()
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 186105)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -1299,6 +1299,18 @@ _llint_op_push_name_scope:
>     dispatch(5)
> 
> 
>+_llint_op_push_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_push_lexical_scope)
>+    dispatch(4)
>+
>+
>+_llint_op_pop_lexical_scope:
>+    traceExecution()
>+    callSlowPath(_llint_slow_path_pop_lexical_scope)
>+    dispatch(2)
>+
>+
> _llint_op_throw:
>     traceExecution()
>     callSlowPath(_llint_slow_path_throw)
>@@ -1311,6 +1323,17 @@ _llint_op_throw_static_error:
>     dispatch(3)
> 
> 
>+_llint_op_get_from_scope_no_tdz:
>+    getFromScope(macro() end)
>+
>+
>+_llint_op_get_from_scope:
>+    getFromScope(
>+        macro() 
>+            checkTDZ(1, macro() end) 
>+        end)
>+
>+
> _llint_op_profile_will_call:
>     traceExecution()
>     loadp CodeBlock[cfr], t0
>Index: Source/JavaScriptCore/parser/ASTBuilder.h
>===================================================================
>--- Source/JavaScriptCore/parser/ASTBuilder.h	(revision 186105)
>+++ Source/JavaScriptCore/parser/ASTBuilder.h	(working copy)
>@@ -327,11 +327,11 @@ public:
>         return new (m_parserArena) ConditionalNode(location, condition, lhs, rhs);
>     }
> 
>-    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
>+    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end, AssignResolveNode::AssignmentContext assignmentContext)
>     {
>         if (rhs->isFuncExprNode())
>             static_cast<FuncExprNode*>(rhs)->body()->setInferredName(ident);
>-        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs);
>+        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs, assignmentContext);
>         setExceptionLocation(node, start, divot, end);
>         return node;
>     }
>@@ -443,16 +443,16 @@ public:
>         const JSTextPosition& classStart, const JSTextPosition& classEnd, unsigned startLine, unsigned endLine)
>     {
>         // FIXME: Use "let" declaration.
>-        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd);
>+        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd, AssignResolveNode::VariableDeclarationStatementContext);
>         ClassDeclNode* decl = new (m_parserArena) ClassDeclNode(location, assign);
>         decl->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return decl;
>     }
> #endif
> 
>-    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine)
>+    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine, VariableEnvironment& lexicalVariables)
>     {
>-        BlockNode* block = new (m_parserArena) BlockNode(location, elements);
>+        BlockNode* block = new (m_parserArena) BlockNode(location, elements, lexicalVariables);
>         block->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return block;
>     }
>@@ -471,39 +471,39 @@ public:
>         return result;
>     }
> 
>-    StatementNode* createForLoop(const JSTokenLocation& location, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end)
>+    StatementNode* createForLoop(const JSTokenLocation& location, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end, VariableEnvironment& lexicalVariables)
>     {
>-        ForNode* result = new (m_parserArena) ForNode(location, initializer, condition, iter, statements);
>+        ForNode* result = new (m_parserArena) ForNode(location, initializer, condition, iter, statements, lexicalVariables);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         return result;
>     }
> 
>-    StatementNode* createForInLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForInLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, VariableEnvironment& lexicalVariables)
>     {
>-        ForInNode* result = new (m_parserArena) ForInNode(location, lhs, iter, statements);
>+        ForInNode* result = new (m_parserArena) ForInNode(location, lhs, iter, statements, lexicalVariables);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         setExceptionLocation(result, eStart, eDivot, eEnd);
>         return result;
>     }
>     
>-    StatementNode* createForInLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForInLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, VariableEnvironment& lexicalVariables)
>     {
>         auto lexpr = new (m_parserArena) DeconstructingAssignmentNode(location, pattern.get(), 0);
>-        return createForInLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end);
>+        return createForInLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end, lexicalVariables);
>     }
>     
>-    StatementNode* createForOfLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForOfLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, VariableEnvironment& lexicalVariables)
>     {
>-        ForOfNode* result = new (m_parserArena) ForOfNode(location, lhs, iter, statements);
>+        ForOfNode* result = new (m_parserArena) ForOfNode(location, lhs, iter, statements, lexicalVariables);
>         result->setLoc(start, end, location.startOffset, location.lineStartOffset);
>         setExceptionLocation(result, eStart, eDivot, eEnd);
>         return result;
>     }
>     
>-    StatementNode* createForOfLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end)
>+    StatementNode* createForOfLoop(const JSTokenLocation& location, PassRefPtr<DeconstructionPatternNode> pattern, ExpressionNode* iter, StatementNode* statements, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, VariableEnvironment& lexicalVariables)
>     {
>         auto lexpr = new (m_parserArena) DeconstructingAssignmentNode(location, pattern.get(), 0);
>-        return createForOfLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end);
>+        return createForOfLoop(location, lexpr, iter, statements, eStart, eDivot, eEnd, start, end, lexicalVariables);
>     }
> 
>     bool isBindingNode(const DeconstructionPattern& pattern)
>@@ -521,9 +521,15 @@ public:
>         return result;
>     }
> 
>-    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier)
>+    StatementNode* createLetStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
>     {
>-        return new (m_parserArena) EmptyVarExpression(location, identifier);
>+        // FIXME: better name for 'VarStatementNode'.
>+        return createVarStatement(location, expr, start, end);
>+    }
>+
>+    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier, EmptyVarExpression::DeclarationType declarationType)
>+    {
>+        return new (m_parserArena) EmptyVarExpression(location, identifier, declarationType);
>     }
> 
>     StatementNode* createReturnStatement(const JSTokenLocation& location, ExpressionNode* expression, const JSTextPosition& start, const JSTextPosition& end)
>@@ -559,10 +565,10 @@ public:
>         return result;
>     }
> 
>-    StatementNode* createSwitchStatement(const JSTokenLocation& location, ExpressionNode* expr, ClauseListNode* firstClauses, CaseClauseNode* defaultClause, ClauseListNode* secondClauses, int startLine, int endLine)
>+    StatementNode* createSwitchStatement(const JSTokenLocation& location, ExpressionNode* expr, ClauseListNode* firstClauses, CaseClauseNode* defaultClause, ClauseListNode* secondClauses, int startLine, int endLine, VariableEnvironment& lexicalVariables)
>     {
>         CaseBlockNode* cases = new (m_parserArena) CaseBlockNode(firstClauses, defaultClause, secondClauses);
>-        SwitchNode* result = new (m_parserArena) SwitchNode(location, expr, cases);
>+        SwitchNode* result = new (m_parserArena) SwitchNode(location, expr, cases, lexicalVariables);
>         result->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
>         return result;
>     }
>@@ -778,9 +784,9 @@ public:
>         node->appendEntry(location, identifier, wasString, pattern.get(), defaultValue);
>     }
>     
>-    BindingPattern createBindingLocation(const JSTokenLocation&, const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end)
>+    BindingPattern createBindingLocation(const JSTokenLocation&, const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, BindingNode::BindingContext context)
>     {
>-        return BindingNode::create(boundProperty, start, end);
>+        return BindingNode::create(boundProperty, start, end, context);
>     }
> 
>     void setEndOffset(Node* node, int offset)
>@@ -1167,7 +1173,7 @@ ExpressionNode* ASTBuilder::makeAssignNo
>         if (op == OpEqual) {
>             if (expr->isFuncExprNode())
>                 static_cast<FuncExprNode*>(expr)->body()->setInferredName(resolve->identifier());
>-            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr);
>+            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr, AssignResolveNode::AssignmentExpressionContext);
>             setExceptionLocation(node, start, divot, end);
>             return node;
>         }
>Index: Source/JavaScriptCore/parser/Keywords.table
>===================================================================
>--- Source/JavaScriptCore/parser/Keywords.table	(revision 186105)
>+++ Source/JavaScriptCore/parser/Keywords.table	(working copy)
>@@ -19,6 +19,7 @@ for		FOR
> instanceof	INSTANCEOF
> new		NEW
> var		VAR
>+let		LET
> continue	CONTINUE
> function	FUNCTION
> return		RETURN
>@@ -46,7 +47,6 @@ import          RESERVED
> # Reserved for future use in strict code.
> implements      RESERVED_IF_STRICT
> interface       RESERVED_IF_STRICT
>-let             RESERVED_IF_STRICT
> package         RESERVED_IF_STRICT
> private         RESERVED_IF_STRICT
> protected       RESERVED_IF_STRICT
>Index: Source/JavaScriptCore/parser/NodeConstructors.h
>===================================================================
>--- Source/JavaScriptCore/parser/NodeConstructors.h	(revision 186105)
>+++ Source/JavaScriptCore/parser/NodeConstructors.h	(working copy)
>@@ -634,10 +634,11 @@ namespace JSC {
>     {
>     }
> 
>-    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right)
>+    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right, AssignmentContext assignmentContext)
>         : ExpressionNode(location)
>         , m_ident(ident)
>         , m_right(right)
>+        , m_assignmentContext(assignmentContext)
>     {
>     }
> 
>@@ -733,9 +734,10 @@ namespace JSC {
>     {
>     }
> 
>-    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident)
>+    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident, DeclarationType declarationType)
>         : ExpressionNode(location)
>         , m_ident(ident)
>+        , m_declarationType(declarationType)
>     {
>     }
>     
>@@ -761,8 +763,9 @@ namespace JSC {
>     {
>     }
> 
>-    inline ForNode::ForNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement)
>+    inline ForNode::ForNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, VariableEnvironment& lexicalVariables)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables)
>         , m_expr1(expr1)
>         , m_expr2(expr2)
>         , m_expr3(expr3)
>@@ -894,8 +897,9 @@ namespace JSC {
>     {
>     }
> 
>-    inline SwitchNode::SwitchNode(const JSTokenLocation& location, ExpressionNode* expr, CaseBlockNode* block)
>+    inline SwitchNode::SwitchNode(const JSTokenLocation& location, ExpressionNode* expr, CaseBlockNode* block, VariableEnvironment& lexicalVariables)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables)
>         , m_expr(expr)
>         , m_block(block)
>     {
>@@ -909,28 +913,30 @@ namespace JSC {
>     {
>     }
> 
>-    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements)
>+    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements, VariableEnvironment& lexicalVariables)
>         : StatementNode(location)
>+        , LexicalNode(lexicalVariables)
>         , m_statements(statements)
>     {
>     }
> 
>-    inline EnumerationNode::EnumerationNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>+    inline EnumerationNode::EnumerationNode(const JSTokenLocation& location, ExpressionNode* lexpr, ExpressionNode* expr, StatementNode* statement, VariableEnvironment& lexicalVariables)
>         : StatementNode(location)
>-        , m_lexpr(l)
>+        , LexicalNode(lexicalVariables)
>+        , m_lexpr(lexpr)
>         , m_expr(expr)
>         , m_statement(statement)
>     {
>-        ASSERT(l);
>+        ASSERT(lexpr);
>     }
>     
>-    inline ForInNode::ForInNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>-        : EnumerationNode(location, l, expr, statement)
>+    inline ForInNode::ForInNode(const JSTokenLocation& location, ExpressionNode* lexpr, ExpressionNode* expr, StatementNode* statement, VariableEnvironment& lexicalVariables)
>+        : EnumerationNode(location, lexpr, expr, statement, lexicalVariables)
>     {
>     }
>     
>-    inline ForOfNode::ForOfNode(const JSTokenLocation& location, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
>-        : EnumerationNode(location, l, expr, statement)
>+    inline ForOfNode::ForOfNode(const JSTokenLocation& location, ExpressionNode* lexpr, ExpressionNode* expr, StatementNode* statement, VariableEnvironment& lexicalVariables)
>+        : EnumerationNode(location, lexpr, expr, statement, lexicalVariables)
>     {
>     }
>     
>@@ -958,16 +964,17 @@ namespace JSC {
>         return adoptRef(*new ObjectPatternNode);
>     }
> 
>-    inline Ref<BindingNode> BindingNode::create(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end)
>+    inline Ref<BindingNode> BindingNode::create(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, BindingContext context)
>     {
>-        return adoptRef(*new BindingNode(boundProperty, start, end));
>+        return adoptRef(*new BindingNode(boundProperty, start, end, context));
>     }
>     
>-    inline BindingNode::BindingNode(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end)
>+    inline BindingNode::BindingNode(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, BindingContext context)
>         : DeconstructionPatternNode()
>         , m_divotStart(start)
>         , m_divotEnd(end)
>         , m_boundProperty(boundProperty)
>+        , m_bindingContext(context)
>     {
>     }
>     
>Index: Source/JavaScriptCore/parser/Nodes.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.cpp	(revision 186105)
>+++ Source/JavaScriptCore/parser/Nodes.cpp	(working copy)
>@@ -94,9 +94,10 @@ ScopeNode::ScopeNode(ParserArena& parser
> {
> }
> 
>-ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, CodeFeatures features, int numConstants)
>+ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, VariableEnvironment& lexicalVariables, CodeFeatures features, int numConstants)
>     : StatementNode(endLocation)
>     , ParserArenaRoot(parserArena)
>+    , LexicalNode(lexicalVariables)
>     , m_startLineNumber(startLocation.line)
>     , m_startStartOffset(startLocation.startOffset)
>     , m_startLineStartOffset(startLocation.lineStartOffset)
>@@ -117,8 +118,8 @@ StatementNode* ScopeNode::singleStatemen
> 
> // ------------------------------ ProgramNode -----------------------------
> 
>-ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, VariableEnvironment& lexicalVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>@@ -131,8 +132,8 @@ void ProgramNode::setClosedVariables(Vec
> 
> // ------------------------------ EvalNode -----------------------------
> 
>-EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, features, numConstants)
>+EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, VariableEnvironment& lexicalVariables, const SourceCode& source, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varStack, funcStack, capturedVariables, lexicalVariables, features, numConstants)
>     , m_endColumn(endColumn)
> {
> }
>@@ -201,8 +202,8 @@ void FunctionBodyNode::setEndPosition(JS
> 
> // ------------------------------ FunctionNode -----------------------------
> 
>-FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>-    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, features, numConstants)
>+FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VarStack& varStack, FunctionStack& funcStack, IdentifierSet& capturedVariables, VariableEnvironment& lexicalVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
>+    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varStack, funcStack, capturedVariables, lexicalVariables, features, numConstants)
>     , m_startColumn(startColumn)
>     , m_endColumn(endColumn)
> {
>@@ -216,4 +217,9 @@ void FunctionNode::finishParsing(PassRef
>     m_functionMode = functionMode;
> }
> 
>+LexicalNode::LexicalNode(VariableEnvironment& lexicalVariables)
>+{
>+    m_lexicalVariables.swap(lexicalVariables);
>+}
>+
> } // namespace JSC
>Index: Source/JavaScriptCore/parser/Nodes.h
>===================================================================
>--- Source/JavaScriptCore/parser/Nodes.h	(revision 186105)
>+++ Source/JavaScriptCore/parser/Nodes.h	(working copy)
>@@ -34,6 +34,7 @@
> #include "ResultType.h"
> #include "SourceCode.h"
> #include "SymbolTable.h"
>+#include "VariableEnvironment.h"
> #include <wtf/MathExtras.h>
> 
> namespace JSC {
>@@ -202,6 +203,20 @@ namespace JSC {
>         int m_lastLine;
>     };
> 
>+    class LexicalNode {
>+    public:
>+        LexicalNode()
>+        {
>+        }
>+
>+        LexicalNode(VariableEnvironment& lexicalDeclaredVariables);
>+
>+        VariableEnvironment& lexicalVariables() { return m_lexicalVariables; }
>+
>+    protected:
>+        VariableEnvironment m_lexicalVariables;
>+    };
>+
>     class ConstantNode : public ExpressionNode {
>     public:
>         ConstantNode(const JSTokenLocation&, ResultType);
>@@ -1149,13 +1164,15 @@ namespace JSC {
> 
>     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
>     public:
>-        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right);
>+        enum AssignmentContext : uint8_t { VariableDeclarationStatementContext, AssignmentExpressionContext };
>+        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right, AssignmentContext);
> 
>     private:
>         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         const Identifier& m_ident;
>         ExpressionNode* m_right;
>+        AssignmentContext m_assignmentContext;
>     };
> 
>     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
>@@ -1283,9 +1300,9 @@ namespace JSC {
>         StatementNode* m_tail;
>     };
> 
>-    class BlockNode : public StatementNode {
>+    class BlockNode : public StatementNode, public LexicalNode {
>     public:
>-        BlockNode(const JSTokenLocation&, SourceElements* = 0);
>+        BlockNode(const JSTokenLocation&, SourceElements*, VariableEnvironment&);
> 
>         StatementNode* singleStatement() const;
>         StatementNode* lastStatement() const;
>@@ -1341,12 +1358,14 @@ namespace JSC {
> 
>     class EmptyVarExpression : public ExpressionNode {
>     public:
>-        EmptyVarExpression(const JSTokenLocation&, const Identifier&);
>+        enum DeclarationType : uint8_t { VarDeclaration,  LexicalDeclaration };
>+        EmptyVarExpression(const JSTokenLocation&, const Identifier&, DeclarationType);
> 
>     private:
>         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         const Identifier& m_ident;
>+        DeclarationType m_declarationType;
>     };
> 
> 
>@@ -1386,9 +1405,9 @@ namespace JSC {
>         StatementNode* m_statement;
>     };
> 
>-    class ForNode : public StatementNode {
>+    class ForNode : public StatementNode, public LexicalNode {
>     public:
>-        ForNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*);
>+        ForNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*, VariableEnvironment&);
> 
>     private:
>         virtual void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -1401,9 +1420,9 @@ namespace JSC {
>     
>     class DeconstructionPatternNode;
>     
>-    class EnumerationNode : public StatementNode, public ThrowableExpressionData {
>+    class EnumerationNode : public StatementNode, public ThrowableExpressionData, public LexicalNode {
>     public:
>-        EnumerationNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        EnumerationNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, VariableEnvironment&);
>         
>     protected:
>         ExpressionNode* m_lexpr;
>@@ -1413,7 +1432,7 @@ namespace JSC {
>     
>     class ForInNode : public EnumerationNode {
>     public:
>-        ForInNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        ForInNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, VariableEnvironment&);
> 
>     private:
>         RegisterID* tryGetBoundLocal(BytecodeGenerator&);
>@@ -1425,7 +1444,7 @@ namespace JSC {
>     
>     class ForOfNode : public EnumerationNode {
>     public:
>-        ForOfNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*);
>+        ForOfNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, VariableEnvironment&);
>         
>     private:
>         virtual void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -1529,13 +1548,13 @@ namespace JSC {
>         ParameterNode* m_next;
>     };
> 
>-    class ScopeNode : public StatementNode, public ParserArenaRoot {
>+    class ScopeNode : public StatementNode, public ParserArenaRoot, public LexicalNode {
>     public:
>         typedef DeclarationStacks::VarStack VarStack;
>         typedef DeclarationStacks::FunctionStack FunctionStack;
> 
>         ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, bool inStrictContext);
>-        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, CodeFeatures, int numConstants);
>+        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, VariableEnvironment&, CodeFeatures, int numConstants);
> 
>         using ParserArenaRoot::operator new;
> 
>@@ -1598,7 +1617,7 @@ namespace JSC {
> 
>     class ProgramNode : public ScopeNode {
>     public:
>-        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, VariableEnvironment&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         unsigned startColumn() const { return m_startColumn; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1617,7 +1636,7 @@ namespace JSC {
> 
>     class EvalNode : public ScopeNode {
>     public:
>-        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, VariableEnvironment&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         ALWAYS_INLINE unsigned startColumn() const { return 0; }
>         unsigned endColumn() const { return m_endColumn; }
>@@ -1704,7 +1723,7 @@ namespace JSC {
> 
>     class FunctionNode final : public ScopeNode {
>     public:
>-        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
>+        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VarStack&, FunctionStack&, IdentifierSet&, VariableEnvironment&, const SourceCode&, CodeFeatures, int numConstants);
> 
>         FunctionParameters* parameters() const { return m_parameters.get(); }
> 
>@@ -1833,14 +1852,15 @@ namespace JSC {
> 
>     class BindingNode : public DeconstructionPatternNode {
>     public:
>-        static Ref<BindingNode> create(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end);
>+        enum BindingContext : uint8_t { DoesNeedTDZCheck, DoesNotNeedTDZCheck };
>+        static Ref<BindingNode> create(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, BindingContext);
>         const Identifier& boundProperty() const { return m_boundProperty; }
> 
>         const JSTextPosition& divotStart() const { return m_divotStart; }
>         const JSTextPosition& divotEnd() const { return m_divotEnd; }
>         
>     private:
>-        BindingNode(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end);
>+        BindingNode(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, BindingContext);
> 
>         virtual void collectBoundIdentifiers(Vector<Identifier>&) const override;
>         virtual void bindValue(BytecodeGenerator&, RegisterID*) const override;
>@@ -1851,6 +1871,7 @@ namespace JSC {
>         JSTextPosition m_divotStart;
>         JSTextPosition m_divotEnd;
>         Identifier m_boundProperty;
>+        BindingContext m_bindingContext;
>     };
> 
>     class DeconstructingAssignmentNode : public ExpressionNode, public ParserArenaDeletable {
>@@ -1936,9 +1957,9 @@ namespace JSC {
>         ClauseListNode* m_list2;
>     };
> 
>-    class SwitchNode : public StatementNode {
>+    class SwitchNode : public StatementNode, public LexicalNode {
>     public:
>-        SwitchNode(const JSTokenLocation&, ExpressionNode*, CaseBlockNode*);
>+        SwitchNode(const JSTokenLocation&, ExpressionNode*, CaseBlockNode*, VariableEnvironment&);
> 
>     private:
>         virtual void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>Index: Source/JavaScriptCore/parser/Parser.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.cpp	(revision 186105)
>+++ Source/JavaScriptCore/parser/Parser.cpp	(working copy)
>@@ -264,6 +264,8 @@ String Parser<LexerType>::parseInner()
>     if (m_lexer->isReparsing())
>         m_statementDepth--;
>     ScopeRef scope = currentScope();
>+    scope->setIsLexicalScope();
>+
>     SourceElements* sourceElements = parseSourceElements(context, CheckForStrictMode, StandardFunctionParseType);
>     if (!sourceElements || !consume(EOFTOK)) {
>         if (hasError())
>@@ -275,7 +277,7 @@ String Parser<LexerType>::parseInner()
>     IdentifierSet capturedVariables;
>     bool modifiedParameter = false;
>     bool modifiedArguments = false;
>-    scope->getCapturedVariables(capturedVariables, modifiedParameter, modifiedArguments);
>+    scope->getCapturedVars(capturedVariables, modifiedParameter, modifiedArguments);
>     
>     CodeFeatures features = context.features();
>     if (scope->strictMode())
>@@ -290,6 +292,7 @@ String Parser<LexerType>::parseInner()
>     if (m_parsingBuiltin) {
>         IdentifierSet usedVariables;
>         scope->getUsedVariables(usedVariables);
>+        // FIXME: This needs to be changed if we want to allow builtins to use lexical declarations.
>         for (const auto& variable : usedVariables) {
>             Identifier identifier = Identifier::fromUid(m_vm, variable.get());
>             if (scope->hasDeclaredVariable(identifier))
>@@ -404,9 +407,9 @@ template <class TreeBuilder> TreeSourceE
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVarDeclaration(TreeBuilder& context)
>+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVariableDeclaration(TreeBuilder& context, DeclarationType declarationType)
> {
>-    ASSERT(match(VAR));
>+    ASSERT(match(VAR) || match(LET));
>     JSTokenLocation location(tokenLocation());
>     int start = tokenLine();
>     int end = 0;
>@@ -414,11 +417,14 @@ template <class TreeBuilder> TreeStateme
>     TreeDeconstructionPattern scratch1 = 0;
>     TreeExpression scratch2 = 0;
>     JSTextPosition scratch3;
>-    TreeExpression varDecls = parseVarDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext);
>+    TreeExpression variableDecls = parseVariableDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext, declarationType);
>     propagateError();
>     failIfFalse(autoSemiColon(), "Expected ';' after var declaration");
>     
>-    return context.createVarStatement(location, varDecls, start, end);
>+    if (declarationType == VarDeclaration)
>+        return context.createVarStatement(location, variableDecls, start, end);
>+    ASSERT(declarationType == LexicalDeclaration);
>+    return context.createLetStatement(location, variableDecls, start, end);
> }
> 
> template <typename LexerType>
>@@ -483,7 +489,7 @@ template <class TreeBuilder> TreeStateme
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext)
>+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVariableDeclarationList(TreeBuilder& context, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext, DeclarationType declarationType)
> {
>     TreeExpression head = 0;
>     TreeExpression tail = 0;
>@@ -497,7 +503,7 @@ template <class TreeBuilder> TreeExpress
>         TreeExpression node = 0;
>         declarations++;
>         bool hasInitializer = false;
>-        if (match(IDENT)) {
>+        if (match(IDENT) || isLETMaskedAsIDENT()) {
>             JSTextPosition varStart = tokenStartPosition();
>             JSTokenLocation varStartLocation(tokenLocation());
>             identStart = varStart;
>@@ -506,8 +512,14 @@ template <class TreeBuilder> TreeExpress
>             lastIdentToken = m_token;
>             next();
>             hasInitializer = match(EQUAL);
>-            failIfFalseIfStrict(declareVariable(name), "Cannot declare a variable named ", name->impl(), " in strict mode");
>-            context.addVar(name, (hasInitializer || (!m_allowsIn && (match(INTOKEN) || isofToken()))) ? DeclarationStacks::HasInitializer : 0);
>+            if (!declareVariable(name, declarationType)) {
>+                if (declarationType == LexicalDeclaration)
>+                    internalFailWithMessage(false, "Cannot declare a lexical variable twice: '", name->impl(), "'");
>+                else if (strictMode())
>+                    internalFailWithMessage(false, "Cannot declare a variable named ", name->impl(), " in strict mode");
>+            }
>+            if (declarationType == VarDeclaration)
>+                context.addVar(name, (hasInitializer || (!m_allowsIn && (match(INTOKEN) || isofToken()))) ? DeclarationStacks::HasInitializer : 0);
>             if (hasInitializer) {
>                 JSTextPosition varDivot = tokenStartPosition() + 1;
>                 initStart = tokenStartPosition();
>@@ -517,12 +529,12 @@ template <class TreeBuilder> TreeExpress
>                 lastInitializer = initializer;
>                 failIfFalse(initializer, "Expected expression as the intializer for the variable '", name->impl(), "'");
>                 
>-                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition());
>+                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition(), AssignResolveNode::VariableDeclarationStatementContext);
>             } else
>-                node = context.createEmptyVarExpression(varStartLocation, *name);
>+                node = context.createEmptyVarExpression(varStartLocation, *name, declarationType == VarDeclaration ? EmptyVarExpression::VarDeclaration : EmptyVarExpression::LexicalDeclaration);
>         } else {
>             lastIdent = 0;
>-            auto pattern = parseDeconstructionPattern(context, DeconstructToVariables);
>+            auto pattern = parseDeconstructionPattern(context, declarationType == VarDeclaration ? DeconstructToVariables : DeconstructToLexicalVariables);
>             failIfFalse(pattern, "Cannot parse this deconstruction pattern");
>             hasInitializer = match(EQUAL);
>             failIfTrue(declarationListContext == VarDeclarationContext && !hasInitializer, "Expected an initializer in destructuring variable declaration");
>@@ -544,12 +556,13 @@ template <class TreeBuilder> TreeExpress
>             tail = context.appendToCommaExpr(location, head, tail, node);
>     } while (match(COMMA));
>     if (lastIdent)
>-        lastPattern = createBindingPattern(context, DeconstructToVariables, *lastIdent, 0, lastIdentToken);
>+        lastPattern = context.createBindingLocation(lastIdentToken.m_location, *lastIdent, lastIdentToken.m_startPosition, lastIdentToken.m_endPosition, BindingNode::DoesNotNeedTDZCheck);
>+
>     return head;
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeDeconstructionPattern Parser<LexerType>::createBindingPattern(TreeBuilder& context, DeconstructionKind kind, const Identifier& name, int depth, JSToken token)
>+template <class TreeBuilder> TreeDeconstructionPattern Parser<LexerType>::createBindingPattern(TreeBuilder& context, DeconstructionKind kind, const Identifier& name, int depth, JSToken token, BindingNode::BindingContext bindingContext)
> {
>     ASSERT(!name.isNull());
>     
>@@ -557,7 +570,9 @@ template <class TreeBuilder> TreeDeconst
>     if (depth) {
>         if (kind == DeconstructToVariables)
>             failIfFalseIfStrict(declareVariable(&name), "Cannot deconstruct to a variable named '", name.impl(), "' in strict mode");
>-        if (kind == DeconstructToParameters) {
>+        else if (kind == DeconstructToLexicalVariables)
>+            semanticFailIfFalse(declareVariable(&name, LexicalDeclaration), "Cannot declare a lexical variable twice: '", name.impl(), "'");
>+        else if (kind == DeconstructToParameters) {
>             auto bindingResult = declareBoundParameter(&name);
>             if (bindingResult == Scope::StrictBindingFailed && strictMode()) {
>                 semanticFailIfTrue(m_vm->propertyNames->arguments == name || m_vm->propertyNames->eval == name, "Cannot deconstruct to a parameter name '", name.impl(), "' in strict mode");
>@@ -575,16 +590,16 @@ template <class TreeBuilder> TreeDeconst
>                 semanticFail("Cannot deconstruct to a parameter named '", name.impl(), "'");
>             }
>         }
>-        if (kind != DeconstructToExpressions)
>+        if (kind != DeconstructToExpressions && kind != DeconstructToLexicalVariables)
>             context.addVar(&name, DeclarationStacks::HasInitializer);
> 
>     } else {
>         if (kind == DeconstructToVariables) {
>             failIfFalseIfStrict(declareVariable(&name), "Cannot declare a variable named '", name.impl(), "' in strict mode");
>             context.addVar(&name, DeclarationStacks::HasInitializer);
>-        }
>-        
>-        if (kind == DeconstructToParameters) {
>+        } else if (kind == DeconstructToLexicalVariables)
>+            semanticFailIfFalse(declareVariable(&name, LexicalDeclaration), "Cannot declare a lexical variable twice: '", name.impl(), "'");
>+        else if (kind == DeconstructToParameters) {
>             bool declarationResult = declareParameter(&name);
>             if (!declarationResult && strictMode()) {
>                 semanticFailIfTrue(m_vm->propertyNames->arguments == name || m_vm->propertyNames->eval == name, "Cannot deconstruct to a parameter name '", name.impl(), "' in strict mode");
>@@ -597,7 +612,7 @@ template <class TreeBuilder> TreeDeconst
>             }
>         }
>     }
>-    return context.createBindingLocation(token.m_location, name, token.m_startPosition, token.m_endPosition);
>+    return context.createBindingLocation(token.m_location, name, token.m_startPosition, token.m_endPosition, bindingContext);
> }
> 
> #if ENABLE(ES6_ARROWFUNCTION_SYNTAX)
>@@ -637,13 +652,13 @@ template <class TreeBuilder> TreeStateme
> #endif
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeDeconstructionPattern Parser<LexerType>::tryParseDeconstructionPatternExpression(TreeBuilder& context)
>+template <class TreeBuilder> TreeDeconstructionPattern Parser<LexerType>::tryParseDeconstructionPatternExpression(TreeBuilder& context, BindingNode::BindingContext bindingContext)
> {
>-    return parseDeconstructionPattern(context, DeconstructToExpressions);
>+    return parseDeconstructionPattern(context, DeconstructToExpressions, bindingContext);
> }
> 
> template <typename LexerType>
>-template <class TreeBuilder> TreeDeconstructionPattern Parser<LexerType>::parseDeconstructionPattern(TreeBuilder& context, DeconstructionKind kind, int depth)
>+template <class TreeBuilder> TreeDeconstructionPattern Parser<LexerType>::parseDeconstructionPattern(TreeBuilder& context, DeconstructionKind kind, BindingNode::BindingContext bindingContext, int depth)
> {
>     failIfStackOverflow();
>     int nonLHSCount = m_nonLHSCount;
>@@ -669,7 +684,7 @@ template <class TreeBuilder> TreeDeconst
>             if (UNLIKELY(match(DOTDOTDOT))) {
>                 JSTokenLocation location = m_token.m_location;
>                 next();
>-                auto innerPattern = parseDeconstructionPattern(context, kind, depth + 1);
>+                auto innerPattern = parseDeconstructionPattern(context, kind, bindingContext, depth + 1);
>                 if (kind == DeconstructToExpressions && !innerPattern)
>                     return 0;
>                 failIfFalse(innerPattern, "Cannot parse this deconstruction pattern");
>@@ -682,7 +697,7 @@ template <class TreeBuilder> TreeDeconst
>             }
> 
>             JSTokenLocation location = m_token.m_location;
>-            auto innerPattern = parseDeconstructionPattern(context, kind, depth + 1);
>+            auto innerPattern = parseDeconstructionPattern(context, kind, bindingContext, depth + 1);
>             if (kind == DeconstructToExpressions && !innerPattern)
>                 return 0;
>             failIfFalse(innerPattern, "Cannot parse this deconstruction pattern");
>@@ -711,14 +726,14 @@ template <class TreeBuilder> TreeDeconst
>             Identifier propertyName;
>             TreeDeconstructionPattern innerPattern = 0;
>             JSTokenLocation location = m_token.m_location;
>-            if (match(IDENT)) {
>+            if (match(IDENT) || isLETMaskedAsIDENT()) {
>                 propertyName = *m_token.m_data.ident;
>                 JSToken identifierToken = m_token;
>                 next();
>                 if (consume(COLON))
>-                    innerPattern = parseDeconstructionPattern(context, kind, depth + 1);
>+                    innerPattern = parseDeconstructionPattern(context, kind, bindingContext, depth + 1);
>                 else
>-                    innerPattern = createBindingPattern(context, kind, propertyName, depth, identifierToken);
>+                    innerPattern = createBindingPattern(context, kind, propertyName, depth, identifierToken, bindingContext);
>             } else {
>                 JSTokenType tokenType = m_token.m_type;
>                 switch (m_token.m_type) {
>@@ -749,7 +764,7 @@ template <class TreeBuilder> TreeDeconst
>                     
>                     failWithMessage("Expected a ':' prior to named property deconstruction");
>                 }
>-                innerPattern = parseDeconstructionPattern(context, kind, depth + 1);
>+                innerPattern = parseDeconstructionPattern(context, kind, bindingContext, depth + 1);
>             }
>             if (kind == DeconstructToExpressions && !innerPattern)
>                 return 0;
>@@ -767,13 +782,13 @@ template <class TreeBuilder> TreeDeconst
>     }
> 
>     default: {
>-        if (!match(IDENT)) {
>+        if (!match(IDENT) && !isLETMaskedAsIDENT()) {
>             if (kind == DeconstructToExpressions)
>                 return 0;
>             semanticFailureDueToKeyword("variable name");
>             failWithMessage("Expected a parameter pattern or a ')' in parameter list");
>         }
>-        pattern = createBindingPattern(context, kind, *m_token.m_data.ident, depth, m_token);
>+        pattern = createBindingPattern(context, kind, *m_token.m_data.ident, depth, m_token, bindingContext);
>         next();
>         break;
>     }
>@@ -801,7 +816,7 @@ template <class TreeBuilder> TreeConstDe
>     do {
>         JSTokenLocation location(tokenLocation());
>         next();
>-        matchOrFail(IDENT, "Expected an identifier name in const declaration");
>+        failIfFalse(match(IDENT) || isLETMaskedAsIDENT(), "Expected an identifier name in const declaration");
>         const Identifier* name = m_token.m_data.ident;
>         next();
>         bool hasInitializer = match(EQUAL);
>@@ -835,17 +850,44 @@ template <class TreeBuilder> TreeStateme
>     JSTextPosition declsEnd;
>     TreeExpression decls = 0;
>     TreeDeconstructionPattern pattern = 0;
>-    if (match(VAR)) {
>+    bool isVarDeclaraton = match(VAR);
>+    bool isLetDeclaration = match(LET);
>+
>+    VariableEnvironment dummySet;
>+    VariableEnvironment* lexicalVariables = nullptr;
>+    AutoCleanupLexicalScope lexicalScope;
>+
>+    auto gatherLexicalVariablesIfNecessary = [&] () {
>+        if (isLetDeclaration) {
>+            ScopeRef scope = lexicalScope.scope();
>+            lexicalVariables = &scope->finalizeLexicalEnvironment();
>+        } else
>+            lexicalVariables = &dummySet;
>+    };
>+
>+    auto popLexicalScopeIfNecessary = [&] () {
>+        if (isLetDeclaration)
>+            popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
>+    };
>+
>+    if (isVarDeclaraton || isLetDeclaration) {
>         /*
>-         for (var IDENT in expression) statement
>-         for (var varDeclarationList; expressionOpt; expressionOpt)
>+         for (var/let IDENT in expression) statement
>+         for (var/let varDeclarationList; expressionOpt; expressionOpt)
>          */
>+        if (isLetDeclaration) {
>+            ScopeRef newScope = pushScope();
>+            newScope->setIsLexicalScope();
>+            newScope->preventVarDeclarations();
>+            lexicalScope.setIsValid(newScope, this);
>+        }
>+
>         TreeDeconstructionPattern forInTarget = 0;
>         TreeExpression forInInitializer = 0;
>         m_allowsIn = false;
>         JSTextPosition initStart;
>         JSTextPosition initEnd;
>-        decls = parseVarDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext);
>+        decls = parseVariableDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext, isVarDeclaraton ? VarDeclaration : LexicalDeclaration);
>         m_allowsIn = true;
>         propagateError();
> 
>@@ -881,16 +923,21 @@ template <class TreeBuilder> TreeStateme
>         TreeStatement statement = parseStatement(context, unused);
>         endLoop();
>         failIfFalse(statement, "Expected statement as body of for-", isOfEnumeration ? "of" : "in", " statement");
>+        gatherLexicalVariablesIfNecessary();
>+        TreeStatement result;
>         if (isOfEnumeration)
>-            return context.createForOfLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine);
>-        return context.createForInLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine);
>+            result = context.createForOfLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables);
>+        else
>+            result = context.createForInLoop(location, forInTarget, expr, statement, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables);
>+        popLexicalScopeIfNecessary();
>+        return result;
>     }
>     
>     if (!match(SEMICOLON)) {
>         if (match(OPENBRACE) || match(OPENBRACKET)) {
>             SavePoint savePoint = createSavePoint();
>             declsStart = tokenStartPosition();
>-            pattern = tryParseDeconstructionPatternExpression(context);
>+            pattern = tryParseDeconstructionPatternExpression(context, BindingNode::DoesNotNeedTDZCheck);
>             declsEnd = lastTokenEndPosition();
>             if (pattern && (match(INTOKEN) || (match(IDENT) && *m_token.m_data.ident == m_vm->propertyNames->of)))
>                 goto enumerationLoop;
>@@ -929,10 +976,13 @@ template <class TreeBuilder> TreeStateme
>         TreeStatement statement = parseStatement(context, unused);
>         endLoop();
>         failIfFalse(statement, "Expected a statement as the body of a for loop");
>-        return context.createForLoop(location, decls, condition, increment, statement, startLine, endLine);
>+        gatherLexicalVariablesIfNecessary();
>+        TreeStatement result = context.createForLoop(location, decls, condition, increment, statement, startLine, endLine, *lexicalVariables);
>+        popLexicalScopeIfNecessary();
>+        return result;
>     }
>     
>-    // For-in loop
>+    // For-in and For-of loop
> enumerationLoop:
>     failIfFalse(nonLHSCount == m_nonLHSCount, "Expected a reference on the left hand side of an enumeration statement");
>     bool isOfEnumeration = false;
>@@ -952,15 +1002,24 @@ enumerationLoop:
>     TreeStatement statement = parseStatement(context, unused);
>     endLoop();
>     failIfFalse(statement, "Expected a statement as the body of a for-", isOfEnumeration ? "of" : "in", "loop");
>+    gatherLexicalVariablesIfNecessary();
>+    TreeStatement result;
>     if (pattern) {
>         ASSERT(!decls);
>         if (isOfEnumeration)
>-            return context.createForOfLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>-        return context.createForInLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>+            result = context.createForOfLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);
>+        else 
>+            result = context.createForInLoop(location, pattern, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);
>+
>+        popLexicalScopeIfNecessary();
>+        return result;
>     }
>     if (isOfEnumeration)
>-        return context.createForOfLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>-    return context.createForInLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
>+        result = context.createForOfLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);
>+    else
>+        result = context.createForInLoop(location, decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);
>+    popLexicalScopeIfNecessary();
>+    return result;
> }
> 
> template <typename LexerType>
>@@ -976,7 +1035,7 @@ template <class TreeBuilder> TreeStateme
>         semanticFailIfFalse(breakIsValid(), "'break' is only valid inside a switch or loop statement");
>         return context.createBreakStatement(location, &m_vm->propertyNames->nullIdentifier, start, end);
>     }
>-    matchOrFail(IDENT, "Expected an identifier as the target for a break statement");
>+    failIfFalse(match(IDENT) || isLETMaskedAsIDENT(), "Expected an identifier as the target for a break statement");
>     const Identifier* ident = m_token.m_data.ident;
>     semanticFailIfFalse(getLabel(ident), "Cannot use the undeclared label '", ident->impl(), "'");
>     end = tokenEndPosition();
>@@ -998,7 +1057,7 @@ template <class TreeBuilder> TreeStateme
>         semanticFailIfFalse(continueIsValid(), "'continue' is only valid inside a loop statement");
>         return context.createContinueStatement(location, &m_vm->propertyNames->nullIdentifier, start, end);
>     }
>-    matchOrFail(IDENT, "Expected an identifier as the target for a continue statement");
>+    failIfFalse(match(IDENT) || isLETMaskedAsIDENT(), "Expected an identifier as the target for a continue statement");
>     const Identifier* ident = m_token.m_data.ident;
>     ScopeLabelInfo* label = getLabel(ident);
>     semanticFailIfFalse(label, "Cannot use the undeclared label '", ident->impl(), "'");
>@@ -1092,6 +1151,9 @@ template <class TreeBuilder> TreeStateme
>     
>     handleProductionOrFail(CLOSEPAREN, ")", "end", "subject of a 'switch'");
>     handleProductionOrFail(OPENBRACE, "{", "start", "body of a 'switch'");
>+    AutoPopScopeRef lexicalScope(this, pushScope());
>+    lexicalScope->setIsLexicalScope();
>+    lexicalScope->preventVarDeclarations();
>     startSwitch();
>     TreeClauseList firstClauses = parseSwitchClauses(context);
>     propagateError();
>@@ -1104,8 +1166,9 @@ template <class TreeBuilder> TreeStateme
>     endSwitch();
>     handleProductionOrFail(CLOSEBRACE, "}", "end", "body of a 'switch'");
>     
>-    return context.createSwitchStatement(location, expr, firstClauses, defaultClause, secondClauses, startLine, endLine);
>-    
>+    TreeStatement result = context.createSwitchStatement(location, expr, firstClauses, defaultClause, secondClauses, startLine, endLine, lexicalScope->finalizeLexicalEnvironment());
>+    popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
>+    return result;
> }
> 
> template <typename LexerType>
>@@ -1177,7 +1240,7 @@ template <class TreeBuilder> TreeStateme
>         next();
>         
>         handleProductionOrFail(OPENPAREN, "(", "start", "'catch' target");
>-        if (!match(IDENT)) {
>+        if (!(match(IDENT) || isLETMaskedAsIDENT())) {
>             semanticFailureDueToKeyword("catch variable name");
>             failWithMessage("Expected identifier name as catch target");
>         }
>@@ -1185,12 +1248,12 @@ template <class TreeBuilder> TreeStateme
>         next();
>         AutoPopScopeRef catchScope(this, pushScope());
>         failIfFalseIfStrict(declareVariable(ident), "Cannot declare a catch variable named '", ident->impl(), "' in strict mode");
>-        catchScope->preventNewDecls();
>+        catchScope->preventAllVariableDeclarations();
>         handleProductionOrFail(CLOSEPAREN, ")", "end", "'catch' target");
>         matchOrFail(OPENBRACE, "Expected exception handler to be a block statement");
>         catchBlock = parseBlockStatement(context);
>         failIfFalse(catchBlock, "Unable to parse 'catch' block");
>-        failIfFalse(popScope(catchScope, TreeBuilder::NeedsFreeVariableInfo), "Parse error");
>+        popScope(catchScope, TreeBuilder::NeedsFreeVariableInfo);
>     }
>     
>     if (match(FINALLY)) {
>@@ -1221,16 +1284,30 @@ template <typename LexerType>
> template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBlockStatement(TreeBuilder& context)
> {
>     ASSERT(match(OPENBRACE));
>+
>+    // We should treat the first block statement of the function (the body of the function) as the lexical 
>+    // scope of the function itself, and not the lexical scope of a 'block' statement within the function.
>+    AutoCleanupLexicalScope lexicalScope;
>+    bool shouldPushLexicalScope = m_statementDepth > 0;
>+    if (shouldPushLexicalScope) {
>+        ScopeRef newScope = pushScope();
>+        newScope->setIsLexicalScope();
>+        newScope->preventVarDeclarations();
>+        lexicalScope.setIsValid(newScope, this);
>+    }
>     JSTokenLocation location(tokenLocation());
>     int startOffset = m_token.m_data.offset;
>     int start = tokenLine();
>+    VariableEnvironment dummyIdentifierSet;
>     next();
>     if (match(CLOSEBRACE)) {
>         int endOffset = m_token.m_data.offset;
>         next();
>-        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line);
>+        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->finalizeLexicalEnvironment() : dummyIdentifierSet);
>         context.setStartOffset(result, startOffset);
>         context.setEndOffset(result, endOffset);
>+        if (shouldPushLexicalScope)
>+            popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
>         return result;
>     }
>     TreeSourceElements subtree = parseSourceElements(context, DontCheckForStrictMode, StandardFunctionParseType);
>@@ -1238,9 +1315,12 @@ template <class TreeBuilder> TreeStateme
>     matchOrFail(CLOSEBRACE, "Expected a closing '}' at the end of a block statement");
>     int endOffset = m_token.m_data.offset;
>     next();
>-    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line);
>+    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->finalizeLexicalEnvironment() : dummyIdentifierSet);
>     context.setStartOffset(result, startOffset);
>     context.setEndOffset(result, endOffset);
>+    if (shouldPushLexicalScope)
>+        popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
>+
>     return result;
> }
> 
>@@ -1261,7 +1341,7 @@ template <class TreeBuilder> TreeStateme
>         shouldSetEndOffset = false;
>         break;
>     case VAR:
>-        result = parseVarDeclaration(context);
>+        result = parseVariableDeclaration(context, VarDeclaration);
>         break;
>     case CONSTTOKEN:
>         result = parseConstDeclaration(context);
>@@ -1324,6 +1404,12 @@ template <class TreeBuilder> TreeStateme
>     case DEFAULT:
>         // These tokens imply the end of a set of source elements
>         return 0;
>+    case LET:
>+        if (strictMode()) {
>+            result = parseVariableDeclaration(context, LexicalDeclaration);
>+            break;
>+        }
>+        FALLTHROUGH;
>     case IDENT:
>         result = parseExpressionOrLabelStatement(context);
>         break;
>@@ -1477,7 +1563,7 @@ template <class TreeBuilder> bool Parser
>     
>     switch (parseType) {
>     case StandardFunctionParseType: {
>-        if (match(IDENT)) {
>+        if (match(IDENT) || isLETMaskedAsIDENT()) {
>             info.name = m_token.m_data.ident;
>             m_lastFunctionName = info.name;
>             next();
>@@ -1565,7 +1651,7 @@ template <class TreeBuilder> bool Parser
>             cachedInfo->strictMode, constructorKind);
>         
>         functionScope->restoreFromSourceProviderCache(cachedInfo);
>-        failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>+        popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo);
>         
>         m_token = cachedInfo->endFunctionToken();
>         
>@@ -1673,7 +1759,7 @@ template <class TreeBuilder> bool Parser
>         newInfo = SourceProviderCacheItem::create(parameters);
>     }
>     
>-    failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>+    popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo);
>     
> #if ENABLE(ES6_ARROWFUNCTION_SYNTAX)
>     if (info.functionBodyType == ArrowFunctionBodyExpression)
>@@ -1851,7 +1937,7 @@ template <class TreeBuilder> TreeClassEx
>         }
>     }
> 
>-    failIfFalse(popScope(classScope, TreeBuilder::NeedsFreeVariableInfo), "Parser error");
>+    popScope(classScope, TreeBuilder::NeedsFreeVariableInfo);
>     consumeOrFail(CLOSEBRACE, "Expected a closing '}' after a class body");
> 
>     return context.createClassExpr(location, *className, constructor, parentClass, instanceMethods, staticMethods);
>@@ -1905,7 +1991,7 @@ template <class TreeBuilder> TreeStateme
>             failIfTrue(getLabel(ident), "Cannot find scope for the label '", ident->impl(), "'");
>             labels.append(LabelInfo(ident, start, end));
>         }
>-    } while (match(IDENT));
>+    } while (match(IDENT) || isLETMaskedAsIDENT());
>     bool isLoop = false;
>     switch (m_token.m_type) {
>     case FOR:
>@@ -1918,6 +2004,7 @@ template <class TreeBuilder> TreeStateme
>         break;
>     }
>     const Identifier* unused = 0;
>+    ScopeRef labelScope = currentScope();
>     if (!m_syntaxAlreadyValidated) {
>         for (size_t i = 0; i < labels.size(); i++)
>             pushLabel(labels[i].m_ident, isLoop);
>@@ -1925,7 +2012,7 @@ template <class TreeBuilder> TreeStateme
>     TreeStatement statement = parseStatement(context, unused);
>     if (!m_syntaxAlreadyValidated) {
>         for (size_t i = 0; i < labels.size(); i++)
>-            popLabel();
>+            popLabel(labelScope);
>     }
>     failIfFalse(statement, "Cannot parse statement");
>     for (size_t i = 0; i < labels.size(); i++) {
>@@ -2074,7 +2161,7 @@ template <typename TreeBuilder> TreeExpr
>     int initialNonLHSCount = m_nonLHSCount;
>     if (match(OPENBRACE) || match(OPENBRACKET)) {
>         SavePoint savePoint = createSavePoint();
>-        auto pattern = tryParseDeconstructionPatternExpression(context);
>+        auto pattern = tryParseDeconstructionPatternExpression(context, BindingNode::DoesNeedTDZCheck);
>         if (pattern && consume(EQUAL)) {
>             auto rhs = parseAssignmentExpression(context);
>             if (rhs)
>@@ -2236,6 +2323,8 @@ template <class TreeBuilder> TreePropert
>     bool wasIdent = false;
>     switch (m_token.m_type) {
>     namedProperty:
>+    case LET:
>+        FALLTHROUGH;
>     case IDENT:
>         wasIdent = true;
>         FALLTHROUGH;
>@@ -2655,6 +2744,7 @@ template <class TreeBuilder> TreeExpress
>         return context.thisExpr(location, m_thisTDZMode);
>     }
>     case IDENT: {
>+    identifierExpression:
>         JSTextPosition start = tokenStartPosition();
>         const Identifier* ident = m_token.m_data.ident;
>         JSTokenLocation location(tokenLocation());
>@@ -2720,6 +2810,11 @@ template <class TreeBuilder> TreeExpress
>     case TEMPLATE:
>         return parseTemplateLiteral(context, LexerType::RawStringsBuildMode::DontBuildRawStrings);
> #endif
>+    case LET: {
>+        if (!strictMode())
>+            goto identifierExpression;
>+        FALLTHROUGH;
>+    }
>     default:
>         failDueToUnexpectedToken();
>     }
>Index: Source/JavaScriptCore/parser/Parser.h
>===================================================================
>--- Source/JavaScriptCore/parser/Parser.h	(revision 186105)
>+++ Source/JavaScriptCore/parser/Parser.h	(working copy)
>@@ -36,6 +36,7 @@
> #include "SourceProvider.h"
> #include "SourceProviderCache.h"
> #include "SourceProviderCacheItem.h"
>+#include "VariableEnvironment.h"
> #include <wtf/Forward.h>
> #include <wtf/Noncopyable.h>
> #include <wtf/RefPtr.h>
>@@ -97,6 +98,7 @@ enum FunctionParseMode {
> };
> enum DeconstructionKind {
>     DeconstructToVariables,
>+    DeconstructToLexicalVariables,
>     DeconstructToParameters,
>     DeconstructToExpressions
> };
>@@ -117,9 +119,11 @@ struct Scope {
>         , m_needsFullActivation(false)
>         , m_hasDirectSuper(false)
>         , m_needsSuperBinding(false)
>-        , m_allowsNewDecls(true)
>+        , m_allowsVarDeclarations(true)
>+        , m_allowsLexicalDeclarations(true)
>         , m_strictMode(strictMode)
>         , m_isFunction(isFunction)
>+        , m_isLexicalScope(false)
>         , m_isFunctionBoundary(false)
>         , m_isValidStrictMode(true)
>         , m_loopDepth(0)
>@@ -134,9 +138,11 @@ struct Scope {
>         , m_needsFullActivation(rhs.m_needsFullActivation)
>         , m_hasDirectSuper(rhs.m_hasDirectSuper)
>         , m_needsSuperBinding(rhs.m_needsSuperBinding)
>-        , m_allowsNewDecls(rhs.m_allowsNewDecls)
>+        , m_allowsVarDeclarations(rhs.m_allowsVarDeclarations)
>+        , m_allowsLexicalDeclarations(rhs.m_allowsLexicalDeclarations)
>         , m_strictMode(rhs.m_strictMode)
>         , m_isFunction(rhs.m_isFunction)
>+        , m_isLexicalScope(rhs.m_isLexicalScope)
>         , m_isFunctionBoundary(rhs.m_isFunctionBoundary)
>         , m_isValidStrictMode(rhs.m_isValidStrictMode)
>         , m_loopDepth(rhs.m_loopDepth)
>@@ -189,9 +195,49 @@ struct Scope {
>     {
>         m_isFunction = true;
>         m_isFunctionBoundary = true;
>+        setIsLexicalScope();
>+    }
>+
>+    bool isFunction() const { return m_isFunction; }
>+    bool isFunctionBoundary() const { return m_isFunctionBoundary; }
>+
>+    void setIsLexicalScope() 
>+    { 
>+        m_isLexicalScope = true;
>+        m_allowsLexicalDeclarations = true;
>+    }
>+    bool isLexicalScope() { return m_isLexicalScope; }
>+
>+    VariableEnvironment& finalizeLexicalEnvironment() 
>+    { 
>+        if (m_usesEval)
>+            m_lexicalVariables.markAllVariablesAsCaptured();
>+        else
>+            computeLexicallyCapturedVariablesAndPurgeCandidates();
>+
>+        return m_lexicalVariables;
>+    }
>+
>+    void computeLexicallyCapturedVariablesAndPurgeCandidates()
>+    {
>+        // Because variables may be defined at any time in the range of a lexical scope, we must
>+        // track lexical variables that might be captured. Then, when we're preparing to pop the top
>+        // lexical scope off the stack, we should find which variables are truly captured, and which
>+        // variable still may be captured in a parent scope.
>+        if (m_lexicalVariables.size() && m_closedVariableCandidates.size()) {
>+            auto end = m_closedVariableCandidates.end();
>+            for (auto iter = m_closedVariableCandidates.begin(); iter != end; ++iter)
>+                m_lexicalVariables.markVariableAsCapturedIfDefined(*iter);
>+        }
>+
>+        // We can now purge values from the captured candidates because they're captured in this scope.
>+        {
>+            for (auto entry : m_lexicalVariables) {
>+                if (entry.value.isCaptured())
>+                    m_closedVariableCandidates.remove(entry.key);
>+            }
>+        }
>     }
>-    bool isFunction() { return m_isFunction; }
>-    bool isFunctionBoundary() { return m_isFunctionBoundary; }
> 
>     void declareCallee(const Identifier* ident)
>     {
>@@ -206,15 +252,39 @@ struct Scope {
>         return isValidStrictMode;
>     }
> 
>+    bool declareLexicalVariable(const Identifier* ident)
>+    {
>+        bool isValidStrictMode = m_vm->propertyNames->eval != *ident && m_vm->propertyNames->arguments != *ident;
>+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
>+        auto addResult = m_lexicalVariables.add(ident->impl());
>+        bool successfulDeclaration = addResult.isNewEntry && isValidStrictMode;
>+        return successfulDeclaration;
>+    }
>+
>     bool hasDeclaredVariable(const Identifier& ident)
>     {
>         return m_declaredVariables.contains(ident.impl());
>     }
>+
>+    bool hasDeclaredVariable(const RefPtr<UniquedStringImpl>& ident)
>+    {
>+        return m_declaredVariables.contains(ident);
>+    }
>+
>+    bool hasLexicallyDeclaredVariable(const RefPtr<UniquedStringImpl>& ident) const
>+    {
>+        return m_lexicalVariables.contains(ident);
>+    }
>     
>     bool hasDeclaredParameter(const Identifier& ident)
>     {
>         return m_declaredParameters.contains(ident.impl()) || m_declaredVariables.contains(ident.impl());
>     }
>+
>+    bool hasDeclaredParameter(const RefPtr<UniquedStringImpl>& ident)
>+    {
>+        return m_declaredParameters.contains(ident) || m_declaredVariables.contains(ident);
>+    }
>     
>     void declareWrite(const Identifier* ident)
>     {
>@@ -222,8 +292,14 @@ struct Scope {
>         m_writtenVariables.add(ident->impl());
>     }
> 
>-    void preventNewDecls() { m_allowsNewDecls = false; }
>-    bool allowsNewDecls() const { return m_allowsNewDecls; }
>+    void preventAllVariableDeclarations()
>+    {
>+        m_allowsVarDeclarations = false; 
>+        m_allowsLexicalDeclarations = false;
>+    }
>+    void preventVarDeclarations() { m_allowsVarDeclarations = false; }
>+    bool allowsVarDeclarations() const { return m_allowsVarDeclarations; }
>+    bool allowsLexicalDeclarations() const { return m_allowsLexicalDeclarations; }
> 
>     bool declareParameter(const Identifier* ident)
>     {
>@@ -268,6 +344,7 @@ struct Scope {
>     }
> 
>     void setNeedsFullActivation() { m_needsFullActivation = true; }
>+    bool needsFullActivation() const { return m_needsFullActivation; }
> 
> #if ENABLE(ES6_CLASS_SYNTAX)
>     bool hasDirectSuper() { return m_hasDirectSuper; }
>@@ -283,38 +360,50 @@ struct Scope {
> #endif
>     void setNeedsSuperBinding() { m_needsSuperBinding = true; }
> 
>-    bool collectFreeVariables(Scope* nestedScope, bool shouldTrackClosedVariables)
>+    void collectFreeVariables(Scope* nestedScope, bool shouldTrackClosedVariables)
>     {
>         if (nestedScope->m_usesEval)
>             m_usesEval = true;
>-        IdentifierSet::iterator end = nestedScope->m_usedVariables.end();
>-        for (IdentifierSet::iterator ptr = nestedScope->m_usedVariables.begin(); ptr != end; ++ptr) {
>-            if (nestedScope->m_declaredVariables.contains(*ptr))
>-                continue;
>-            m_usedVariables.add(*ptr);
>-            if (shouldTrackClosedVariables)
>-                m_closedVariables.add(*ptr);
>+
>+        {
>+            IdentifierSet::iterator end = nestedScope->m_usedVariables.end();
>+            for (IdentifierSet::iterator ptr = nestedScope->m_usedVariables.begin(); ptr != end; ++ptr) {
>+                if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicalVariables.contains(*ptr))
>+                    continue;
>+                m_usedVariables.add(*ptr);
>+                // We don't want a declared variable that is used in an inner scope to be thought of as captured if
>+                // that inner scope is both a lexical scope and not a function. Only inner functions and "catch" 
>+                // statements can cause variables to be captured.
>+                if (shouldTrackClosedVariables && (nestedScope->m_isFunctionBoundary || !nestedScope->m_isLexicalScope))
>+                    m_closedVariableCandidates.add(*ptr);
>+            }
>+        }
>+        // Propagate closed variable candidates downwards within the same function.
>+        // Cross function captures will be realized via m_usedVariables propagation.
>+        if (shouldTrackClosedVariables && !nestedScope->m_isFunctionBoundary && nestedScope->m_closedVariableCandidates.size()) {
>+            IdentifierSet::iterator end = nestedScope->m_closedVariableCandidates.end();
>+            IdentifierSet::iterator begin = nestedScope->m_closedVariableCandidates.begin();
>+            m_closedVariableCandidates.add(begin, end);
>         }
>+
>         if (nestedScope->m_writtenVariables.size()) {
>             IdentifierSet::iterator end = nestedScope->m_writtenVariables.end();
>             for (IdentifierSet::iterator ptr = nestedScope->m_writtenVariables.begin(); ptr != end; ++ptr) {
>-                if (nestedScope->m_declaredVariables.contains(*ptr))
>+                if (nestedScope->m_declaredVariables.contains(*ptr) || nestedScope->m_lexicalVariables.contains(*ptr))
>                     continue;
>                 m_writtenVariables.add(*ptr);
>             }
>         }
>-
>-        return true;
>     }
>-
>-    void getCapturedVariables(IdentifierSet& capturedVariables, bool& modifiedParameter, bool& modifiedArguments)
>+    
>+    void getCapturedVars(IdentifierSet& capturedVariables, bool& modifiedParameter, bool& modifiedArguments)
>     {
>         if (m_needsFullActivation || m_usesEval) {
>             modifiedParameter = true;
>             capturedVariables.swap(m_declaredVariables);
>             return;
>         }
>-        for (IdentifierSet::iterator ptr = m_closedVariables.begin(); ptr != m_closedVariables.end(); ++ptr) {
>+        for (IdentifierSet::iterator ptr = m_closedVariableCandidates.begin(); ptr != m_closedVariableCandidates.end(); ++ptr) {
>             if (!m_declaredVariables.contains(*ptr))
>                 continue;
>             capturedVariables.add(*ptr);
>@@ -343,7 +432,7 @@ struct Scope {
>     {
>         IdentifierSet::iterator end = capturedVariables.end();
>         for (IdentifierSet::iterator it = capturedVariables.begin(); it != end; ++it) {
>-            if (m_declaredVariables.contains(*it))
>+            if (m_declaredVariables.contains(*it) || m_lexicalVariables.contains(*it))
>                 continue;
>             vector.append(*it);
>         }
>@@ -378,9 +467,11 @@ private:
>     bool m_needsFullActivation : 1;
>     bool m_hasDirectSuper : 1;
>     bool m_needsSuperBinding : 1;
>-    bool m_allowsNewDecls : 1;
>+    bool m_allowsVarDeclarations : 1;
>+    bool m_allowsLexicalDeclarations : 1;
>     bool m_strictMode : 1;
>     bool m_isFunction : 1;
>+    bool m_isLexicalScope : 1;
>     bool m_isFunctionBoundary : 1;
>     bool m_isValidStrictMode : 1;
>     int m_loopDepth;
>@@ -390,8 +481,9 @@ private:
>     std::unique_ptr<LabelStack> m_labels;
>     IdentifierSet m_declaredParameters;
>     IdentifierSet m_declaredVariables;
>+    VariableEnvironment m_lexicalVariables;
>     IdentifierSet m_usedVariables;
>-    IdentifierSet m_closedVariables;
>+    IdentifierSet m_closedVariableCandidates;
>     IdentifierSet m_writtenVariables;
> };
> 
>@@ -442,6 +534,7 @@ public:
>     Vector<RefPtr<UniquedStringImpl>>&& closedVariables() { return WTF::move(m_closedVariables); }
> 
> private:
>+
>     struct AllowInOverride {
>         AllowInOverride(Parser* parser)
>             : m_parser(parser)
>@@ -479,6 +572,47 @@ private:
>         Parser* m_parser;
>     };
> 
>+    struct AutoCleanupLexicalScope {
>+        // We can allocate this object on the stack without actually knowing beforehand if we're 
>+        // going to create a new lexical scope. If we decide to create a new lexical scope, we
>+        // can pass the scope into this obejct and it will take care of the cleanup for us if the parse fails.
>+        // This is helpful if we may fail from syntax errors after creating a lexical scope conditionally.
>+        AutoCleanupLexicalScope()
>+            : m_scope(nullptr, UINT_MAX)
>+            , m_parser(nullptr)
>+        {
>+        }
>+
>+        ~AutoCleanupLexicalScope()
>+        {
>+            // This should only ever be called if we fail from a syntax error. Otherwise
>+            // it's the intention that a user of this class pops this scope manually on a 
>+            // successful parse. 
>+            if (isValid())
>+                m_parser->popScope(*this, false);
>+        }
>+
>+        void setIsValid(ScopeRef& scope, Parser* parser)
>+        {
>+            RELEASE_ASSERT(scope->isLexicalScope());
>+            m_scope = scope;
>+            m_parser = parser;
>+        }
>+
>+        bool isValid() const { return !!m_parser; }
>+
>+        void setPopped()
>+        {
>+            m_parser = nullptr;
>+        }
>+
>+        ScopeRef& scope() { return m_scope; }
>+
>+    private:
>+        ScopeRef m_scope;
>+        Parser* m_parser;
>+    };
>+
>     ScopeRef currentScope()
>     {
>         return ScopeRef(&m_scopeStack, m_scopeStack.size() - 1);
>@@ -496,53 +630,80 @@ private:
>         return currentScope();
>     }
>     
>-    bool popScopeInternal(ScopeRef& scope, bool shouldTrackClosedVariables)
>+    void popScopeInternal(ScopeRef& scope, bool shouldTrackClosedVariables)
>     {
>         ASSERT_UNUSED(scope, scope.index() == m_scopeStack.size() - 1);
>         ASSERT(m_scopeStack.size() > 1);
>-        bool result = m_scopeStack[m_scopeStack.size() - 2].collectFreeVariables(&m_scopeStack.last(), shouldTrackClosedVariables);
>+        m_scopeStack[m_scopeStack.size() - 2].collectFreeVariables(&m_scopeStack.last(), shouldTrackClosedVariables);
>+        if (!m_scopeStack.last().isFunctionBoundary() && m_scopeStack.last().needsFullActivation())
>+            m_scopeStack[m_scopeStack.size() - 2].setNeedsFullActivation();
>         m_scopeStack.removeLast();
>-        return result;
>     }
>     
>-    bool popScope(ScopeRef& scope, bool shouldTrackClosedVariables)
>+    ALWAYS_INLINE void popScope(ScopeRef& scope, bool shouldTrackClosedVariables)
>     {
>-        return popScopeInternal(scope, shouldTrackClosedVariables);
>+        popScopeInternal(scope, shouldTrackClosedVariables);
>     }
>     
>-    bool popScope(AutoPopScopeRef& scope, bool shouldTrackClosedVariables)
>+    ALWAYS_INLINE void popScope(AutoPopScopeRef& scope, bool shouldTrackClosedVariables)
>     {
>         scope.setPopped();
>-        return popScopeInternal(scope, shouldTrackClosedVariables);
>+        popScopeInternal(scope, shouldTrackClosedVariables);
>+    }
>+
>+    ALWAYS_INLINE void popScope(AutoCleanupLexicalScope& cleanupScope, bool shouldTrackClosedVariables)
>+    {
>+        RELEASE_ASSERT(cleanupScope.isValid());
>+        ScopeRef& scope = cleanupScope.scope();
>+        cleanupScope.setPopped();
>+        popScopeInternal(scope, shouldTrackClosedVariables);
>     }
>     
>-    bool declareVariable(const Identifier* ident)
>+    enum DeclarationType { VarDeclaration, LexicalDeclaration };
>+    bool declareVariable(const Identifier* ident, typename Parser::DeclarationType type = VarDeclaration)
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+
>+        if (type == VarDeclaration) {
>+            while (!m_scopeStack[i].allowsVarDeclarations()) {
>+                i--;
>+                ASSERT(i < m_scopeStack.size());
>+            }
>+
>+            return m_scopeStack[i].declareVariable(ident);
>+        }
>+
>+        ASSERT(type == LexicalDeclaration);
>+
>+        // Lexical variables declared at a top level scope that shadow arguments or vars are not allowed.
>+        if (m_statementDepth == 1 && (hasDeclaredParameter(*ident) || hasDeclaredVariable(*ident)))
>+            return false;
>+
>+        while (!m_scopeStack[i].allowsLexicalDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>-        return m_scopeStack[i].declareVariable(ident);
>+
>+        return m_scopeStack[i].declareLexicalVariable(ident);
>     }
>     
>     NEVER_INLINE bool hasDeclaredVariable(const Identifier& ident)
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+        while (!m_scopeStack[i].allowsVarDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>         return m_scopeStack[i].hasDeclaredVariable(ident);
>     }
>-    
>+
>     NEVER_INLINE bool hasDeclaredParameter(const Identifier& ident)
>     {
>         unsigned i = m_scopeStack.size() - 1;
>         ASSERT(i < m_scopeStack.size());
>-        while (!m_scopeStack[i].allowsNewDecls()) {
>+        while (!m_scopeStack[i].allowsVarDeclarations()) {
>             i--;
>             ASSERT(i < m_scopeStack.size());
>         }
>@@ -554,7 +715,7 @@ private:
>         if (!m_syntaxAlreadyValidated || strictMode())
>             m_scopeStack.last().declareWrite(ident);
>     }
>-    
>+
>     ScopeStack m_scopeStack;
>     
>     const SourceProviderCacheItem* findCachedFunctionInfo(int openBracePos) 
>@@ -753,7 +914,7 @@ private:
>         return true;
>     }
>     void pushLabel(const Identifier* label, bool isLoop) { currentScope()->pushLabel(label, isLoop); }
>-    void popLabel() { currentScope()->popLabel(); }
>+    void popLabel(ScopeRef scope) { scope->popLabel(); }
>     ScopeLabelInfo* getLabel(const Identifier* label)
>     {
>         ScopeRef current = currentScope();
>@@ -766,13 +927,18 @@ private:
>         return result;
>     }
> 
>+    ALWAYS_INLINE bool isLETMaskedAsIDENT()
>+    {
>+        return match(LET) && !strictMode();
>+    }
>+
>     template <class TreeBuilder> TreeSourceElements parseSourceElements(TreeBuilder&, SourceElementsMode, FunctionParseType);
>     template <class TreeBuilder> TreeStatement parseStatement(TreeBuilder&, const Identifier*& directive, unsigned* directiveLiteralLength = 0);
> #if ENABLE(ES6_CLASS_SYNTAX)
>     template <class TreeBuilder> TreeStatement parseClassDeclaration(TreeBuilder&);
> #endif
>     template <class TreeBuilder> TreeStatement parseFunctionDeclaration(TreeBuilder&);
>-    template <class TreeBuilder> TreeStatement parseVarDeclaration(TreeBuilder&);
>+    template <class TreeBuilder> TreeStatement parseVariableDeclaration(TreeBuilder&, DeclarationType);
>     template <class TreeBuilder> TreeStatement parseConstDeclaration(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseDoWhileStatement(TreeBuilder&);
>     template <class TreeBuilder> TreeStatement parseWhileStatement(TreeBuilder&);
>@@ -809,7 +975,7 @@ private:
>     template <class TreeBuilder> ALWAYS_INLINE TreeFunctionBody parseFunctionBody(TreeBuilder&, int functionKeywordStart, int functionNameStart, int parametersStart, ConstructorKind, FunctionParseType);
>     template <class TreeBuilder> ALWAYS_INLINE TreeFormalParameterList parseFormalParameters(TreeBuilder&);
>     enum VarDeclarationListContext { ForLoopContext, VarDeclarationContext };
>-    template <class TreeBuilder> TreeExpression parseVarDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext);
>+    template <class TreeBuilder> TreeExpression parseVariableDeclarationList(TreeBuilder&, int& declarations, TreeDeconstructionPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext, DeclarationType);
>     template <class TreeBuilder> NEVER_INLINE TreeConstDeclList parseConstDeclarationList(TreeBuilder&);
> 
> #if ENABLE(ES6_ARROWFUNCTION_SYNTAX)
>@@ -817,9 +983,9 @@ private:
>     template <class TreeBuilder> TreeExpression parseArrowFunctionExpression(TreeBuilder&);
> #endif
> 
>-    template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern createBindingPattern(TreeBuilder&, DeconstructionKind, const Identifier&, int depth, JSToken);
>-    template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern parseDeconstructionPattern(TreeBuilder&, DeconstructionKind, int depth = 0);
>-    template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern tryParseDeconstructionPatternExpression(TreeBuilder&);
>+    template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern createBindingPattern(TreeBuilder&, DeconstructionKind, const Identifier&, int depth, JSToken, BindingNode::BindingContext);
>+    template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern parseDeconstructionPattern(TreeBuilder&, DeconstructionKind, BindingNode::BindingContext = BindingNode::DoesNotNeedTDZCheck, int depth = 0);
>+    template <class TreeBuilder> NEVER_INLINE TreeDeconstructionPattern tryParseDeconstructionPatternExpression(TreeBuilder&, BindingNode::BindingContext);
>     template <class TreeBuilder> NEVER_INLINE TreeExpression parseDefaultValueForDeconstructionPattern(TreeBuilder&);
> 
>     template <class TreeBuilder> NEVER_INLINE bool parseFunctionInfo(TreeBuilder&, FunctionRequirements, FunctionParseMode, bool nameIsInContainingScope, ConstructorKind, SuperBinding, int functionKeywordStart, ParserFunctionInfo<TreeBuilder>&, FunctionParseType);
>@@ -919,9 +1085,9 @@ private:
>         m_assignmentCount = state.assignmentCount;
>         m_nonLHSCount = state.nonLHSCount;
>         m_nonTrivialExpressionCount = state.nonTrivialExpressionCount;
>-        
>+
>     }
>-    
>+
> 
>     VM* m_vm;
>     const SourceCode* m_source;
>@@ -1020,6 +1186,7 @@ std::unique_ptr<ParsedNode> Parser<Lexer
>                                     m_varDeclarations,
>                                     m_funcDeclarations,
>                                     m_capturedVariables,
>+                                    currentScope()->finalizeLexicalEnvironment(),
>                                     *m_source,
>                                     m_features,
>                                     m_numConstants);
>Index: Source/JavaScriptCore/parser/ParserTokens.h
>===================================================================
>--- Source/JavaScriptCore/parser/ParserTokens.h	(revision 186105)
>+++ Source/JavaScriptCore/parser/ParserTokens.h	(working copy)
>@@ -57,6 +57,7 @@ enum JSTokenType {
>     FOR,
>     NEW,
>     VAR,
>+    LET,
>     CONSTTOKEN,
>     CONTINUE,
>     FUNCTION,
>Index: Source/JavaScriptCore/parser/SyntaxChecker.h
>===================================================================
>--- Source/JavaScriptCore/parser/SyntaxChecker.h	(revision 186105)
>+++ Source/JavaScriptCore/parser/SyntaxChecker.h	(working copy)
>@@ -172,8 +172,8 @@ public:
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int, int, int) { return NewExpr; }
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int) { return NewExpr; }
>     ExpressionType createConditionalExpr(const JSTokenLocation&, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
>-    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int) { return AssignmentExpr; }
>-    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&) { return AssignmentExpr; }
>+    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int, int) { return AssignmentExpr; }
>+    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&, unsigned) { return AssignmentExpr; }
> #if ENABLE(ES6_CLASS_SYNTAX)
>     ClassExpression createClassExpr(const JSTokenLocation&, const Identifier&, ExpressionType, ExpressionType, PropertyList, PropertyList) { return ClassExpr; }
> #endif
>@@ -230,22 +230,23 @@ public:
>     int createClassDeclStatement(const JSTokenLocation&, ClassExpression,
>         const JSTextPosition&, const JSTextPosition&, int, int) { return StatementResult; }
> #endif
>-    int createBlockStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createBlockStatement(const JSTokenLocation&, int, int, int, VariableEnvironment&) { return StatementResult; }
>     int createExprStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
>     int createIfStatement(const JSTokenLocation&, int, int, int, int, int) { return StatementResult; }
>-    int createForLoop(const JSTokenLocation&, int, int, int, int, int, int) { return StatementResult; }
>-    int createForInLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>-    int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int) { return StatementResult; }
>+    int createForLoop(const JSTokenLocation&, int, int, int, int, int, int, VariableEnvironment&) { return StatementResult; }
>+    int createForInLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int, VariableEnvironment&) { return StatementResult; }
>+    int createForOfLoop(const JSTokenLocation&, int, int, int, int, int, int, int, int, VariableEnvironment&) { return StatementResult; }
>     int createEmptyStatement(const JSTokenLocation&) { return StatementResult; }
>     int createVarStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>+    int createLetStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createReturnStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, int, int) { return StatementResult; }
>     int createBreakStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
>     int createContinueStatement(const JSTokenLocation&, int, int) { return StatementResult; }
>     int createContinueStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
>     int createTryStatement(const JSTokenLocation&, int, const Identifier*, int, int, int, int) { return StatementResult; }
>-    int createSwitchStatement(const JSTokenLocation&, int, int, int, int, int, int) { return StatementResult; }
>+    int createSwitchStatement(const JSTokenLocation&, int, int, int, int, int, int, VariableEnvironment&) { return StatementResult; }
>     int createWhileStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
>     int createWithStatement(const JSTokenLocation&, int, int, int, int, int, int) { return StatementResult; }
>     int createDoWhileStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
>@@ -328,7 +329,7 @@ public:
>     void appendObjectPatternEntry(ArrayPattern, const JSTokenLocation&, bool, const Identifier&, DeconstructionPattern, int)
>     {
>     }
>-    DeconstructionPattern createBindingLocation(const JSTokenLocation&, const Identifier&, const JSTextPosition&, const JSTextPosition&)
>+    DeconstructionPattern createBindingLocation(const JSTokenLocation&, const Identifier&, const JSTextPosition&, const JSTextPosition&, BindingNode::BindingContext)
>     {
>         return BindingDeconstruction;
>     }
>Index: Source/JavaScriptCore/parser/VariableEnvironment.cpp
>===================================================================
>--- Source/JavaScriptCore/parser/VariableEnvironment.cpp	(revision 0)
>+++ Source/JavaScriptCore/parser/VariableEnvironment.cpp	(working copy)
>@@ -0,0 +1,53 @@
>+/*
>+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "VariableEnvironment.h"
>+
>+namespace JSC {
>+
>+void VariableEnvironment::markVariableAsCapturedIfDefined(PassRefPtr<UniquedStringImpl> identifier)
>+{
>+    auto findResult = m_map.find(identifier);
>+    if (findResult != m_map.end())
>+        findResult->value.setIsCaptured();
>+}
>+
>+void VariableEnvironment::markAllVariablesAsCaptured()
>+{
>+    for (auto iter = m_map.begin(), end = m_map.end(); iter != end; ++iter)
>+        iter->value.setIsCaptured();
>+}
>+
>+bool VariableEnvironment::hasCapturedVariables() const
>+{
>+    for (auto entry : m_map) {
>+        if (entry.value.isCaptured())
>+            return true;
>+    }
>+    return false;
>+}
>+
>+} // namespace JSC
>Index: Source/JavaScriptCore/parser/VariableEnvironment.h
>===================================================================
>--- Source/JavaScriptCore/parser/VariableEnvironment.h	(revision 0)
>+++ Source/JavaScriptCore/parser/VariableEnvironment.h	(working copy)
>@@ -0,0 +1,79 @@
>+/*
>+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#ifndef VariableEnvironment_h
>+#define VariableEnvironment_h
>+
>+#include "Identifier.h"
>+#include <wtf/HashMap.h>
>+#include <wtf/text/UniquedStringImpl.h>
>+
>+namespace JSC {
>+
>+struct VariableEnvironmentEntry {
>+public:
>+    ALWAYS_INLINE bool isCaptured() { return m_bits & IsCaptured; }
>+    ALWAYS_INLINE bool isConstant() { return m_bits & IsConstant; }
>+    ALWAYS_INLINE void setIsCaptured() { m_bits |= IsCaptured; }
>+    ALWAYS_INLINE void setIsConstant() { m_bits |= IsConstant; }
>+private:
>+    enum Traits {
>+        IsCaptured = 1 << 0,
>+        IsConstant = 1 << 1,
>+    };
>+    uint8_t m_bits { 0 };
>+};
>+
>+struct VariableEnvironmentEntryHashTraits : HashTraits<VariableEnvironmentEntry> {
>+    static const bool needsDestruction = false;
>+};
>+
>+class VariableEnvironment {
>+private:
>+    typedef HashMap<RefPtr<UniquedStringImpl>, VariableEnvironmentEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> Map;
>+public:
>+    ALWAYS_INLINE Map::iterator begin() { return m_map.begin(); }
>+    ALWAYS_INLINE Map::iterator end() { return m_map.end(); }
>+    ALWAYS_INLINE Map::const_iterator begin() const { return m_map.begin(); }
>+    ALWAYS_INLINE Map::const_iterator end() const { return m_map.end(); }
>+    ALWAYS_INLINE Map::AddResult add(PassRefPtr<UniquedStringImpl> identifier)
>+    {
>+        return m_map.add(identifier, VariableEnvironmentEntry());
>+    }
>+    ALWAYS_INLINE unsigned size() const { return m_map.size(); }
>+    ALWAYS_INLINE bool contains(const RefPtr<UniquedStringImpl>& identifier) const { return m_map.contains(identifier); }
>+    void swap(VariableEnvironment& other) { m_map.swap(other.m_map); }
>+
>+    void markVariableAsCapturedIfDefined(PassRefPtr<UniquedStringImpl> identifier);
>+    void markAllVariablesAsCaptured();
>+    bool hasCapturedVariables() const;
>+
>+private:
>+    Map m_map;
>+};
>+
>+} // namespace JSC
>+
>+#endif // VariableEnvironment_h
>Index: Source/JavaScriptCore/runtime/CodeCache.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CodeCache.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/CodeCache.cpp	(working copy)
>@@ -76,7 +76,7 @@ template <> struct CacheTypes<UnlinkedEv
> 
> template <class UnlinkedCodeBlockType, class ExecutableType>
> UnlinkedCodeBlockType* CodeCache::getGlobalCodeBlock(VM& vm, ExecutableType* executable, const SourceCode& source, JSParserBuiltinMode builtinMode,
>-    JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
>+    JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error, const VariableEnvironment* variablesUnderTDZ)
> {
>     SourceCodeKey key = SourceCodeKey(source, String(), CacheTypes<UnlinkedCodeBlockType>::codeType, builtinMode, strictMode, thisTDZMode);
>     SourceCodeValue* cache = m_sourceCode.findCacheAndUpdateAge(key);
>@@ -109,7 +109,7 @@ UnlinkedCodeBlockType* CodeCache::getGlo
>     UnlinkedCodeBlockType* unlinkedCodeBlock = UnlinkedCodeBlockType::create(&vm, executable->executableInfo());
>     unlinkedCodeBlock->recordParse(rootNode->features(), rootNode->hasCapturedVariables(), rootNode->firstLine() - source.firstLine(), lineCount, unlinkedEndColumn);
> 
>-    auto generator = std::make_unique<BytecodeGenerator>(vm, rootNode.get(), unlinkedCodeBlock, debuggerMode, profilerMode);
>+    auto generator = std::make_unique<BytecodeGenerator>(vm, rootNode.get(), unlinkedCodeBlock, debuggerMode, profilerMode, variablesUnderTDZ);
>     error = generator->generate();
>     if (error.isValid())
>         return nullptr;
>@@ -123,12 +123,13 @@ UnlinkedCodeBlockType* CodeCache::getGlo
> 
> UnlinkedProgramCodeBlock* CodeCache::getProgramCodeBlock(VM& vm, ProgramExecutable* executable, const SourceCode& source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
> {
>-    return getGlobalCodeBlock<UnlinkedProgramCodeBlock>(vm, executable, source, builtinMode, strictMode, ThisTDZMode::CheckIfNeeded, debuggerMode, profilerMode, error);
>+    VariableEnvironment emptyParentTDZVariables;
>+    return getGlobalCodeBlock<UnlinkedProgramCodeBlock>(vm, executable, source, builtinMode, strictMode, ThisTDZMode::CheckIfNeeded, debuggerMode, profilerMode, error, &emptyParentTDZVariables);
> }
> 
>-UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(VM& vm, EvalExecutable* executable, const SourceCode& source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error)
>+UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(VM& vm, EvalExecutable* executable, const SourceCode& source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError& error, const VariableEnvironment* variablesUnderTDZ)
> {
>-    return getGlobalCodeBlock<UnlinkedEvalCodeBlock>(vm, executable, source, builtinMode, strictMode, thisTDZMode, debuggerMode, profilerMode, error);
>+    return getGlobalCodeBlock<UnlinkedEvalCodeBlock>(vm, executable, source, builtinMode, strictMode, thisTDZMode, debuggerMode, profilerMode, error, variablesUnderTDZ);
> }
> 
> // FIXME: There's no need to add the function's name to the key here. It's already in the source code.
>@@ -171,7 +172,9 @@ UnlinkedFunctionExecutable* CodeCache::g
>         return nullptr;
>     
>     body->setEndPosition(positionBeforeLastNewline);
>-    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&vm, source, body, UnlinkedNormalFunction);
>+    // The Function constructor only has access to global variables, so no variables will be under TDZ.
>+    VariableEnvironment emptyTDZVariables;
>+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&vm, source, body, UnlinkedNormalFunction, emptyTDZVariables);
>     functionExecutable->m_nameValue.set(vm, functionExecutable, jsString(&vm, name.string()));
> 
>     m_sourceCode.addCache(key, SourceCodeValue(vm, functionExecutable, m_sourceCode.age()));
>Index: Source/JavaScriptCore/runtime/CodeCache.h
>===================================================================
>--- Source/JavaScriptCore/runtime/CodeCache.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/CodeCache.h	(working copy)
>@@ -30,6 +30,7 @@
> #include "ParserModes.h"
> #include "SourceCode.h"
> #include "Strong.h"
>+#include "VariableEnvironment.h"
> #include "WeakRandom.h"
> #include <wtf/CurrentTime.h>
> #include <wtf/Forward.h>
>@@ -255,7 +256,7 @@ public:
>     ~CodeCache();
> 
>     UnlinkedProgramCodeBlock* getProgramCodeBlock(VM&, ProgramExecutable*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, DebuggerMode, ProfilerMode, ParserError&);
>-    UnlinkedEvalCodeBlock* getEvalCodeBlock(VM&, EvalExecutable*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&);
>+    UnlinkedEvalCodeBlock* getEvalCodeBlock(VM&, EvalExecutable*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&, const VariableEnvironment*);
>     UnlinkedFunctionExecutable* getFunctionExecutableFromGlobalCode(VM&, const Identifier&, const SourceCode&, ParserError&);
> 
>     void clear()
>@@ -265,7 +266,7 @@ public:
> 
> private:
>     template <class UnlinkedCodeBlockType, class ExecutableType> 
>-    UnlinkedCodeBlockType* getGlobalCodeBlock(VM&, ExecutableType*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&);
>+    UnlinkedCodeBlockType* getGlobalCodeBlock(VM&, ExecutableType*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&, const VariableEnvironment*);
> 
>     CodeCacheMap m_sourceCode;
> };
>Index: Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPaths.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/CommonSlowPaths.cpp	(working copy)
>@@ -268,7 +268,7 @@ SLOW_PATH_DECL(slow_path_to_this)
> SLOW_PATH_DECL(slow_path_throw_tdz_error)
> {
>     BEGIN();
>-    THROW(createReferenceError(exec, "Cannot access uninitialized variable."));
>+    THROW(createTDZError(exec));
> }
> 
> SLOW_PATH_DECL(slow_path_not)
>Index: Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ExceptionHelpers.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/ExceptionHelpers.cpp	(working copy)
>@@ -267,6 +267,11 @@ JSObject* createErrorForInvalidGlobalAss
>     return createReferenceError(exec, makeString("Strict mode forbids implicit creation of global property '", propertyName, '\''));
> }
> 
>+JSObject* createTDZError(ExecState* exec)
>+{
>+    return createReferenceError(exec, "Cannot access uninitialized variable.");
>+}
>+
> JSObject* throwOutOfMemoryError(ExecState* exec)
> {
>     return exec->vm().throwException(exec, createOutOfMemoryError(exec));
>Index: Source/JavaScriptCore/runtime/ExceptionHelpers.h
>===================================================================
>--- Source/JavaScriptCore/runtime/ExceptionHelpers.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/ExceptionHelpers.h	(working copy)
>@@ -41,6 +41,7 @@ JS_EXPORT_PRIVATE bool isTerminatedExecu
> JS_EXPORT_PRIVATE JSObject* createError(ExecState*, JSValue, const String&, ErrorInstance::SourceAppender);
> JS_EXPORT_PRIVATE JSObject* createStackOverflowError(ExecState*);
> JSObject* createUndefinedVariableError(ExecState*, const Identifier&);
>+JSObject* createTDZError(ExecState*);
> JSObject* createNotAnObjectError(ExecState*, JSValue);
> JSObject* createInvalidFunctionApplyParameterError(ExecState*, JSValue);
> JSObject* createInvalidInParameterError(ExecState*, JSValue);
>Index: Source/JavaScriptCore/runtime/Executable.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Executable.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/Executable.cpp	(working copy)
>@@ -347,7 +347,7 @@ JSObject* ScriptExecutable::prepareForEx
> 
> const ClassInfo EvalExecutable::s_info = { "EvalExecutable", &ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(EvalExecutable) };
> 
>-EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode& source, bool isInStrictContext, ThisTDZMode thisTDZMode)
>+EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode& source, bool isInStrictContext, ThisTDZMode thisTDZMode, const VariableEnvironment* variablesUnderTDZ)
> {
>     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
>     if (!globalObject->evalEnabled()) {
>@@ -358,7 +358,7 @@ EvalExecutable* EvalExecutable::create(E
>     EvalExecutable* executable = new (NotNull, allocateCell<EvalExecutable>(*exec->heap())) EvalExecutable(exec, source, isInStrictContext);
>     executable->finishCreation(exec->vm());
> 
>-    UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject->createEvalCodeBlock(exec, executable, thisTDZMode);
>+    UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject->createEvalCodeBlock(exec, executable, thisTDZMode, variablesUnderTDZ);
>     if (!unlinkedEvalCode)
>         return 0;
> 
>Index: Source/JavaScriptCore/runtime/Executable.h
>===================================================================
>--- Source/JavaScriptCore/runtime/Executable.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/Executable.h	(working copy)
>@@ -454,7 +454,7 @@ public:
>         return m_evalCodeBlock.get();
>     }
> 
>-    static EvalExecutable* create(ExecState*, const SourceCode&, bool isInStrictContext, ThisTDZMode);
>+    static EvalExecutable* create(ExecState*, const SourceCode&, bool isInStrictContext, ThisTDZMode, const VariableEnvironment*);
> 
>     PassRefPtr<JITCode> generatedJITCode()
>     {
>Index: Source/JavaScriptCore/runtime/JSCJSValue.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSCJSValue.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSCJSValue.h	(working copy)
>@@ -487,6 +487,11 @@ inline JSValue jsUndefined()
>     return JSValue(JSValue::JSUndefined);
> }
> 
>+inline JSValue jsTDZValue()
>+{
>+    return JSValue();
>+}
>+
> inline JSValue jsBoolean(bool b)
> {
>     return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
>Index: Source/JavaScriptCore/runtime/JSEnvironmentRecord.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSEnvironmentRecord.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSEnvironmentRecord.h	(working copy)
>@@ -100,12 +100,13 @@ protected:
>         Base::finishCreation(vm);
>     }
>     
>-    void finishCreation(VM& vm)
>+    void finishCreation(VM& vm, JSValue value)
>     {
>         finishCreationUninitialized(vm);
>+        ASSERT(value == jsUndefined() || value == jsTDZValue());
>         for (unsigned i = symbolTable()->scopeSize(); i--;) {
>-            // Filling this with undefined is useful because that's what variables start out as.
>-            variableAt(ScopeOffset(i)).setUndefined();
>+            // Filling this with undefined/TDZEmptyValue is useful because that's what variables start out as.
>+            variableAt(ScopeOffset(i)).setStartingValue(value);
>         }
>     }
> 
>Index: Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObject.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.cpp	(working copy)
>@@ -878,14 +878,14 @@ UnlinkedProgramCodeBlock* JSGlobalObject
>     return unlinkedCodeBlock;
> }
> 
>-UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, ThisTDZMode thisTDZMode)
>+UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, ThisTDZMode thisTDZMode, const VariableEnvironment* variablesUnderTDZ)
> {
>     ParserError error;
>     JSParserStrictMode strictMode = executable->isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
>     DebuggerMode debuggerMode = hasDebugger() ? DebuggerOn : DebuggerOff;
>     ProfilerMode profilerMode = hasProfiler() ? ProfilerOn : ProfilerOff;
>     UnlinkedEvalCodeBlock* unlinkedCodeBlock = vm().codeCache()->getEvalCodeBlock(
>-        vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, strictMode, thisTDZMode, debuggerMode, profilerMode, error);
>+        vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, strictMode, thisTDZMode, debuggerMode, profilerMode, error, variablesUnderTDZ);
> 
>     if (hasDebugger())
>         debugger()->sourceParsed(callFrame, executable->source().provider(), error.line(), error.message());
>Index: Source/JavaScriptCore/runtime/JSGlobalObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObject.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.h	(working copy)
>@@ -39,6 +39,7 @@
> #include "SymbolPrototype.h"
> #include "TemplateRegistry.h"
> #include "VM.h"
>+#include "VariableEnvironment.h"
> #include "Watchpoint.h"
> #include <JavaScriptCore/JSBase.h>
> #include <array>
>@@ -633,7 +634,7 @@ public:
>     unsigned weakRandomInteger() { return m_weakRandom.getUint32(); }
> 
>     UnlinkedProgramCodeBlock* createProgramCodeBlock(CallFrame*, ProgramExecutable*, JSObject** exception);
>-    UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*, ThisTDZMode);
>+    UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*, ThisTDZMode, const VariableEnvironment*);
> 
> protected:
>     struct GlobalPropertyInfo {
>Index: Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp	(working copy)
>@@ -580,7 +580,8 @@ EncodedJSValue JSC_HOST_CALL globalFuncE
>     }
> 
>     JSGlobalObject* calleeGlobalObject = exec->callee()->globalObject();
>-    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false, ThisTDZMode::CheckIfNeeded);
>+    VariableEnvironment emptyTDZVariables; // Indirect eval does not have access to the lexical scope.
>+    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false, ThisTDZMode::CheckIfNeeded, &emptyTDZVariables);
>     if (!eval)
>         return JSValue::encode(jsUndefined());
> 
>Index: Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp	(working copy)
>@@ -39,7 +39,7 @@ namespace JSC {
> 
> const ClassInfo JSLexicalEnvironment::s_info = { "JSLexicalEnvironment", &Base::s_info, 0, CREATE_METHOD_TABLE(JSLexicalEnvironment) };
> 
>-inline bool JSLexicalEnvironment::symbolTableGet(PropertyName propertyName, PropertySlot& slot)
>+inline bool JSLexicalEnvironment::symbolTableGet(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
> {
>     SymbolTableEntry entry = symbolTable()->inlineGet(propertyName.uid());
>     if (entry.isNull())
>@@ -51,23 +51,13 @@ inline bool JSLexicalEnvironment::symbol
>     if (!isValid(offset))
>         return false;
> 
>-    slot.setValue(this, DontEnum, variableAt(offset).get());
>-    return true;
>-}
>-
>-inline bool JSLexicalEnvironment::symbolTableGet(PropertyName propertyName, PropertyDescriptor& descriptor)
>-{
>-    SymbolTableEntry entry = symbolTable()->inlineGet(propertyName.uid());
>-    if (entry.isNull())
>-        return false;
>-
>-    ScopeOffset offset = entry.scopeOffset();
>-
>-    // Defend against the inspector asking for a var after it has been optimized out.
>-    if (!isValid(offset))
>+    JSValue result = variableAt(offset).get();
>+    if (result == jsTDZValue()) {
>+        printf("SymbolTableGet throwing tdz error\n");
>+        exec->vm().throwException(exec, createTDZError(exec));
>         return false;
>-
>-    descriptor.setDescriptor(variableAt(offset).get(), entry.getAttributes());
>+    }
>+    slot.setValue(this, DontEnum, result);
>     return true;
> }
> 
>@@ -151,9 +141,12 @@ bool JSLexicalEnvironment::getOwnPropert
> {
>     JSLexicalEnvironment* thisObject = jsCast<JSLexicalEnvironment*>(object);
> 
>-    if (thisObject->symbolTableGet(propertyName, slot))
>+    if (thisObject->symbolTableGet(exec, propertyName, slot))
>         return true;
> 
>+    if (exec->vm().exception()) // TDZ error.
>+        return false;
>+
>     unsigned attributes;
>     if (JSValue value = thisObject->getDirect(exec->vm(), propertyName, attributes)) {
>         slot.setValue(thisObject, attributes, value);
>Index: Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSLexicalEnvironment.h	(working copy)
>@@ -47,23 +47,29 @@ public:
>     static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
> 
>     static JSLexicalEnvironment* create(
>-        VM& vm, Structure* structure, JSScope* currentScope, SymbolTable* symbolTable)
>+        VM& vm, Structure* structure, JSScope* currentScope, SymbolTable* symbolTable, JSValue initialValue)
>     {
>         JSLexicalEnvironment* result = 
>             new (
>                 NotNull,
>                 allocateCell<JSLexicalEnvironment>(vm.heap, allocationSize(symbolTable)))
>             JSLexicalEnvironment(vm, structure, currentScope, symbolTable);
>-        result->finishCreation(vm);
>+        result->finishCreation(vm, initialValue);
>         return result;
>     }
>     
>-    static JSLexicalEnvironment* create(VM& vm, CallFrame* callFrame, JSScope* currentScope, CodeBlock* codeBlock)
>+    static JSLexicalEnvironment* create(VM& vm, CallFrame* callFrame, JSScope* currentScope, CodeBlock* codeBlock, JSValue initialValue)
>     {
>         JSGlobalObject* globalObject = callFrame->lexicalGlobalObject();
>         Structure* structure = globalObject->activationStructure();
>         SymbolTable* symbolTable = codeBlock->symbolTable();
>-        return create(vm, structure, currentScope, symbolTable);
>+        return create(vm, structure, currentScope, symbolTable, initialValue);
>+    }
>+
>+    static JSLexicalEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable, JSValue initialValue)
>+    {
>+        Structure* structure = globalObject->activationStructure();
>+        return create(vm, structure, currentScope, symbolTable, initialValue);
>     }
>         
>     static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
>@@ -80,9 +86,7 @@ public:
>     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject) { return Structure::create(vm, globalObject, jsNull(), TypeInfo(ActivationObjectType, StructureFlags), info()); }
> 
> private:
>-    bool symbolTableGet(PropertyName, PropertySlot&);
>-    bool symbolTableGet(PropertyName, PropertyDescriptor&);
>-    bool symbolTableGet(PropertyName, PropertySlot&, bool& slotIsWriteable);
>+    bool symbolTableGet(ExecState*, PropertyName, PropertySlot&);
>     bool symbolTablePut(ExecState*, PropertyName, JSValue, bool shouldThrow);
>     bool symbolTablePutWithAttributes(VM&, PropertyName, JSValue, unsigned attributes);
> };
>Index: Source/JavaScriptCore/runtime/JSScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSScope.cpp	(working copy)
>@@ -170,14 +170,14 @@ JSValue JSScope::resolve(ExecState* exec
>     }
> }
> 
>-ResolveOp JSScope::abstractResolve(ExecState* exec, bool hasTopActivation, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
>+ResolveOp JSScope::abstractResolve(ExecState* exec, size_t depthOffset, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType)
> {
>     ResolveOp op(Dynamic, 0, 0, 0, 0, 0);
>     if (unlinkedType == Dynamic)
>         return op;
> 
>-    size_t depth = hasTopActivation ? 1 : 0;
>     bool needsVarInjectionChecks = JSC::needsVarInjectionChecks(unlinkedType);
>+    size_t depth = depthOffset;
>     for (; scope; scope = scope->next()) {
>         if (abstractAccess(exec, scope, ident, getOrPut, depth, needsVarInjectionChecks, op))
>             break;
>@@ -187,6 +187,22 @@ ResolveOp JSScope::abstractResolve(ExecS
>     return op;
> }
> 
>+void JSScope::collectVariablesUnderTDZ(JSScope* scope, VariableEnvironment& result)
>+{
>+    for (; scope; scope = scope->next()) {
>+        JSLexicalEnvironment* lexicalEnvironment = jsDynamicCast<JSLexicalEnvironment*>(scope);
>+        if (!lexicalEnvironment) // Global object does not hold any lexical variables so we can ignore it.
>+            continue;
>+
>+        SymbolTable* symbolTable = lexicalEnvironment->symbolTable();
>+        ConcurrentJITLocker locker(symbolTable->m_lock);
>+        for (auto end = symbolTable->end(locker), iter = symbolTable->begin(locker); iter != end; ++iter) {
>+            if (iter->value.isLexicallyScoped())
>+                result.add(iter->key);
>+        }
>+    }
>+}
>+
> const char* resolveModeName(ResolveMode mode)
> {
>     static const char* const names[] = {
>Index: Source/JavaScriptCore/runtime/JSScope.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/JSScope.h	(working copy)
>@@ -27,6 +27,7 @@
> #define JSScope_h
> 
> #include "JSObject.h"
>+#include "VariableEnvironment.h"
> 
> namespace JSC {
> 
>@@ -157,7 +158,9 @@ public:
>     static JSObject* objectAtScope(JSScope*);
> 
>     static JSValue resolve(ExecState*, JSScope*, const Identifier&);
>-    static ResolveOp abstractResolve(ExecState*, bool hasTopActivation, JSScope*, const Identifier&, GetOrPut, ResolveType);
>+    static ResolveOp abstractResolve(ExecState*, size_t depthOffset, JSScope*, const Identifier&, GetOrPut, ResolveType);
>+
>+    static void collectVariablesUnderTDZ(JSScope*, VariableEnvironment& result);
> 
>     static void visitChildren(JSCell*, SlotVisitor&);
> 
>Index: Source/JavaScriptCore/runtime/SymbolTable.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolTable.cpp	(revision 186105)
>+++ Source/JavaScriptCore/runtime/SymbolTable.cpp	(working copy)
>@@ -144,7 +144,7 @@ SymbolTable* SymbolTable::cloneScopePart
>             continue;
>         result->m_map.add(
>             iter->key,
>-            SymbolTableEntry(iter->value.varOffset(), iter->value.getAttributes()));
>+            SymbolTableEntry(iter->value.varOffset(), iter->value.getAttributes(), iter->value.isLexicallyScoped()));
>     }
>     
>     result->m_maxScopeOffset = m_maxScopeOffset;
>Index: Source/JavaScriptCore/runtime/SymbolTable.h
>===================================================================
>--- Source/JavaScriptCore/runtime/SymbolTable.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/SymbolTable.h	(working copy)
>@@ -169,14 +169,21 @@ public:
>         : m_bits(SlimFlag)
>     {
>         ASSERT(isValidVarOffset(offset));
>-        pack(offset, true, false, false);
>+        pack(offset, true, false, false, false);
>     }
> 
>     SymbolTableEntry(VarOffset offset, unsigned attributes)
>         : m_bits(SlimFlag)
>     {
>         ASSERT(isValidVarOffset(offset));
>-        pack(offset, true, attributes & ReadOnly, attributes & DontEnum);
>+        pack(offset, true, attributes & ReadOnly, attributes & DontEnum, false);
>+    }
>+
>+    SymbolTableEntry(VarOffset offset, unsigned attributes, bool isLexicalScope)
>+        : m_bits(SlimFlag)
>+    {
>+        ASSERT(isValidVarOffset(offset));
>+        pack(offset, true, attributes & ReadOnly, attributes & DontEnum, isLexicalScope);
>     }
>     
>     ~SymbolTableEntry()
>@@ -245,7 +252,7 @@ public:
>     
>     void setAttributes(unsigned attributes)
>     {
>-        pack(varOffset(), isWatchable(), attributes & ReadOnly, attributes & DontEnum);
>+        pack(varOffset(), isWatchable(), attributes & ReadOnly, attributes & DontEnum, isLexicallyScoped());
>     }
> 
>     bool isReadOnly() const
>@@ -262,13 +269,18 @@ public:
>     {
>         return bits() & DontEnumFlag;
>     }
>+
>+    bool isLexicallyScoped() const
>+    {
>+        return bits() & LexicalScopeFlag;
>+    }
>     
>     void disableWatching()
>     {
>         if (WatchpointSet* set = watchpointSet())
>             set->invalidate("Disabling watching in symbol table");
>         if (varOffset().isScope())
>-            pack(varOffset(), false, isReadOnly(), isDontEnum());
>+            pack(varOffset(), false, isReadOnly(), isDontEnum(), isLexicallyScoped());
>     }
>     
>     void prepareToWatch();
>@@ -306,12 +318,13 @@ private:
>     static const intptr_t ReadOnlyFlag = 0x2;
>     static const intptr_t DontEnumFlag = 0x4;
>     static const intptr_t NotNullFlag = 0x8;
>-    static const intptr_t KindBitsMask = 0x30;
>+    static const intptr_t LexicalScopeFlag = 0x10;
>+    static const intptr_t KindBitsMask = 0x60;
>     static const intptr_t ScopeKindBits = 0x00;
>-    static const intptr_t UnwatchableScopeKindBits = 0x10;
>-    static const intptr_t StackKindBits = 0x20;
>-    static const intptr_t DirectArgumentKindBits = 0x30;
>-    static const intptr_t FlagBits = 6;
>+    static const intptr_t UnwatchableScopeKindBits = 0x20;
>+    static const intptr_t StackKindBits = 0x40;
>+    static const intptr_t DirectArgumentKindBits = 0x60;
>+    static const intptr_t FlagBits = 7;
>     
>     class FatEntry {
>         WTF_MAKE_FAST_ALLOCATED;
>@@ -378,7 +391,7 @@ private:
> 
>     JS_EXPORT_PRIVATE void freeFatEntrySlow();
> 
>-    void pack(VarOffset offset, bool isWatchable, bool readOnly, bool dontEnum)
>+    void pack(VarOffset offset, bool isWatchable, bool readOnly, bool dontEnum, bool lexicalScope)
>     {
>         ASSERT(!isFat());
>         intptr_t& bitsRef = bits();
>@@ -388,6 +401,8 @@ private:
>             bitsRef |= ReadOnlyFlag;
>         if (dontEnum)
>             bitsRef |= DontEnumFlag;
>+        if (lexicalScope)
>+            bitsRef |= LexicalScopeFlag;
>         switch (offset.kind()) {
>         case VarKind::Scope:
>             if (isWatchable)
>Index: Source/JavaScriptCore/runtime/WriteBarrier.h
>===================================================================
>--- Source/JavaScriptCore/runtime/WriteBarrier.h	(revision 186105)
>+++ Source/JavaScriptCore/runtime/WriteBarrier.h	(working copy)
>@@ -145,6 +145,7 @@ public:
>     }
>     void clear() { m_value = JSValue::encode(JSValue()); }
>     void setUndefined() { m_value = JSValue::encode(jsUndefined()); }
>+    void setStartingValue(JSValue value) { m_value = JSValue::encode(value); }
>     bool isNumber() const { return get().isNumber(); }
>     bool isObject() const { return get().isObject(); }
>     bool isNull() const { return get().isNull(); }
>Index: Source/JavaScriptCore/tests/stress/activation-sink-default-value-tdz-error.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/activation-sink-default-value-tdz-error.js	(revision 0)
>+++ Source/JavaScriptCore/tests/stress/activation-sink-default-value-tdz-error.js	(working copy)
>@@ -0,0 +1,46 @@
>+"use strict";
>+
>+var n = 10000000;
>+
>+function shouldThrowTDZ(func) {
>+    var hasThrown = false;
>+    try {
>+        func();
>+    } catch(e) {
>+        if (e.name.indexOf("ReferenceError") !== -1)
>+            hasThrown = true;
>+    }
>+    if (!hasThrown)
>+        throw new Error("Did not throw TDZ error");
>+}
>+noInline(shouldThrowTDZ);
>+
>+function bar(f) { f(10); }
>+
>+function foo(b) {
>+    let result = 0;
>+    var set = function (x) { result = x; }
>+    var cap = function() { return tdzPerpetrator; }
>+    if (b) {
>+        bar(set);
>+        //if (result != 10)
>+        //    throw "Error: bad: " + result;
>+        return tdzPerpetrator;
>+    }
>+    let tdzPerpetrator;
>+    return result;
>+}
>+
>+noInline(bar);
>+noInline(foo);
>+
>+for (var i = 0; i < n; i++) {
>+    var bool = !(i % 100);
>+    if (bool)
>+        shouldThrowTDZ(function() { foo(bool); });
>+    else {
>+        var result = foo(bool);
>+        if (result != 0)
>+            throw "Error: bad result: " + result;
>+    }
>+}
>Index: Source/JavaScriptCore/tests/stress/activation-sink-osrexit-default-value-tdz-error.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/activation-sink-osrexit-default-value-tdz-error.js	(revision 0)
>+++ Source/JavaScriptCore/tests/stress/activation-sink-osrexit-default-value-tdz-error.js	(working copy)
>@@ -0,0 +1,46 @@
>+"use strict";
>+
>+var n = 10000000;
>+
>+function shouldThrowTDZ(func) {
>+    var hasThrown = false;
>+    try {
>+        func();
>+    } catch(e) {
>+        if (e.name.indexOf("ReferenceError") !== -1)
>+            hasThrown = true;
>+    }
>+    if (!hasThrown)
>+        throw new Error("Did not throw TDZ error");
>+}
>+
>+function bar(f) { }
>+
>+function foo(b) {
>+    let result = 0;
>+    var set = function (x) { result = x; return tdzPerpetrator; }
>+    if (b) {
>+        OSRExit();
>+        if (b) {
>+            bar(set);
>+            return tdzPerpetrator;
>+        }
>+    }
>+    let tdzPerpetrator;
>+    return result;
>+}
>+
>+noInline(bar);
>+noInline(foo);
>+noInline(shouldThrowTDZ);
>+
>+for (var i = 0; i < n; i++) {
>+    var bool = !(i % 100);
>+    if (bool)
>+        shouldThrowTDZ(function() { foo(bool); });
>+    else {
>+        var result = foo(bool);
>+        if (result != 0)
>+            throw "Error: bad result: " + result;
>+    }
>+}
>Index: Source/JavaScriptCore/tests/stress/activation-sink-osrexit-default-value.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/activation-sink-osrexit-default-value.js	(revision 186105)
>+++ Source/JavaScriptCore/tests/stress/activation-sink-osrexit-default-value.js	(working copy)
>@@ -1,6 +1,6 @@
> var n = 10000000;
> 
>-function bar(set) { 
>+function bar(set) {
>     var result = set(0);
>     if (result !== void 0)
>         throw "Error: bad value: " + result;
>Index: Source/JavaScriptCore/tests/stress/lexical-let-exception-handling.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/lexical-let-exception-handling.js	(revision 0)
>+++ Source/JavaScriptCore/tests/stress/lexical-let-exception-handling.js	(working copy)
>@@ -0,0 +1,194 @@
>+"use strict";
>+
>+function truth() {
>+    return true;
>+}
>+noInline(truth);
>+
>+function assert(cond) {
>+    if (!cond)
>+        throw new Error("broke assertion");
>+}
>+noInline(assert);
>+
>+;(function () {
>+
>+function foo() {
>+    let x = 20;
>+    let y = "y";
>+    try {
>+        assert(x === 20);
>+        assert(y === "y");
>+        throw "error";
>+    } catch(e) {
>+        assert(x === 20);
>+    } finally {
>+        assert(x === 20);
>+        assert(y === "y");
>+    }
>+
>+    for (let i = 0; i < 1; i++) {
>+        let numFinally = 0;
>+        try {
>+            let a = 40;
>+            let capA = function() { return a; }
>+            assert(capA() === 40);
>+            try {
>+                let b = 41;
>+                let capB = function() { return b; }
>+                assert(capB() === 41);
>+                assert(capA() === 40);
>+                try {
>+                    return 20;
>+                } catch(e){
>+                } finally {
>+                    let c = 42;
>+                    let capC = function() { return c; }
>+                    assert(capC() === 42);
>+                    assert(capB() === 41);
>+                    assert(capA() === 40);
>+                    if (i === 0) {
>+                        numFinally++;
>+                    }
>+                    return 22;
>+                }
>+            } catch(e) {
>+            } finally {
>+                if (i === 0) {
>+                    numFinally++;
>+                }
>+                return 23;
>+            }
>+        } catch(e) {
>+        } finally {
>+            if (i === 0) {
>+                numFinally++;
>+            }
>+            assert(numFinally === 3);
>+            return 24;
>+        }
>+    }
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    assert(foo() === 24);
>+}
>+
>+})();
>+
>+
>+;(function () {
>+function foo() {
>+    for (let i = 0; i < 1; i++) {
>+        let numFinally = 0;
>+        let numErrors = 0;
>+        try {
>+            let a = 40;
>+            let capA = function() { return a; }
>+            assert(capA() === 40);
>+            try {
>+                let b = 41;
>+                let capB = function() { return b; }
>+                assert(capB() === 41);
>+                assert(capA() === 40);
>+                try {
>+                    throw "e";
>+                } catch(e) {
>+                    assert(i === 0);
>+                    assert(capB() === 41);
>+                    assert(capA() === 40);
>+                    numErrors++;
>+                    throw e;
>+                } finally {
>+                    let c = 42;
>+                    let capC = function() { return c; }
>+                    assert(capC() === 42);
>+                    assert(capB() === 41);
>+                    assert(capA() === 40);
>+                    if (i === 0) {
>+                        numFinally++;
>+                    }
>+                }
>+            } catch(e) {
>+                assert(i === 0);
>+                assert(capA() === 40);
>+                numErrors++;
>+            } finally {
>+                assert(capA() === 40);
>+                if (i === 0) {
>+                    numFinally++;
>+                }
>+                return 23;
>+            }    
>+        } catch(e) {
>+            //assert(i === 0);
>+        } finally {
>+            if (i === 0) {
>+                numFinally++;
>+            }
>+
>+            assert(numFinally === 3);
>+            assert(numErrors === 2);
>+            return 24;
>+        }
>+    }
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    assert(foo() === 24);
>+}
>+
>+})();
>+
>+
>+var d = 100;
>+;(function (){
>+function foo() {
>+    assert(d === 100);
>+    for (let i = 0; i < 1; i++) {
>+        let numFinally = 0;
>+        let numErrors = 0;
>+        let c = 44;
>+        assert(d === 100);
>+        try {
>+            let d = 45;
>+            if (truth()) {
>+                let a = 20;
>+                let capA = function() { return a; }
>+                assert(capA() === 20);
>+                if (truth()) {
>+                    let b = 21;
>+                    let e = 48;
>+                    let capB = function() { return b; }
>+                    assert(capB() === 21);
>+                    assert(d === 45);
>+                    try {
>+                        throw "e";
>+                    } catch(e) {
>+                        assert(capA() === 20);
>+                        assert(a === 20);
>+                        numErrors++;
>+                    } finally {
>+                        assert(capA() === 20);
>+                        assert(e === 48);
>+                        numFinally++;
>+                        return 30;
>+                    }
>+                } 
>+            }
>+        } finally {
>+            assert(c === 44);
>+            assert(d === 100);
>+            numFinally++;
>+            assert(numFinally === 2);
>+            assert(numErrors === 1);
>+            return 40;
>+        }
>+    }
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    assert(foo() === 40);
>+}
>+
>+})();
>Index: Source/JavaScriptCore/tests/stress/lexical-let-global-not-captured-variables.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/lexical-let-global-not-captured-variables.js	(revision 0)
>+++ Source/JavaScriptCore/tests/stress/lexical-let-global-not-captured-variables.js	(working copy)
>@@ -0,0 +1,31 @@
>+"use strict";
>+
>+function truth() {
>+    return true;
>+}
>+noInline(truth);
>+
>+function assert(cond) {
>+    if (!cond)
>+        throw new Error("broke assertion");
>+}
>+noInline(assert);
>+
>+
>+function foo(y) {
>+    return y;
>+}
>+
>+let x = 40;
>+assert(x === 40);
>+
>+for (var i = 0; i < 1000; i++) {
>+    if (truth()) {
>+        let y = 20;
>+        let capY = function() { return y; }
>+        assert(x === 40);
>+        assert(capY() === 20);
>+        assert(foo(i) === i);
>+    }
>+}
>+assert(foo("hello") === "hello");
>Index: Source/JavaScriptCore/tests/stress/lexical-let-loop-semantics.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/lexical-let-loop-semantics.js	(revision 0)
>+++ Source/JavaScriptCore/tests/stress/lexical-let-loop-semantics.js	(working copy)
>@@ -0,0 +1,378 @@
>+"use strict";
>+
>+function truth() {
>+    return true;
>+}
>+noInline(truth);
>+
>+function assert(cond) {
>+    if (!cond)
>+        throw new Error("broke assertion");
>+}
>+noInline(assert);
>+
>+function shouldThrowTDZ(func) {
>+    var hasThrown = false;
>+    try {
>+        func();
>+    } catch(e) {
>+        if (e.name.indexOf("ReferenceError") !== -1)
>+            hasThrown = true;
>+    }
>+    assert(hasThrown);
>+}
>+noInline(shouldThrowTDZ);
>+
>+
>+;(function () {
>+    var arr = [];
>+
>+    for (let i = 0; i < 10; i++) {
>+        arr.push(function () { return i; })
>+    }
>+
>+    for (let j = 0; j < arr.length; j++) {
>+        assert(arr[j]() === j);
>+    }
>+
>+    let f = "fff";
>+    let counter = 0;
>+    for (let f of arr) {
>+        assert(f() === counter++);
>+    }
>+    assert(f === "fff");
>+
>+    let numLoops = 0;
>+    for (let f of arr) {
>+        numLoops++;
>+        let f = function () { return "f"; }
>+        assert(f() === "f");
>+    }
>+    assert(numLoops === arr.length);
>+    assert(f === "fff");
>+
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        var obj = {hello:1, world:2};
>+        obj["bar"] = 3;
>+        let p = 20;
>+        assert(p === 20);
>+        for (let p in obj) {
>+            assert(p === "hello" || p === "world" || p === "bar");
>+        }
>+        assert(p === 20);
>+    }
>+
>+    function bar() {
>+        var obj = {hello:1, world:2};
>+        obj["bar"] = 3;
>+        let props = [];
>+        let p = 20;
>+        for (let p in obj) {
>+            props.push(function foo() { return p; });
>+            let outerP = p;
>+            if (truth()) {
>+                let p = 100;
>+                assert(p === 100);
>+                assert(p !== outerP);
>+                assert(outerP === "hello" || outerP === "world" || outerP === "bar");
>+            }
>+            assert(p === outerP);
>+        }
>+        assert(p === 20);
>+
>+        let seenProps = {};
>+        for (let f of props) {
>+            let p = f();
>+            assert(p === "hello" || p === "world" || p === "bar");
>+            seenProps[p] = true;
>+        }
>+        assert(seenProps["hello"] === true);
>+        assert(seenProps["world"] === true);
>+        assert(seenProps["bar"] === true);
>+        assert(p === 20);
>+    }
>+
>+    for (var i = 0; i < 1000; i++) {
>+        foo();
>+        bar();
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        let counter = 0;
>+        for (let idx = 0; idx < 20; idx++) {
>+            assert(idx === counter++);
>+            continue;
>+        }
>+        shouldThrowTDZ(function() { return idx; });
>+    }
>+    for (var i = 0; i < 1000; i++) {
>+        foo();
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        for (let idx = 0; !truth(); idx++) { }
>+        shouldThrowTDZ(function() { return idx; }); // Just plain old reference error here.
>+    }
>+    function bar() {
>+        for (let j = 0; j < 20; j++) { 
>+            if (j === 1)
>+                break;
>+            else
>+                continue;
>+        }
>+        shouldThrowTDZ(function() { return j; });
>+    }
>+    for (var i = 0; i < 1000; i++) {
>+        foo();
>+        bar();
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        var obj = {hello:1, world:2};
>+        let p = 20;
>+        var arr = []
>+        for (let p in obj) {
>+            arr.push(function capP() { return p; });
>+            assert(p === "hello" || p === "world");
>+        }
>+        assert(arr[0]() === "hello" || arr[0]() === "world");
>+        assert(arr[1]() === "hello" || arr[1]() === "world");
>+        assert(arr[1]() !== arr[0]());
>+        assert(p === 20);
>+    }
>+
>+    function bar() {
>+        var obj = {a:1, b:2, c:3, d:4, e:4};
>+        obj["f"] = 5;
>+        let funcs = [];
>+        for (let p in obj) {
>+            funcs.push(function capP() { return p; });
>+        }
>+        let counter = 0;
>+        for (let p in obj) {
>+            assert(funcs[counter]() === p);
>+            counter++;
>+        }
>+    }
>+
>+    for (var i = 0; i < 1000; i++) {
>+        foo();
>+        bar();
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        let arr = [0, 1, 2, 3, 4, 5];
>+        let funcs = [];
>+        for (let x of arr) {
>+            funcs.push(function() { return x; });
>+        }
>+        for (let i = 0; i < arr.length; ++i) {
>+            assert(funcs[i]() === i);
>+        }
>+    }
>+
>+    for (var i = 0; i < 1000; i++) {
>+        foo();
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        let thing = {};
>+        for (let thing = thing; !thing; ) {}
>+    }
>+    for (var i = 0; i < 1000; i++) {
>+        shouldThrowTDZ(foo);
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        let thing = {};
>+        for (let thing = eval("thing"); !truth(); ) {}
>+    }
>+
>+    for (var i = 0; i < 1000; i++) {
>+        shouldThrowTDZ(foo);
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        let thing = {};
>+        for (let thing in thing) {}
>+    }
>+    function bar() {
>+        let thing = {hello: "world"}
>+        for (let thing in thing) {}
>+    }
>+    function baz() {
>+        let thing = {};
>+        for (let thing in eval("thing")) {}
>+    }
>+    function bag() {
>+        let thing = {hello: "world"}
>+        for (let thing in eval("thing")) {}
>+    }
>+    for (var i = 0; i < 1000; i++) {
>+        shouldThrowTDZ(foo);
>+        shouldThrowTDZ(bar);
>+        shouldThrowTDZ(baz);
>+        shouldThrowTDZ(bag);
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        let thing = ["hello"];
>+        for (let thing in thing) {}
>+    }
>+    function bar() {
>+        let thing = [];
>+        for (let thing in thing) {}
>+    }
>+    function baz() {
>+        let thing = {hello: "world"};
>+        for (let thing in thing) {}
>+    }
>+    function bag() {
>+        let empty = {};
>+        for (let thing in empty) {}
>+        return thing;
>+    }
>+    function hat() {
>+        let notEmpty = {foo: "bar"};
>+        for (let thing in notEmpty) {
>+            break;
>+        }
>+        return thing;
>+    }
>+    function cap() {
>+        let notEmpty = {foo: "bar"};
>+        for (let thing in notEmpty) {
>+            continue;
>+        }
>+        return thing;
>+    }
>+    for (var i = 0; i < 1000; i++) {
>+        shouldThrowTDZ(foo);
>+        shouldThrowTDZ(bar);
>+        shouldThrowTDZ(baz);
>+        shouldThrowTDZ(bag);
>+        shouldThrowTDZ(hat);
>+        shouldThrowTDZ(cap);
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        let thing = ["hello"];
>+        for (let thing of thing) {}
>+    }
>+    function bar() {
>+        let thing = [];
>+        for (let thing of thing) {}
>+    }
>+    function baz() {
>+        let thing = ["world"]
>+        for (let thing of thing) {}
>+    }
>+    function bag() {
>+        let empty = [];
>+        for (let thing of empty) {}
>+        return thing;
>+    }
>+    function hat() {
>+        let notEmpty = ["hello", "world"];
>+        for (let thing of notEmpty) {
>+            break;
>+        }
>+        return thing;
>+    }
>+    function tap() {
>+        let notEmpty = [10, 20];
>+        for (let thing of notEmpty) { }
>+        return thing;
>+    }
>+    function cap() {
>+        let notEmpty = [10, 20];
>+        for (let thing of notEmpty) {
>+            continue;
>+        }
>+        return thing;
>+    }
>+    function pap() {
>+        let notEmpty = [10, 20];
>+        for (let thing of notEmpty) {
>+        }
>+        return thing;
>+    }
>+    for (var i = 0; i < 1000; i++) {
>+        shouldThrowTDZ(foo);
>+        shouldThrowTDZ(bar);
>+        shouldThrowTDZ(baz);
>+        shouldThrowTDZ(bag);
>+        shouldThrowTDZ(hat);
>+        shouldThrowTDZ(tap);
>+        shouldThrowTDZ(cap);
>+        shouldThrowTDZ(pap);
>+    }
>+})();
>+
>+
>+;(function() {
>+    function foo() {
>+        let x = 0;
>+        let arr = [];
>+        for (let x of (x=2, obj)) { x; }
>+    }
>+
>+    function bar() {
>+        let x = 0;
>+        let obj = {};
>+        for (let x in (x=2, obj)) { x; }
>+    }
>+
>+    for (var i = 0; i < 1000; i++) {
>+        shouldThrowTDZ(foo);
>+        shouldThrowTDZ(bar);
>+    }
>+})();
>+
>+
>+;(function() {
>+    let factorial = null;
>+    function test() {
>+        for (let factorial = function(x){ return x > 1 ? x * factorial(x - 1) : 1; }; true; ) { return factorial(5); }
>+    }
>+    assert(test() === 120);
>+})();
>+
>+;(function() {
>+    function test() {
>+        for (let factorial = function(x){ return x > 1 ? x * factorial(x - 1) : 1; }; true; ) { return factorial(5); }
>+    }
>+    assert(test() === 120);
>+})();
>+
>Index: Source/JavaScriptCore/tests/stress/lexical-let-semantics.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/lexical-let-semantics.js	(revision 0)
>+++ Source/JavaScriptCore/tests/stress/lexical-let-semantics.js	(working copy)
>@@ -0,0 +1,411 @@
>+"use strict";
>+function truth() {
>+    return true;
>+}
>+noInline(truth);
>+
>+function assert(cond) {
>+    if (!cond)
>+        throw new Error("broke assertion");
>+}
>+noInline(assert);
>+
>+
>+// ========== tests below ===========
>+
>+
>+let globalLet = "helloWorld";
>+assert(globalLet === "helloWorld");
>+function captureGlobalLet() { return globalLet; }
>+assert(globalLet === captureGlobalLet());
>+let globalFunction = function() { return 20; }
>+assert(globalFunction() === 20);
>+assert((function() { return globalFunction(); })() === 20);
>+let globalNumber = 20;
>+assert(globalNumber === 20);
>+globalNumber++;
>+assert(globalNumber === 21);
>+globalNumber += 40;
>+assert(globalNumber === 61);
>+globalNumber = "hello";
>+assert(globalNumber === "hello");
>+
>+let globalNumberCaptured = 20;
>+let retGlobalNumberCaptured = function() { return globalNumberCaptured; }
>+let setGlobalNumberCaptured = function(x) { globalNumberCaptured = x; }
>+assert(retGlobalNumberCaptured() === globalNumberCaptured);
>+globalNumberCaptured++;
>+assert(retGlobalNumberCaptured() === globalNumberCaptured);
>+assert(globalNumberCaptured === 21);
>+setGlobalNumberCaptured(100);
>+assert(retGlobalNumberCaptured() === globalNumberCaptured);
>+assert(globalNumberCaptured === 100);
>+setGlobalNumberCaptured(retGlobalNumberCaptured);
>+assert(retGlobalNumberCaptured() === retGlobalNumberCaptured);
>+assert(globalNumberCaptured === retGlobalNumberCaptured);
>+
>+var arrOfFuncs = [];
>+for (var i = 0; i < 1000; i++) {
>+    let globalLet = "inner";
>+    assert(globalLet === "inner");
>+    let inner = i;
>+    arrOfFuncs.push(function() { return inner; });
>+}
>+assert(globalLet === "helloWorld");
>+for (var i = 0; i < arrOfFuncs.length; i++)
>+    assert(arrOfFuncs[i]() === i);
>+
>+
>+var globalVar = 100;
>+assert(globalVar === 100);
>+;(function () {
>+    assert(globalVar === 100);
>+    if (truth()) {
>+        let globalVar = 20;
>+        assert(globalVar === 20);
>+    }
>+    assert(globalVar === 100);
>+})();
>+
>+assert(globalVar === 100);
>+;(function () {
>+    let globalVar = 10;
>+    assert(globalVar === 10);
>+    if (truth()) {
>+        let globalVar = 20;
>+        assert(globalVar === 20);
>+    }
>+    assert(globalVar === 10);
>+})();
>+assert(globalVar === 100);
>+
>+
>+;(function() {
>+function foo() {
>+    let x = 20;
>+    
>+    if (truth()) {
>+        let thingy = function() { 
>+            x = 200;
>+            return x; 
>+        };
>+        noInline(thingy);
>+        thingy();
>+    }
>+
>+    return x;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    assert(foo() === 200);
>+}
>+})();
>+
>+
>+;(function() {
>+var arr = [];
>+function foo(i) {
>+    var num = i;
>+    
>+    if (truth()) {
>+        let num = i;
>+        arr.push(function() { return num; });
>+    }
>+    var oldFunc = arr[arr.length - 1];
>+    arr[arr.length - 1] = function() { return oldFunc() + num; }
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo(i);
>+}
>+
>+for (var i = 0; i < arr.length; i++) {
>+    assert(arr[i]() === i + i);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    let x = 20;
>+    let y = 40;
>+    assert(x === 20);
>+    assert(y === 40);
>+    if (truth()) {
>+        let x = 50;
>+        let y = 60;
>+        assert(x === 50);
>+        assert(y === 60);
>+    }
>+    assert(x === 20);
>+    assert(y === 40);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    function captureX() { return x; }
>+    let x = 20;
>+    let y = 40;
>+    assert(x === 20);
>+    assert(y === 40);
>+    if (truth()) {
>+        let x = 50;
>+        let y = 60;
>+        assert(x === 50);
>+        assert(y === 60);
>+    }
>+    assert(x === 20);
>+    assert(y === 40);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    let x = 20;
>+    let y = 40;
>+    function captureAll() { return x + y; }
>+    noInline(captureAll);
>+    assert(x === 20);
>+    assert(y === 40);
>+    assert(captureAll() === 60);
>+    if (truth()) {
>+        let x = 50;
>+        assert(x + y === 90);
>+        assert(captureAll() === 60);
>+    }
>+    assert(x === 20);
>+    assert(y === 40);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    var captureAll = function() { return x + y; }
>+    let x = 20;
>+    let {_y : y, z} = {_y : 40, z : 100};
>+    assert(x === 20);
>+    assert(y === 40);
>+    assert(z === 100);
>+    assert(captureAll() === 60);
>+    if (truth()) {
>+        let x = 50;
>+        assert(x + y === 90);
>+        assert(y === 40);
>+        assert(captureAll() === 60);
>+    }
>+    assert(x === 20);
>+    assert(y === 40);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    var captureAll = function() { return x + y; }
>+    let x = 20;
>+    let y = 40;
>+    assert(x === 20);
>+    assert(y === 40);
>+    assert(captureAll() === 60);
>+    if (truth()) {
>+        let x = 50;
>+        let secondCaptureAll = function() { return x + y; };
>+        assert(x + y === 90);
>+        assert(secondCaptureAll() === 90);
>+    }
>+    assert(x === 20);
>+    assert(y === 40);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    let x, y, z;
>+    assert(x === undefined);
>+    assert(y === undefined);
>+    assert(z === undefined);
>+}
>+function bar() {
>+    let x, y, z;
>+    if (truth()) {
>+        let x = 20, y = 40;
>+        assert(x === 20);
>+        assert(y === 40);
>+    }
>+    function capture() { return x + z; }
>+    assert(x === undefined);
>+    assert(y === undefined);
>+    assert(z === undefined);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+    bar();
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    let x, y, z = "z", t = undefined;
>+    assert(cap() === undefined);
>+    assert(x === undefined);
>+    assert(y === undefined);
>+    assert(t === undefined);
>+    assert(z === "z");
>+
>+    function cap() { return x; }
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+})();
>+
>+;(function() {
>+function foo() {
>+    let {x: baz} = {x: 20};
>+    let {x: bar} = {x: 200};
>+    function cap() { return baz; }
>+    assert(baz === 20);
>+    assert(bar === 200);
>+    assert(cap() === 20);
>+    baz = 40;
>+    assert(baz === 40);
>+    assert(cap() === 40);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+
>+})();
>+
>+
>+
>+;(function() {
>+function foo() {
>+    let x = 20;
>+    let y = 50;
>+    assert(y === 50);
>+    assert(eval("y = 25; let x = 40; x;") === 40);
>+    assert(x === 20);
>+    assert(y === 25);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    let x = 20;
>+    let y = 50;
>+    assert(y === 50);
>+    if (truth()) {
>+        let y = 30;
>+        assert(y === 30);
>+        assert(eval("y = 25; let x = 40; x;") === 40);
>+        assert(y === 25);
>+        assert(x === 20);
>+        if (truth()) {
>+            let y = 100;
>+            assert(y === 100);
>+            x = 1;
>+        }
>+        assert(x === 1);
>+        assert(y === 25);
>+    }
>+    assert(x === 1);
>+    assert(y === 50);
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    foo();
>+}
>+})();
>+
>+
>+;(function() {
>+function foo(x) {
>+    let y = 50;
>+    let result = null;
>+    switch(x) {
>+        case 10:
>+            let y = 40;
>+            assert(y === 40);
>+        case 20:
>+            y += 1;
>+            assert(y === 41);
>+            result = y;
>+            break;
>+        default:
>+            result = x;
>+            break;
>+    }
>+    assert(y === 50);
>+    return result;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    assert(foo(10) === 41);
>+}
>+
>+assert(foo("hello") === "hello");
>+})();
>+
>+
>+;(function() {
>+function foo(x) {
>+    let y = 50;
>+    let result = null;
>+    switch(x) {
>+        case 10:
>+            let y = 40;
>+            assert(y === 40);
>+        case 20:
>+            y += 1;
>+            assert(y === 41);
>+            result = function() { return y; };
>+            break;
>+        default:
>+            result = x;
>+            break;
>+    }
>+    assert(y === 50);
>+    return result;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    assert(foo(10)() === 41);
>+}
>+
>+assert(foo("hello") === "hello");
>+})();
>Index: Source/JavaScriptCore/tests/stress/lexical-let-tdz.js
>===================================================================
>--- Source/JavaScriptCore/tests/stress/lexical-let-tdz.js	(revision 0)
>+++ Source/JavaScriptCore/tests/stress/lexical-let-tdz.js	(working copy)
>@@ -0,0 +1,428 @@
>+"use strict";
>+
>+function truth() {
>+    return true;
>+}
>+noInline(truth);
>+
>+function assert(cond) {
>+    if (!cond)
>+        throw new Error("broke assertion");
>+}
>+noInline(assert);
>+
>+function shouldThrowTDZ(func) {
>+    var hasThrown = false;
>+    try {
>+        func();
>+    } catch(e) {
>+        if (e.name.indexOf("ReferenceError") !== -1)
>+            hasThrown = true;
>+    }
>+    assert(hasThrown);
>+}
>+noInline(shouldThrowTDZ);
>+
>+
>+;(function() {
>+function foo() {
>+    x;
>+    let x = 20;
>+}
>+function bar() {
>+    let x = x;
>+}
>+function baz() {
>+    let {x: prop, y: prop2} = {x: prop};
>+}
>+function jaz() {
>+    let {x: prop, y: prop2} = {x: 20, y: prop};
>+}
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+    shouldThrowTDZ(bar);
>+    shouldThrowTDZ(baz);
>+    shouldThrowTDZ(jaz);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    x;
>+    let x = 20;
>+    function captureX() { return x; }
>+}
>+function bar() {
>+    captureX();
>+    let x = 20;
>+    function captureX() { return x; }
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+    shouldThrowTDZ(bar);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    if (truth()) {
>+        let x = 20;
>+        assert(x === 20);
>+    }
>+    x;
>+    let x = 20;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+}
>+})();
>+
>+
>+
>+;(function() {
>+function foo() {
>+    if (truth()) {
>+        let y = 20;
>+        let captureY = function() { return y; }
>+        assert(y === 20);
>+        x;
>+    }
>+    let x = 20;
>+    let y;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    if (truth()) {
>+        let y = 20;
>+        let x = 40;
>+        let captureAll = function() { return x + y; }
>+        //noInline(captureAll);
>+        assert(y === 20);
>+        assert(x === 40);
>+        assert(captureAll() === 60);
>+    }
>+    tdz;
>+    let tdz = 20;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    if (truth()) {
>+        let y = 20;
>+        let x = 40;
>+        let captureAll = function() { return x + y + tdz; }
>+        assert(y === 20);
>+        assert(x === 40);
>+    }
>+    tdz;
>+    let tdz = 20;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    x = 10;
>+    let x = 20;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    x = 10;
>+    let x = 20;
>+    function cap() { return x; }
>+}
>+function bar() {
>+    captureX();
>+    let x = 20;
>+    function captureX() { return x; }
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+    shouldThrowTDZ(bar);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    if (!truth()) {
>+        y;
>+        assert(false);
>+    }
>+    let y;
>+    assert(y === undefined);
>+    if (truth()) {
>+        x;
>+    }
>+    let x;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    eval("x;");
>+    let x = 20;
>+}
>+function bar() {
>+    function captureX() { return x; }
>+    eval("captureX();");
>+    let x = 20;
>+}
>+function baz() {
>+    function captureX() { return x; }
>+    function other() { return captureX; }
>+    other()();
>+    let x = 20;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+    shouldThrowTDZ(bar);
>+    shouldThrowTDZ(baz);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    let y;
>+    eval("y; x;");
>+    let x = 20;
>+}
>+
>+for (var i = 0; i < 1; i++) {
>+    shouldThrowTDZ(foo);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    let x = 20;
>+    let y = 40;
>+    assert(eval("x;") === 20);
>+    if (truth()) {
>+        assert(eval("eval('y');") === 40);
>+        eval("eval('x');");
>+        let x = 40;
>+    }
>+}
>+
>+for (var i = 0; i < 1; i++) {
>+    shouldThrowTDZ(foo);
>+}
>+})();
>+
>+
>+// FunctionResolveNode
>+;(function() {
>+function foo() {
>+    function captureX() { return x; }
>+    x();
>+    let x = function() { return 20; };
>+}
>+
>+function bar() {
>+    x();
>+    let x = function() { return 20; };
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+    shouldThrowTDZ(bar);
>+}
>+})();
>+
>+
>+// TypeofResolveNode
>+;(function() {
>+function foo() {
>+    function captureX() { return x; }
>+    typeof x;
>+    let x = function() { return 20; };
>+}
>+
>+function bar() {
>+    typeof x;
>+    let x = function() { return 20; };
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+    shouldThrowTDZ(bar);
>+}
>+})();
>+
>+
>+// ReadModifyResolveNode
>+;(function() {
>+function foo() {
>+    function captureX() { return x; }
>+    x++;
>+    let x = 20;
>+}
>+
>+function bar() {
>+    x--;
>+    let x = 30;
>+}
>+
>+function baz() {
>+    x *= 40;
>+    let x = 30;
>+}
>+
>+function kaz() {
>+    function captureX() { return x; }
>+    x /= 20;
>+    let x = 20;
>+}
>+
>+function haz() {
>+    function captureX() { return x; }
>+    --x;
>+    let x = 20;
>+}
>+
>+function jaz() {
>+    --x;
>+    let x = 30;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+    shouldThrowTDZ(bar);
>+    shouldThrowTDZ(baz);
>+    shouldThrowTDZ(kaz);
>+    shouldThrowTDZ(haz);
>+    shouldThrowTDZ(jaz);
>+}
>+})();
>+
>+
>+;(function() {
>+function foo(x) {
>+    let y = 50;
>+    let result = null;
>+    switch(x) {
>+        case 10:
>+            let y = 40;
>+            assert(y === 40);
>+        case 20:
>+            y += 1;
>+            assert(y === 41);
>+            result = y;
>+            break;
>+        default:
>+            result = x;
>+            break;
>+    }
>+    assert(y === 50);
>+    return result;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(function() { foo(20);});
>+}
>+
>+assert(foo(10) === 41);
>+assert(foo("hello") === "hello");
>+})();
>+
>+
>+;(function() {
>+function foo() {
>+    let y;
>+    [y] = [40];
>+    assert(y === 40);
>+
>+    [x] = [1];
>+    let x;
>+}
>+
>+function boo() {
>+    let y;
>+    [y] = [40];
>+    assert(y === 40);
>+
>+    [x] = [1];
>+    let x;
>+    function capX() { return x; }
>+}
>+
>+function bar() {
>+    let x;
>+    ({p: x} = {p: 40});
>+    assert(x === 40);
>+
>+    ({a, p: y} = {a: 100, p: 40});
>+    let y;
>+}
>+
>+function zar() {
>+    let x;
>+    ({p: x} = {p: 40});
>+    assert(x === 40);
>+
>+    ({a, p: y} = {a: 100, p: 40});
>+    let y;
>+    function capY() { return y; }
>+}
>+
>+function baz() {
>+    let x;
>+    ({p: x} = {p: 40});
>+    assert(x === 40);
>+
>+    ({a, p: {y}} = {a: 100, p: {p: {y: 40}}});
>+    let y;
>+}
>+
>+function jaz() {
>+    ({y} = {});
>+    let y;
>+}
>+
>+for (var i = 0; i < 1000; i++) {
>+    shouldThrowTDZ(foo);
>+    shouldThrowTDZ(boo);
>+    shouldThrowTDZ(bar);
>+    shouldThrowTDZ(zar);
>+    shouldThrowTDZ(baz);
>+    shouldThrowTDZ(jaz);
>+}
>+})();
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 186144)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,24 @@
>+2015-06-30  Saam barati  <saambarati1@gmail.com>
>+
>+        [ES6] implement block scoping to enable 'let'
>+        https://bugs.webkit.org/show_bug.cgi?id=142944
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * js/dom/reserved-words-as-property-expected.txt:
>+        * js/keywords-and-reserved_words-expected.txt:
>+        * js/let-syntax-expected.txt: Added.
>+        * js/let-syntax.html: Added.
>+        * js/reserved-words-strict-expected.txt:
>+        * js/script-tests/keywords-and-reserved_words.js:
>+        * js/script-tests/let-syntax.js: Added.
>+        (truth):
>+        (assert):
>+        (hasSyntaxError):
>+        (shouldHaveSyntaxError):
>+        (shouldNotHaveSyntaxError):
>+        * js/script-tests/reserved-words-strict.js:
>+
> 2015-06-30  Chris Dumez  <cdumez@apple.com>
> 
>         Unreviewed, revert bad WK1 rebaseline done in r186106.
>Index: LayoutTests/js/keywords-and-reserved_words-expected.txt
>===================================================================
>--- LayoutTests/js/keywords-and-reserved_words-expected.txt	(revision 186105)
>+++ LayoutTests/js/keywords-and-reserved_words-expected.txt	(working copy)
>@@ -60,13 +60,14 @@ PASS classifyIdentifier("import") is "ke
> PASS classifyIdentifier("super") is "keyword"
> PASS classifyIdentifier("implements") is "strict"
> PASS classifyIdentifier("interface") is "strict"
>-PASS classifyIdentifier("let") is "strict"
> PASS classifyIdentifier("package") is "strict"
> PASS classifyIdentifier("private") is "strict"
> PASS classifyIdentifier("protected") is "strict"
> PASS classifyIdentifier("public") is "strict"
> PASS classifyIdentifier("static") is "strict"
> PASS classifyIdentifier("yield") is "strict"
>+PASS isKeyword("let") is false
>+PASS isStrictKeyword("let") is true
> PASS successfullyParsed is true
> 
> TEST COMPLETE
>Index: LayoutTests/js/let-syntax-expected.txt
>===================================================================
>--- LayoutTests/js/let-syntax-expected.txt	(revision 0)
>+++ LayoutTests/js/let-syntax-expected.txt	(working copy)
>@@ -0,0 +1,52 @@
>+Tests for ES6 "let"
>+
>+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>+
>+
>+PASS Does not have syntax error: 'let x = 20; if (truth()) { let x = 30; }'
>+PASS Does not have syntax error: 'let {x} = {x:20}; if (truth()) { let {x} = {x : 20}; }'
>+PASS Does not have syntax error: 'let {x} = {x:20}; if (truth()) { let {y: x} = {y : 20}; }'
>+PASS Does not have syntax error: 'let {x, y: [arr]} = {x:20, y: [10]}; if (truth()) { let {y: x} = {y : 20}; }'
>+PASS Does not have syntax error: 'let i = 40; for (let i = 1; i < 2; i++) { let i = 40; i; }'
>+PASS Does not have syntax error: 'let i = 40; let obj = {}; for (let i in obj) { let i = 40; let obj = {}; i; }'
>+PASS Does not have syntax error: 'let i = 40; let obj = []; for (let i of obj) { let i = 40; let obj = {}; i; }'
>+PASS Does not have syntax error: 'let {i} = 20; let obj = []; for (let {i} of obj) { let i = 40; let obj = {}; i; }'
>+PASS Does not have syntax error: 'let {i} = 20; let obj = []; for (let {i} in obj) { let i = 40; let obj = {}; i; }'
>+PASS Does not have syntax error: 'let {i} = 20; let obj = []; for (let {i} = {i: 0}; i < 2; i++) { let i = 40; let obj = {}; i; }'
>+PASS Does not have syntax error: 'function foo() { let foo = 20; }'
>+PASS Does not have syntax error: 'function foo(bar) { if (truth()) { let bar; } }'
>+PASS Does not have syntax error: 'function foo() { var bar; if (truth()) { let bar; } }'
>+PASS Has syntax error: 'let let;'
>+PASS Has syntax error: 'let {let};'
>+PASS Has syntax error: 'let {l: let};'
>+PASS Has syntax error: 'let {l: {let}};'
>+PASS Has syntax error: 'let {l: [let]};'
>+PASS Has syntax error: 'var {let};'
>+PASS Has syntax error: 'var let;'
>+PASS Has syntax error: '(function test(let){})'
>+PASS Has syntax error: 'let;'
>+PASS Has syntax error: 'let x, x;'
>+PASS Has syntax error: 'let x = 20, y, x = 40;'
>+PASS Has syntax error: 'let x = 20, y; let x = 40;'
>+PASS Has syntax error: 'let x = 20, y, {x} = {};'
>+PASS Has syntax error: 'let x = 20, y; let {x} = {};'
>+PASS Has syntax error: 'let {x, y, z, x} = {};'
>+PASS Has syntax error: 'let {x: xx, y, x: xx} = {};'
>+PASS Has syntax error: 'let {x: xx,  foo: [xx]} = {foo:[12]};'
>+PASS Has syntax error: 'let {x: xx,  foo: {y: xx}} = {foo:[12]};'
>+PASS Has syntax error: 'for (let; ; ) {}'
>+PASS Has syntax error: 'let arr = []; for (let    of arr) {}'
>+PASS Has syntax error: 'let obj = {}; for (let    in arr) {}'
>+PASS Has syntax error: 'for (let i = 20, j = 40, i = 10; i < 10; i++) {}'
>+PASS Has syntax error: 'let x = 20; if (truth()) let x = 40;'
>+PASS Has syntax error: 'let baz = 20; if (truth()) { let x = 20; let x = 40;} '
>+PASS Has syntax error: 'function foo() { var bar; let bar; }'
>+PASS Has syntax error: 'function foo(bar) { let bar; }'
>+PASS Has syntax error: 'function foo() {}; let foo;'
>+PASS Has syntax error: 'function foo() {}; function bar(){} let baz, {bar} = {};'
>+PASS Has syntax error: 'function foo() {}; function bar(){} let baz, {f: {bar}} = {f:{}};'
>+PASS Has syntax error: 'function foo() {}; function bar(){} let baz, {f: [bar]} = {f:[10]};'
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>Index: LayoutTests/js/let-syntax.html
>===================================================================
>--- LayoutTests/js/let-syntax.html	(revision 0)
>+++ LayoutTests/js/let-syntax.html	(working copy)
>@@ -0,0 +1,8 @@
>+<!DOCTYPE html>
>+<html>
>+<body>
>+<script src="../resources/js-test-pre.js"></script>
>+<script src="script-tests/let-syntax.js"></script>
>+<script src="../resources/js-test-post.js"></script>
>+</body>
>+</html>
>Index: LayoutTests/js/reserved-words-strict-expected.txt
>===================================================================
>--- LayoutTests/js/reserved-words-strict-expected.txt	(revision 186105)
>+++ LayoutTests/js/reserved-words-strict-expected.txt	(working copy)
>@@ -6,7 +6,6 @@ On success, you will see a series of "PA
> SHOULD BE RESERVED:
> PASS isReserved('implements') is true
> PASS isReserved('interface') is true
>-PASS isReserved('let') is true
> PASS isReserved('package') is true
> PASS isReserved('private') is true
> PASS isReserved('protected') is true
>Index: LayoutTests/js/dom/reserved-words-as-property-expected.txt
>===================================================================
>--- LayoutTests/js/dom/reserved-words-as-property-expected.txt	(revision 186105)
>+++ LayoutTests/js/dom/reserved-words-as-property-expected.txt	(working copy)
>@@ -1353,18 +1353,18 @@ PASS ({ let: 42 }.let === 42) is true
> PASS (function(){({ let: 42 }.let === 42)}); true is true
> PASS ({ get let(){}, set let(x){}, parsedOkay: 42 }.parsedOkay === 42) is true
> PASS (function(){({ get let(){}, set let(x){}, parsedOkay: 42 }.parsedOkay === 42)}); true is true
>-PASS "use strict";var let; true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS (function(){"use strict";var let; true}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS "use strict";var let = 42; let === 42 threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS (function(){"use strict";var let = 42; let === 42}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS "use strict";function g(let){ "use strict"; }; true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS (function(){"use strict";function g(let){ "use strict"; }; true}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS "use strict";/let/.test(function g(let){ "use strict"; }) threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS (function(){"use strict";/let/.test(function g(let){ "use strict"; })}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a variable name in strict mode..
>-PASS "use strict";try{}catch(let){}; true threw exception SyntaxError: Cannot use the reserved word 'let' as a catch variable name in strict mode..
>-PASS (function(){"use strict";try{}catch(let){}; true}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a catch variable name in strict mode..
>-PASS "use strict";function let(){ "use strict"; }; true threw exception SyntaxError: Cannot use the reserved word 'let' as a function name in strict mode..
>-PASS (function(){"use strict";function let(){ "use strict"; }; true}); true threw exception SyntaxError: Cannot use the reserved word 'let' as a function name in strict mode..
>+PASS "use strict";var let; true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS (function(){"use strict";var let; true}); true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS "use strict";var let = 42; let === 42 threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS (function(){"use strict";var let = 42; let === 42}); true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS "use strict";function g(let){ "use strict"; }; true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS (function(){"use strict";function g(let){ "use strict"; }; true}); true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS "use strict";/let/.test(function g(let){ "use strict"; }) threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS (function(){"use strict";/let/.test(function g(let){ "use strict"; })}); true threw exception SyntaxError: Cannot use the keyword 'let' as a variable name..
>+PASS "use strict";try{}catch(let){}; true threw exception SyntaxError: Cannot use the keyword 'let' as a catch variable name..
>+PASS (function(){"use strict";try{}catch(let){}; true}); true threw exception SyntaxError: Cannot use the keyword 'let' as a catch variable name..
>+PASS "use strict";function let(){ "use strict"; }; true threw exception SyntaxError: Cannot use the keyword 'let' as a function name..
>+PASS (function(){"use strict";function let(){ "use strict"; }; true}); true threw exception SyntaxError: Cannot use the keyword 'let' as a function name..
> PASS "use strict";({ "let": 42 }.let === 42) is true
> PASS (function(){"use strict";({ "let": 42 }.let === 42)}); true is true
> PASS "use strict";({ let: 42 }.let === 42) is true
>Index: LayoutTests/js/script-tests/keywords-and-reserved_words.js
>===================================================================
>--- LayoutTests/js/script-tests/keywords-and-reserved_words.js	(revision 186105)
>+++ LayoutTests/js/script-tests/keywords-and-reserved_words.js	(working copy)
>@@ -104,10 +104,15 @@ shouldBe('classifyIdentifier("super")', 
> // Future Reserved Words, in strict mode only.
> shouldBe('classifyIdentifier("implements")', '"strict"');
> shouldBe('classifyIdentifier("interface")', '"strict"');
>-shouldBe('classifyIdentifier("let")', '"strict"');
> shouldBe('classifyIdentifier("package")', '"strict"');
> shouldBe('classifyIdentifier("private")', '"strict"');
> shouldBe('classifyIdentifier("protected")', '"strict"');
> shouldBe('classifyIdentifier("public")', '"strict"');
> shouldBe('classifyIdentifier("static")', '"strict"');
> shouldBe('classifyIdentifier("yield")', '"strict"');
>+
>+// This is in a class of its own because it's treated as a keyword
>+// in strict-mode and not a keyword in sloppy mode 
>+// (non-keyword in sloppy mode is temporary).
>+shouldBeFalse('isKeyword("let")');
>+shouldBeTrue('isStrictKeyword("let")');
>Index: LayoutTests/js/script-tests/let-syntax.js
>===================================================================
>--- LayoutTests/js/script-tests/let-syntax.js	(revision 0)
>+++ LayoutTests/js/script-tests/let-syntax.js	(working copy)
>@@ -0,0 +1,81 @@
>+"use strict";
>+
>+description('Tests for ES6 "let"');
>+
>+function truth() { return true; }
>+noInline(truth);
>+
>+function assert(cond) {
>+    if (!cond)
>+        throw new Error("Broke assertion");
>+}
>+
>+function hasSyntaxError(str) {
>+    let hadError = false;
>+    try {
>+        eval(str);
>+    } catch(e) {
>+        if (e.name === "SyntaxError") {
>+            hadError = true;
>+        }
>+    }
>+    return hadError; 
>+}
>+
>+function shouldHaveSyntaxError(str) {
>+    assert(hasSyntaxError(str));
>+    assert(hasSyntaxError("function dummy() { " + str + " }"));
>+    testPassed("Has syntax error: '" + str + "'");
>+}
>+
>+
>+function shouldNotHaveSyntaxError(str) {
>+    assert(!hasSyntaxError(str));
>+    assert(!hasSyntaxError("(function dummy() { " + str + " })"));
>+    testPassed("Does not have syntax error: '" + str + "'");
>+}
>+
>+shouldNotHaveSyntaxError("let x = 20; if (truth()) { let x = 30; }");
>+shouldNotHaveSyntaxError("let {x} = {x:20}; if (truth()) { let {x} = {x : 20}; }");
>+shouldNotHaveSyntaxError("let {x} = {x:20}; if (truth()) { let {y: x} = {y : 20}; }");
>+shouldNotHaveSyntaxError("let {x, y: [arr]} = {x:20, y: [10]}; if (truth()) { let {y: x} = {y : 20}; }");
>+shouldNotHaveSyntaxError("let i = 40; for (let i = 1; i < 2; i++) { let i = 40; i; }");
>+shouldNotHaveSyntaxError("let i = 40; let obj = {}; for (let i in obj) { let i = 40; let obj = {}; i; }");
>+shouldNotHaveSyntaxError("let i = 40; let obj = []; for (let i of obj) { let i = 40; let obj = {}; i; }");
>+shouldNotHaveSyntaxError("let {i} = 20; let obj = []; for (let {i} of obj) { let i = 40; let obj = {}; i; }");
>+shouldNotHaveSyntaxError("let {i} = 20; let obj = []; for (let {i} in obj) { let i = 40; let obj = {}; i; }");
>+shouldNotHaveSyntaxError("let {i} = 20; let obj = []; for (let {i} = {i: 0}; i < 2; i++) { let i = 40; let obj = {}; i; }");
>+shouldNotHaveSyntaxError("function foo() { let foo = 20; }");
>+shouldNotHaveSyntaxError("function foo(bar) { if (truth()) { let bar; } }");
>+shouldNotHaveSyntaxError("function foo() { var bar; if (truth()) { let bar; } }");
>+
>+shouldHaveSyntaxError("let let;");
>+shouldHaveSyntaxError("let {let};");
>+shouldHaveSyntaxError("let {l: let};");
>+shouldHaveSyntaxError("let {l: {let}};");
>+shouldHaveSyntaxError("let {l: [let]};");
>+shouldHaveSyntaxError("var {let};");
>+shouldHaveSyntaxError("var let;");
>+shouldHaveSyntaxError("(function test(let){})");
>+shouldHaveSyntaxError("let;");
>+shouldHaveSyntaxError("let x, x;");
>+shouldHaveSyntaxError("let x = 20, y, x = 40;");
>+shouldHaveSyntaxError("let x = 20, y; let x = 40;");
>+shouldHaveSyntaxError("let x = 20, y, {x} = {};");
>+shouldHaveSyntaxError("let x = 20, y; let {x} = {};");
>+shouldHaveSyntaxError("let {x, y, z, x} = {};");
>+shouldHaveSyntaxError("let {x: xx, y, x: xx} = {};");
>+shouldHaveSyntaxError("let {x: xx,  foo: [xx]} = {foo:[12]};");
>+shouldHaveSyntaxError("let {x: xx,  foo: {y: xx}} = {foo:[12]};");
>+shouldHaveSyntaxError("for (let; ; ) {}");
>+shouldHaveSyntaxError("let arr = []; for (let    of arr) {}");
>+shouldHaveSyntaxError("let obj = {}; for (let    in arr) {}");
>+shouldHaveSyntaxError("for (let i = 20, j = 40, i = 10; i < 10; i++) {}");
>+shouldHaveSyntaxError("let x = 20; if (truth()) let x = 40;");
>+shouldHaveSyntaxError("let baz = 20; if (truth()) { let x = 20; let x = 40;} ");
>+shouldHaveSyntaxError("function foo() { var bar; let bar; }");
>+shouldHaveSyntaxError("function foo(bar) { let bar; }");
>+shouldHaveSyntaxError("function foo() {}; let foo;");
>+shouldHaveSyntaxError("function foo() {}; function bar(){} let baz, {bar} = {};");
>+shouldHaveSyntaxError("function foo() {}; function bar(){} let baz, {f: {bar}} = {f:{}};");
>+shouldHaveSyntaxError("function foo() {}; function bar(){} let baz, {f: [bar]} = {f:[10]};");
>Index: LayoutTests/js/script-tests/reserved-words-strict.js
>===================================================================
>--- LayoutTests/js/script-tests/reserved-words-strict.js	(revision 186105)
>+++ LayoutTests/js/script-tests/reserved-words-strict.js	(working copy)
>@@ -16,7 +16,6 @@ function isReserved(word)
> 
> var reservedWords = [
>     "implements",
>-    "let",
>     "private",
>     "public",
>     "yield",

Actions: View | Formatted Diff | Diff

Attachments on bug 142944: 249945 | 249961 | 250169 | 250230 | 250533 | 250684 | 250714 | 250715 | 251081 | 251130 | 251133 | 251136 | 251409 | 251653 | 251913 | 252074 | 253066 | 253070 | 253115 | 253794 | 255536 | 255614 | 255622 | 255804 | 255806 | 255807 | 255830 | 255834 | 255835 | 255871 | 256033 | 256036 | 256226 | 256232 | 256233 | 256257 | 256264 | 256267 | 256433 | 256438 | 256445 | 256450 | 256465 | 256481 | 256658 | 256860