<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[193606] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/193606">193606</a></dd>
<dt>Author</dt> <dd>ddkilzer@apple.com</dd>
<dt>Date</dt> <dd>2015-12-06 17:54:43 -0800 (Sun, 06 Dec 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>REGRESSION(<a href="http://trac.webkit.org/projects/webkit/changeset/193584">r193584</a>): Causes heap use-after-free crashes in Web Inspector tests with AddressSanitizer (Requested by ddkilzer on #webkit).
https://bugs.webkit.org/show_bug.cgi?id=151929

Reverted changeset:

&quot;[ES6] &quot;super&quot; and &quot;this&quot; should be lexically bound inside an
arrow function and should live in a JSLexicalEnvironment&quot;
https://bugs.webkit.org/show_bug.cgi?id=149338
http://trac.webkit.org/changeset/193584</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsjsarrowfunctiontdzexpectedtxt">trunk/LayoutTests/js/arrowfunction-tdz-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsscripttestsarrowfunctiontdzjs">trunk/LayoutTests/js/script-tests/arrowfunction-tdz.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsBuiltinExecutablescpp">trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeListjson">trunk/Source/JavaScriptCore/bytecode/BytecodeList.json</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeUseDefh">trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeEvalCodeCacheh">trunk/Source/JavaScriptCore/bytecode/EvalCodeCache.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeExecutableInfoh">trunk/Source/JavaScriptCore/bytecode/ExecutableInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeUnlinkedCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeUnlinkedCodeBlockh">trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeUnlinkedFunctionExecutablecpp">trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeUnlinkedFunctionExecutableh">trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerNodesCodegencpp">trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerCallFramecpp">trunk/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCapabilitiescpp">trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGObjectAllocationSinkingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPromotedHeapLocationcpp">trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPromotedHeapLocationh">trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLOperationscpp">trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterInterpretercpp">trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITh">trunk/Source/JavaScriptCore/jit/JIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodescpp">trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodes32_64cpp">trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserASTBuilderh">trunk/Source/JavaScriptCore/parser/ASTBuilder.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserNodesh">trunk/Source/JavaScriptCore/parser/Nodes.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserParsercpp">trunk/Source/JavaScriptCore/parser/Parser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserParserModesh">trunk/Source/JavaScriptCore/parser/ParserModes.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCodeCachecpp">trunk/Source/JavaScriptCore/runtime/CodeCache.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCodeCacheh">trunk/Source/JavaScriptCore/runtime/CodeCache.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonIdentifiersh">trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutablecpp">trunk/Source/JavaScriptCore/runtime/Executable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutableh">trunk/Source/JavaScriptCore/runtime/Executable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjecth">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoretestses6yaml">trunk/Source/JavaScriptCore/tests/es6.yaml</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionactivationsinkosrexitjs">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-activation-sink-osrexit.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionactivationsinkjs">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-activation-sink.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindthis1js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-this-1.js</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctiontdzjs">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz.js</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsarrowfunctionsupercallexpectedtxt">trunk/LayoutTests/js/arrowfunction-supercall-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsarrowfunctionsupercallhtml">trunk/LayoutTests/js/arrowfunction-supercall.html</a></li>
<li><a href="#trunkLayoutTestsjsscripttestsarrowfunctionsupercalljs">trunk/LayoutTests/js/script-tests/arrowfunction-supercall.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindnewtargetjs">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-newtarget.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindsupercall1js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-1.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindsupercall2js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-2.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindsupercall3js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-3.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindsupercall4js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-4.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindthis7js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-this-7.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctiontdz1js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-1.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctiontdz2js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-2.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctiontdz3js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-3.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrowfunctiontdz4js">trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-4.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/LayoutTests/ChangeLog        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2015-12-06  David Kilzer  &lt;ddkilzer@apple.com&gt;
+
+        REGRESSION(r193584): Causes heap use-after-free crashes in Web Inspector tests with AddressSanitizer (Requested by ddkilzer on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=151929
+
+        Reverted changeset:
+
+        &quot;[ES6] &quot;super&quot; and &quot;this&quot; should be lexically bound inside an
+        arrow function and should live in a JSLexicalEnvironment&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=149338
+        http://trac.webkit.org/changeset/193584
+
</ins><span class="cx"> 2015-12-06  Skachkov Oleksandr  &lt;gskachkov@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [ES6] &quot;super&quot; and &quot;this&quot; should be lexically bound inside an arrow function and should live in a JSLexicalEnvironment
</span></span></pre></div>
<a id="trunkLayoutTestsjsarrowfunctionsupercallexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/arrowfunction-supercall-expected.txt (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/arrowfunction-supercall-expected.txt        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/LayoutTests/js/arrowfunction-supercall-expected.txt        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,27 +0,0 @@
</span><del>-Tests for ES6 arrow function, calling of the super in arrow function
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS isReferenceError is true
-PASS b.id is value
-PASS isReferenceError is true
-PASS d1.id is &quot;b&quot;
-PASS d2.id is value
-PASS (new D()).id is value
-PASS (new E(false)).id is value
-PASS typeof (new E(true)).id is 'undefined'
-PASS (new F(false)).id is value
-PASS typeof (new F(true)).id is 'undefined'
-PASS indexOfParentClassInStackError &lt; indexOfnestedArrowInStackError is true
-PASS indexOfnestedArrowInStackError &lt; indexOfarrowInChildConstructorInStackError is true
-PASS indexOfarrowInChildConstructorInStackError &lt; indexOfChildClassInStackError is true
-PASS indexOfChildClassInStackError &gt; 0 is true
-PASS indexOfParentClassInStackError &gt; -1 &amp;&amp; errorStack.indexOf('ParentClass', indexOfParentClassInStackError + 1) === -1 is true
-PASS indexOfnestedArrowInStackError &gt; -1 &amp;&amp; errorStack.indexOf('nestedArrow', indexOfnestedArrowInStackError + 1) === -1 is true
-PASS indexOfarrowInChildConstructorInStackError &gt; -1 &amp;&amp; errorStack.indexOf('arrowInChildConstructor', indexOfarrowInChildConstructorInStackError + 1) === -1 is true
-PASS indexOfChildClassInStackError &gt; -1 &amp;&amp; errorStack.indexOf('ChildClass', indexOfChildClassInStackError + 1) === -1 is true
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsarrowfunctionsupercallhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/arrowfunction-supercall.html (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/arrowfunction-supercall.html        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/LayoutTests/js/arrowfunction-supercall.html        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;script-tests/arrowfunction-supercall.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsarrowfunctiontdzexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/arrowfunction-tdz-expected.txt (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/arrowfunction-tdz-expected.txt        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/LayoutTests/js/arrowfunction-tdz-expected.txt        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -4,14 +4,6 @@
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> PASS isReferenceError is true
</span><del>-PASS isReferenceError is true
-PASS d.id is 'a'
-PASS e.id is 'a'
-PASS f.id is 'a'
-PASS isReferenceError is true
-PASS g.id is 'a'
-PASS h.id is 'a'
-PASS i.id is 'a'
</del><span class="cx"> PASS successfullyParsed is true
</span><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span></span></pre></div>
<a id="trunkLayoutTestsjsscripttestsarrowfunctionsupercalljs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/script-tests/arrowfunction-supercall.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/script-tests/arrowfunction-supercall.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/LayoutTests/js/script-tests/arrowfunction-supercall.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,151 +0,0 @@
</span><del>-description('Tests for ES6 arrow function, calling of the super in arrow function');
-
-var value = 'abcd-1234';
-
-var A = class A {
-  constructor() {
-    this.id = value;
-  }
-};
-
-var B = class B extends A {
-  constructor(accessThisBeforeSuper) {
-    var f = () =&gt;  { super(); };
-    if (accessThisBeforeSuper) {
-      if (this.id !== value) throw new Error('Should be reference error because of TDZ');
-      f();
-    } else {
-      f();
-      if (this.id !== value) throw new Error('wrong value');
-    }
-  }
-};
-
-var isReferenceError = false;
-try {
-    new B(true);
-} catch (e) {
-    isReferenceError = e instanceof ReferenceError;
-}
-
-shouldBe('isReferenceError', 'true');
-
-var b = new B(false);
-shouldBe('b.id', 'value');
-
-var C = class C extends A {
-  constructor(runSuperInConstructor, forceTDZ) {
-    var f1 = () =&gt;  { if (!forceTDZ) super();  this.id = 'b'; };
-    var f2 = () =&gt;  { if (this.id !== 'b') throw new Error('wrong bound of the this'); };
-    var f3 = () =&gt;  { if (this.id !== value) throw new Error('wrong bound of the this'); };
-
-    if (runSuperInConstructor) {
-      super();
-      f3();
-    } else {
-      f1();
-      f2();
-    }
-  }
-};
-
-isReferenceError = false;
-try {
-    new C(false, true);
-} catch (e) {
-    isReferenceError = e instanceof ReferenceError;
-}
-shouldBe('isReferenceError', 'true');
-var d1 = new C(false, false);
-shouldBe('d1.id', '&quot;b&quot;');
-
-var d2 = new C(true, false);
-shouldBe('d2.id', 'value');
-
-var D = class D extends A {
-  constructor () {
-    var arrow = () =&gt; {
-      let __proto__ = 'some-text';
-      var arr = () =&gt; {
-          let value = __proto__ + 'text';
-          super();
-      };
-
-      arr();
-    };
-
-    arrow();
-  }
-};
-shouldBe('(new D()).id', 'value');
-
-class E extends A {
-  constructor(doReplaceProto) {
-    var arrow = () =&gt; {
-      if (doReplaceProto)
-        E.__proto__ = function () {};
-      super();
-    };
-
-    arrow();
-  }
-};
-shouldBe('(new E(false)).id', &quot;value&quot;);
-shouldBe('typeof (new E(true)).id', &quot;'undefined'&quot;);
-
-class F extends A {
-  constructor(doReplaceProto) {
-    var arrow = () =&gt; super();
-    if (doReplaceProto)
-      F.__proto__ = function () {};
-    arrow();
-  }
-};
-shouldBe('(new F(false)).id', &quot;value&quot;);
-shouldBe('typeof (new F(true)).id',  &quot;'undefined'&quot;);
-
-var errorStack;
-
-var ParentClass = class ParentClass {
-  constructor() {
-    try {
-      this.idValue = testValue;
-      throw new Error('Error');
-    } catch (e) {
-      errorStack  = e.stack;
-    }
-  }
-};
-
-var ChildClass = class ChildClass extends ParentClass {
-  constructor () {
-    var arrowInChildConstructor = () =&gt; {
-      var nestedArrow = () =&gt; {
-        super();
-      }
-
-      nestedArrow();
-    };
-
-    arrowInChildConstructor();
-  }
-};
-
-var c = new ChildClass();
-
-var indexOfParentClassInStackError = errorStack.indexOf('ParentClass');
-var indexOfnestedArrowInStackError = errorStack.indexOf('nestedArrow');
-var indexOfarrowInChildConstructorInStackError = errorStack.indexOf('arrowInChildConstructor');
-var indexOfChildClassInStackError = errorStack.indexOf('ChildClass');
-
-shouldBeTrue(&quot;indexOfParentClassInStackError &lt; indexOfnestedArrowInStackError&quot;);
-shouldBeTrue(&quot;indexOfnestedArrowInStackError &lt; indexOfarrowInChildConstructorInStackError&quot;);
-shouldBeTrue(&quot;indexOfarrowInChildConstructorInStackError &lt; indexOfChildClassInStackError&quot;);
-shouldBeTrue(&quot;indexOfChildClassInStackError &gt; 0&quot;);
-
-shouldBeTrue(&quot;indexOfParentClassInStackError &gt; -1 &amp;&amp; errorStack.indexOf('ParentClass', indexOfParentClassInStackError + 1) === -1&quot;);
-shouldBeTrue(&quot;indexOfnestedArrowInStackError &gt; -1 &amp;&amp; errorStack.indexOf('nestedArrow', indexOfnestedArrowInStackError + 1) === -1&quot;);
-shouldBeTrue(&quot;indexOfarrowInChildConstructorInStackError &gt; -1 &amp;&amp; errorStack.indexOf('arrowInChildConstructor', indexOfarrowInChildConstructorInStackError + 1) === -1&quot;);
-shouldBeTrue(&quot;indexOfChildClassInStackError &gt; -1 &amp;&amp; errorStack.indexOf('ChildClass', indexOfChildClassInStackError + 1) === -1&quot;);
-
-var successfullyParsed = true;
</del></span></pre></div>
<a id="trunkLayoutTestsjsscripttestsarrowfunctiontdzjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/script-tests/arrowfunction-tdz.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/script-tests/arrowfunction-tdz.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/LayoutTests/js/script-tests/arrowfunction-tdz.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,20 +1,13 @@
</span><span class="cx"> description('Tests for ES6 arrow function test tdz');
</span><span class="cx"> 
</span><del>-var A = class A {
-  constructor() {
-    this.id = 'a';
-  }
-};
-
</del><ins>+var A = class A { };
</ins><span class="cx"> var B = class B extends A {
</span><span class="cx">   constructor(accessThisBeforeSuper) {
</span><del>-    var f = () =&gt; this;
</del><span class="cx">     if (accessThisBeforeSuper) {
</span><del>-      f();
</del><ins>+      var f = () =&gt; this;
</ins><span class="cx">       super();
</span><span class="cx">     } else {
</span><span class="cx">       super();
</span><del>-      f();
</del><span class="cx">     }
</span><span class="cx">   }
</span><span class="cx"> };
</span><span class="lines">@@ -28,65 +21,6 @@
</span><span class="cx"> 
</span><span class="cx"> shouldBe('isReferenceError', 'true');
</span><span class="cx"> 
</span><del>-var a = new B(false);
</del><ins>+var e = new B(false);
</ins><span class="cx"> 
</span><del>-var D = class D extends A {
-  constructor(accessThisBeforeSuper, returnThis) {
-    var f = () =&gt; returnThis ? this : {};
-    if (accessThisBeforeSuper) {
-      let val = f();
-      super();
-    } else {
-      super();
-      let val = f();
-    }
-  }
-};
-
-isReferenceError = false;
-try {
-      new D(true, true);
-} catch (e) {
-      isReferenceError = e instanceof ReferenceError;
-}
-
-shouldBe('isReferenceError', 'true');
-
-var d = new D(false, true);
-shouldBe('d.id', &quot;'a'&quot;);
-var e = new D(false, false);
-shouldBe('e.id', &quot;'a'&quot;);
-var f = new D(true, false);
-shouldBe('f.id', &quot;'a'&quot;);
-
-var G = class G extends A {
-  constructor(accessThisBeforeSuper, returnThis) {
-    var f = () =&gt; returnThis ? (() =&gt; this ) : (()=&gt;{});
-    let af = f();
-    if (accessThisBeforeSuper) {
-      let result = af();
-      super();
-    } else {
-      super();
-      let result = af();
-    }
-  }
-};
-
-try {
-      new G(true, true);
-} catch (e) {
-    exception = e;
-    isReferenceError = e instanceof ReferenceError;
-}
-
-shouldBe('isReferenceError', 'true');
-
-var g = new G(false, true);
-shouldBe('g.id', &quot;'a'&quot;);
-var h = new G(false, false);
-shouldBe('h.id', &quot;'a'&quot;);
-var i = new G(true, false);
-shouldBe('i.id', &quot;'a'&quot;);
-
</del><span class="cx"> var successfullyParsed = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/ChangeLog        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2015-12-06  David Kilzer  &lt;ddkilzer@apple.com&gt;
+
+        REGRESSION(r193584): Causes heap use-after-free crashes in Web Inspector tests with AddressSanitizer (Requested by ddkilzer on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=151929
+
+        Reverted changeset:
+
+        &quot;[ES6] &quot;super&quot; and &quot;this&quot; should be lexically bound inside an
+        arrow function and should live in a JSLexicalEnvironment&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=149338
+        http://trac.webkit.org/changeset/193584
+
</ins><span class="cx"> 2015-12-06  Skachkov Oleksandr  &lt;gskachkov@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [es6] Arrow function syntax. Fix tests after 149338 landing
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsBuiltinExecutablescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -115,7 +115,7 @@
</span><span class="cx">     }
</span><span class="cx">     metadata-&gt;overrideName(name);
</span><span class="cx">     VariableEnvironment dummyTDZVariables;
</span><del>-    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&amp;vm, source, metadata, kind, constructAbility, GeneratorThisMode::NonEmpty, dummyTDZVariables, false, WTF::move(sourceOverride));
</del><ins>+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&amp;vm, source, metadata, kind, constructAbility, GeneratorThisMode::NonEmpty, dummyTDZVariables, WTF::move(sourceOverride));
</ins><span class="cx">     functionExecutable-&gt;setNameValue(vm, jsString(&amp;vm, name.string()));
</span><span class="cx">     return functionExecutable;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeListjson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeList.json (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx">             { &quot;name&quot; : &quot;op_new_func_exp&quot;, &quot;length&quot; : 4 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_new_generator_func&quot;, &quot;length&quot; : 4 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_new_generator_func_exp&quot;, &quot;length&quot; : 4 },
</span><del>-            { &quot;name&quot; : &quot;op_new_arrow_func_exp&quot;, &quot;length&quot; : 4 },
</del><ins>+            { &quot;name&quot; : &quot;op_new_arrow_func_exp&quot;, &quot;length&quot; : 5 },
</ins><span class="cx">             { &quot;name&quot; : &quot;op_call&quot;, &quot;length&quot; : 9 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_tail_call&quot;, &quot;length&quot; : 9 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_call_eval&quot;, &quot;length&quot; : 9 },
</span><span class="lines">@@ -129,6 +129,7 @@
</span><span class="cx">             { &quot;name&quot; : &quot;op_enumerator_structure_pname&quot;, &quot;length&quot; : 4 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_enumerator_generic_pname&quot;, &quot;length&quot; : 4 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_to_index_string&quot;, &quot;length&quot; : 3 },
</span><ins>+            { &quot;name&quot; : &quot;op_load_arrowfunction_this&quot;, &quot;length&quot; : 2 },
</ins><span class="cx">             { &quot;name&quot; : &quot;op_assert&quot;, &quot;length&quot; : 3 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_copy_rest&quot;, &quot;length&quot;: 4 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_get_rest_length&quot;, &quot;length&quot;: 3 },
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeUseDefh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -57,6 +57,7 @@
</span><span class="cx">         return;
</span><span class="cx">     case op_assert:
</span><span class="cx">     case op_get_scope:
</span><ins>+    case op_load_arrowfunction_this:
</ins><span class="cx">     case op_to_this:
</span><span class="cx">     case op_check_tdz:
</span><span class="cx">     case op_profile_will_call:
</span><span class="lines">@@ -392,6 +393,7 @@
</span><span class="cx">     case op_to_this:
</span><span class="cx">     case op_check_tdz:
</span><span class="cx">     case op_get_scope:
</span><ins>+    case op_load_arrowfunction_this:
</ins><span class="cx">     case op_create_direct_arguments:
</span><span class="cx">     case op_create_scoped_arguments:
</span><span class="cx">     case op_create_out_of_band_arguments:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -769,6 +769,11 @@
</span><span class="cx">             printLocationOpAndRegisterOperand(out, exec, location, it, &quot;get_scope&quot;, r0);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><ins>+        case op_load_arrowfunction_this: {
+            int r0 = (++it)-&gt;u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, &quot;load_arrowfunction_this&quot;, r0);
+            break;
+        }
</ins><span class="cx">         case op_create_direct_arguments: {
</span><span class="cx">             int r0 = (++it)-&gt;u.operand;
</span><span class="cx">             printLocationAndOp(out, exec, location, it, &quot;create_direct_arguments&quot;);
</span><span class="lines">@@ -1322,8 +1327,9 @@
</span><span class="cx">             int r0 = (++it)-&gt;u.operand;
</span><span class="cx">             int r1 = (++it)-&gt;u.operand;
</span><span class="cx">             int f0 = (++it)-&gt;u.operand;
</span><ins>+            int r2 = (++it)-&gt;u.operand;
</ins><span class="cx">             printLocationAndOp(out, exec, location, it, &quot;op_new_arrow_func_exp&quot;);
</span><del>-            out.printf(&quot;%s, %s, f%d&quot;, registerName(r0).data(), registerName(r1).data(), f0);
</del><ins>+            out.printf(&quot;%s, %s, f%d, %s&quot;, registerName(r0).data(), registerName(r1).data(), f0, registerName(r2).data());
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_new_func_exp: {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeEvalCodeCacheh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/EvalCodeCache.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/EvalCodeCache.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/EvalCodeCache.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -55,12 +55,11 @@
</span><span class="cx">             return nullptr;
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        EvalExecutable* getSlow(ExecState* exec, JSCell* owner, bool inStrictContext, ThisTDZMode thisTDZMode, bool isDerivedConstructorContext, bool isArrowFunctionContext, const SourceCode&amp; evalSource, JSScope* scope)
</del><ins>+        EvalExecutable* getSlow(ExecState* exec, JSCell* owner, bool inStrictContext, ThisTDZMode thisTDZMode, const SourceCode&amp; evalSource, JSScope* scope)
</ins><span class="cx">         {
</span><span class="cx">             VariableEnvironment variablesUnderTDZ;
</span><span class="cx">             JSScope::collectVariablesUnderTDZ(scope, variablesUnderTDZ);
</span><del>-            EvalExecutable* evalExecutable = EvalExecutable::create(exec, evalSource, inStrictContext, thisTDZMode, isDerivedConstructorContext, isArrowFunctionContext, &amp;variablesUnderTDZ);
-
</del><ins>+            EvalExecutable* evalExecutable = EvalExecutable::create(exec, evalSource, inStrictContext, thisTDZMode, &amp;variablesUnderTDZ);
</ins><span class="cx">             if (!evalExecutable)
</span><span class="cx">                 return nullptr;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeExecutableInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ExecutableInfo.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ExecutableInfo.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/ExecutableInfo.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> // FIXME: These flags, ParserModes and propagation to XXXCodeBlocks should be reorganized.
</span><span class="cx"> // https://bugs.webkit.org/show_bug.cgi?id=151547
</span><span class="cx"> struct ExecutableInfo {
</span><del>-    ExecutableInfo(bool needsActivation, bool usesEval, bool isStrictMode, bool isConstructor, bool isBuiltinFunction, ConstructorKind constructorKind, GeneratorThisMode generatorThisMode, SuperBinding superBinding, SourceParseMode parseMode, bool isDerivedConstructorContext, bool isArrowFunctionContext)
</del><ins>+    ExecutableInfo(bool needsActivation, bool usesEval, bool isStrictMode, bool isConstructor, bool isBuiltinFunction, ConstructorKind constructorKind, GeneratorThisMode generatorThisMode, SuperBinding superBinding, SourceParseMode parseMode)
</ins><span class="cx">         : m_needsActivation(needsActivation)
</span><span class="cx">         , m_usesEval(usesEval)
</span><span class="cx">         , m_isStrictMode(isStrictMode)
</span><span class="lines">@@ -44,8 +44,6 @@
</span><span class="cx">         , m_constructorKind(static_cast&lt;unsigned&gt;(constructorKind))
</span><span class="cx">         , m_superBinding(static_cast&lt;unsigned&gt;(superBinding))
</span><span class="cx">         , m_parseMode(parseMode)
</span><del>-        , m_isDerivedConstructorContext(isDerivedConstructorContext)
-        , m_isArrowFunctionContext(isArrowFunctionContext)
</del><span class="cx">     {
</span><span class="cx">         ASSERT(m_constructorKind == static_cast&lt;unsigned&gt;(constructorKind));
</span><span class="cx">         ASSERT(m_superBinding == static_cast&lt;unsigned&gt;(superBinding));
</span><span class="lines">@@ -61,8 +59,6 @@
</span><span class="cx">     ConstructorKind constructorKind() const { return static_cast&lt;ConstructorKind&gt;(m_constructorKind); }
</span><span class="cx">     SuperBinding superBinding() const { return static_cast&lt;SuperBinding&gt;(m_superBinding); }
</span><span class="cx">     SourceParseMode parseMode() const { return m_parseMode; }
</span><del>-    bool isDerivedConstructorContext() const { return m_isDerivedConstructorContext; }
-    bool isArrowFunctionContext() const { return m_isArrowFunctionContext; }
</del><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     unsigned m_needsActivation : 1;
</span><span class="lines">@@ -74,8 +70,6 @@
</span><span class="cx">     unsigned m_constructorKind : 2;
</span><span class="cx">     unsigned m_superBinding : 1;
</span><span class="cx">     SourceParseMode m_parseMode;
</span><del>-    unsigned m_isDerivedConstructorContext : 1;
-    unsigned m_isArrowFunctionContext : 1;
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeUnlinkedCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -67,8 +67,6 @@
</span><span class="cx">     , m_constructorKind(static_cast&lt;unsigned&gt;(info.constructorKind()))
</span><span class="cx">     , m_generatorThisMode(static_cast&lt;unsigned&gt;(info.generatorThisMode()))
</span><span class="cx">     , m_superBinding(static_cast&lt;unsigned&gt;(info.superBinding()))
</span><del>-    , m_isDerivedConstructorContext(info.isDerivedConstructorContext())
-    , m_isArrowFunctionContext(info.isArrowFunctionContext())
</del><span class="cx">     , m_firstLine(0)
</span><span class="cx">     , m_lineCount(0)
</span><span class="cx">     , m_endColumn(UINT_MAX)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeUnlinkedCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -119,9 +119,6 @@
</span><span class="cx">     bool isStrictMode() const { return m_isStrictMode; }
</span><span class="cx">     bool usesEval() const { return m_usesEval; }
</span><span class="cx">     SourceParseMode parseMode() const { return m_parseMode; }
</span><del>-    bool isArrowFunction() const { return m_parseMode == SourceParseMode::ArrowFunctionMode; }
-    bool isDerivedConstructorContext() const { return m_isDerivedConstructorContext; }
-    bool isArrowFunctionContext() const { return m_isArrowFunctionContext; }
</del><span class="cx"> 
</span><span class="cx">     bool needsFullScopeChain() const { return m_needsFullScopeChain; }
</span><span class="cx"> 
</span><span class="lines">@@ -396,8 +393,6 @@
</span><span class="cx">     unsigned m_constructorKind : 2;
</span><span class="cx">     unsigned m_generatorThisMode : 1;
</span><span class="cx">     unsigned m_superBinding : 1;
</span><del>-    unsigned m_isDerivedConstructorContext : 1;
-    unsigned m_isArrowFunctionContext : 1;
</del><span class="cx"> 
</span><span class="cx">     unsigned m_firstLine;
</span><span class="cx">     unsigned m_lineCount;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeUnlinkedFunctionExecutablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -67,8 +67,7 @@
</span><span class="cx">     executable-&gt;recordParse(function-&gt;features(), function-&gt;hasCapturedVariables());
</span><span class="cx">     
</span><span class="cx">     UnlinkedFunctionCodeBlock* result = UnlinkedFunctionCodeBlock::create(&amp;vm, FunctionCode,
</span><del>-        ExecutableInfo(function-&gt;needsActivation(), function-&gt;usesEval(), function-&gt;isStrictMode(), kind == CodeForConstruct, functionKind == UnlinkedBuiltinFunction, executable-&gt;constructorKind(), executable-&gt;generatorThisMode(), executable-&gt;superBinding(), parseMode,  executable-&gt;isDerivedConstructorContext(), false));
-
</del><ins>+        ExecutableInfo(function-&gt;needsActivation(), function-&gt;usesEval(), function-&gt;isStrictMode(), kind == CodeForConstruct, functionKind == UnlinkedBuiltinFunction, executable-&gt;constructorKind(), executable-&gt;generatorThisMode(), executable-&gt;superBinding(), parseMode));
</ins><span class="cx">     auto generator(std::make_unique&lt;BytecodeGenerator&gt;(vm, function.get(), result, debuggerMode, profilerMode, executable-&gt;parentScopeTDZVariables()));
</span><span class="cx">     error = generator-&gt;generate();
</span><span class="cx">     if (error.isValid())
</span><span class="lines">@@ -76,7 +75,7 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM* vm, Structure* structure, const SourceCode&amp; source, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceOverride, FunctionMetadataNode* node, UnlinkedFunctionKind kind, ConstructAbility constructAbility, GeneratorThisMode generatorThisMode, VariableEnvironment&amp; parentScopeTDZVariables, bool isDerivedConstructorContext)
</del><ins>+UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM* vm, Structure* structure, const SourceCode&amp; source, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceOverride, FunctionMetadataNode* node, UnlinkedFunctionKind kind, ConstructAbility constructAbility, GeneratorThisMode generatorThisMode, VariableEnvironment&amp; parentScopeTDZVariables)
</ins><span class="cx">     : Base(*vm, structure)
</span><span class="cx">     , m_name(node-&gt;ident())
</span><span class="cx">     , m_inferredName(node-&gt;inferredName())
</span><span class="lines">@@ -102,7 +101,6 @@
</span><span class="cx">     , m_functionMode(node-&gt;functionMode())
</span><span class="cx">     , m_generatorThisMode(static_cast&lt;unsigned&gt;(generatorThisMode))
</span><span class="cx">     , m_superBinding(static_cast&lt;unsigned&gt;(node-&gt;superBinding()))
</span><del>-    , m_isDerivedConstructorContext(isDerivedConstructorContext)
</del><span class="cx"> {
</span><span class="cx">     ASSERT(m_constructorKind == static_cast&lt;unsigned&gt;(node-&gt;constructorKind()));
</span><span class="cx">     m_parentScopeTDZVariables.swap(parentScopeTDZVariables);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeUnlinkedFunctionExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -66,10 +66,10 @@
</span><span class="cx">     typedef JSCell Base;
</span><span class="cx">     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
</span><span class="cx"> 
</span><del>-    static UnlinkedFunctionExecutable* create(VM* vm, const SourceCode&amp; source, FunctionMetadataNode* node, UnlinkedFunctionKind unlinkedFunctionKind, ConstructAbility constructAbility, GeneratorThisMode generatorThisMode, VariableEnvironment&amp; parentScopeTDZVariables, bool isDerivedConstructorContext, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceOverride = nullptr)
</del><ins>+    static UnlinkedFunctionExecutable* create(VM* vm, const SourceCode&amp; source, FunctionMetadataNode* node, UnlinkedFunctionKind unlinkedFunctionKind, ConstructAbility constructAbility, GeneratorThisMode generatorThisMode, VariableEnvironment&amp; parentScopeTDZVariables, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceOverride = nullptr)
</ins><span class="cx">     {
</span><span class="cx">         UnlinkedFunctionExecutable* instance = new (NotNull, allocateCell&lt;UnlinkedFunctionExecutable&gt;(vm-&gt;heap))
</span><del>-            UnlinkedFunctionExecutable(vm, vm-&gt;unlinkedFunctionExecutableStructure.get(), source, WTF::move(sourceOverride), node, unlinkedFunctionKind, constructAbility, generatorThisMode, parentScopeTDZVariables, isDerivedConstructorContext);
</del><ins>+            UnlinkedFunctionExecutable(vm, vm-&gt;unlinkedFunctionExecutableStructure.get(), source, WTF::move(sourceOverride), node, unlinkedFunctionKind, constructAbility, generatorThisMode, parentScopeTDZVariables);
</ins><span class="cx">         instance-&gt;finishCreation(*vm);
</span><span class="cx">         return instance;
</span><span class="cx">     }
</span><span class="lines">@@ -128,13 +128,9 @@
</span><span class="cx">     ConstructAbility constructAbility() const { return static_cast&lt;ConstructAbility&gt;(m_constructAbility); }
</span><span class="cx">     bool isClassConstructorFunction() const { return constructorKind() != ConstructorKind::None; }
</span><span class="cx">     const VariableEnvironment* parentScopeTDZVariables() const { return &amp;m_parentScopeTDZVariables; }
</span><del>-    
-    bool isArrowFunction() const { return m_parseMode == SourceParseMode::ArrowFunctionMode; }
-    bool isDerivedConstructorContext() const {return m_isDerivedConstructorContext; }
</del><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    UnlinkedFunctionExecutable(VM*, Structure*, const SourceCode&amp;, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceOverride, FunctionMetadataNode*, UnlinkedFunctionKind, ConstructAbility, GeneratorThisMode, VariableEnvironment&amp;, bool isDerivedConstructorContext);
-    
</del><ins>+    UnlinkedFunctionExecutable(VM*, Structure*, const SourceCode&amp;, RefPtr&lt;SourceProvider&gt;&amp;&amp; sourceOverride, FunctionMetadataNode*, UnlinkedFunctionKind, ConstructAbility, GeneratorThisMode, VariableEnvironment&amp;);
</ins><span class="cx">     WriteBarrier&lt;UnlinkedFunctionCodeBlock&gt; m_unlinkedCodeBlockForCall;
</span><span class="cx">     WriteBarrier&lt;UnlinkedFunctionCodeBlock&gt; m_unlinkedCodeBlockForConstruct;
</span><span class="cx"> 
</span><span class="lines">@@ -166,7 +162,6 @@
</span><span class="cx">     unsigned m_functionMode : 1; // FunctionMode
</span><span class="cx">     unsigned m_generatorThisMode : 1;
</span><span class="cx">     unsigned m_superBinding : 1;
</span><del>-    unsigned m_isDerivedConstructorContext : 1;
</del><span class="cx"> 
</span><span class="cx"> protected:
</span><span class="cx">     void finishCreation(VM&amp; vm)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -157,8 +157,6 @@
</span><span class="cx">     , m_thisRegister(CallFrame::thisArgumentOffset())
</span><span class="cx">     , m_codeType(GlobalCode)
</span><span class="cx">     , m_vm(&amp;vm)
</span><del>-    , m_isDerivedConstructorContext(false)
-    , m_needsToUpdateArrowFunctionContext(programNode-&gt;usesArrowFunction() || programNode-&gt;usesEval())
</del><span class="cx"> {
</span><span class="cx">     ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables-&gt;size());
</span><span class="cx"> 
</span><span class="lines">@@ -189,11 +187,6 @@
</span><span class="cx">     // operations we emit we will have ResolveTypes that implictly do TDZ checks. Therefore, we don't need
</span><span class="cx">     // additional TDZ checks on top of those. This is why we can omit pushing programNode-&gt;lexicalVariables()
</span><span class="cx">     // to the TDZ stack.
</span><del>-    
-    if (needsToUpdateArrowFunctionContext()) {
-        initializeArrowFunctionContextScopeIfNeeded();
-        emitPutThisToArrowFunctionContextScope();
-    }
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> BytecodeGenerator::BytecodeGenerator(VM&amp; vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, ProfilerMode profilerMode, const VariableEnvironment* parentScopeTDZVariables)
</span><span class="lines">@@ -211,8 +204,6 @@
</span><span class="cx">     // compatible with tail calls (we have no way of emitting op_did_call).
</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=148819
</span><span class="cx">     , m_inTailPosition(Options::useTailCalls() &amp;&amp; !isConstructor() &amp;&amp; constructorKind() == ConstructorKind::None &amp;&amp; isStrictMode() &amp;&amp; !m_shouldEmitProfileHooks)
</span><del>-    , m_isDerivedConstructorContext(codeBlock-&gt;isDerivedConstructorContext())
-    , m_needsToUpdateArrowFunctionContext(functionNode-&gt;usesArrowFunction() || functionNode-&gt;usesEval())
</del><span class="cx"> {
</span><span class="cx">     for (auto&amp; constantRegister : m_linkTimeConstantRegisters)
</span><span class="cx">         constantRegister = nullptr;
</span><span class="lines">@@ -239,10 +230,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     SourceParseMode parseMode = codeBlock-&gt;parseMode();
</span><del>-
-    bool containsArrowOrEvalButNotInArrowBlock = needsToUpdateArrowFunctionContext() &amp;&amp; !m_codeBlock-&gt;isArrowFunction();
-    bool shouldCaptureSomeOfTheThings = m_shouldEmitDebugHooks || m_codeBlock-&gt;needsFullScopeChain() || containsArrowOrEvalButNotInArrowBlock;
-
</del><ins>+    bool shouldCaptureSomeOfTheThings = m_shouldEmitDebugHooks || m_codeBlock-&gt;needsFullScopeChain();
</ins><span class="cx">     bool shouldCaptureAllOfTheThings = m_shouldEmitDebugHooks || codeBlock-&gt;usesEval();
</span><span class="cx">     bool needsArguments = functionNode-&gt;usesArguments() || codeBlock-&gt;usesEval();
</span><span class="cx"> 
</span><span class="lines">@@ -522,8 +510,8 @@
</span><span class="cx">     m_newTargetRegister = addVar();
</span><span class="cx">     switch (parseMode) {
</span><span class="cx">     case SourceParseMode::ArrowFunctionMode: {
</span><del>-        if (functionNode-&gt;usesThis())
-            emitLoadThisFromArrowFunctionLexicalEnvironment();
</del><ins>+        if (functionNode-&gt;usesThis() || codeBlock-&gt;usesEval())
+            emitLoadArrowFunctionThis(&amp;m_thisRegister);
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -574,13 +562,6 @@
</span><span class="cx">     m_TDZStack.append(std::make_pair(*parentScopeTDZVariables, false));
</span><span class="cx">     initializeDefaultParameterValuesAndSetupFunctionScopeStack(parameters, functionNode, functionSymbolTable, symbolTableConstantIndex, captures);
</span><span class="cx"> 
</span><del>-    if (needsToUpdateArrowFunctionContext() &amp;&amp; !codeBlock-&gt;isArrowFunction()) {
-        initializeArrowFunctionContextScopeIfNeeded(functionSymbolTable);
-        emitPutThisToArrowFunctionContextScope();
-        emitPutNewTargetToArrowFunctionContextScope();
-        emitPutDerivedConstructorToArrowFunctionContextScope();
-    }
-
</del><span class="cx">     pushLexicalScope(m_scopeNode, true);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -593,8 +574,6 @@
</span><span class="cx">     , m_codeType(EvalCode)
</span><span class="cx">     , m_vm(&amp;vm)
</span><span class="cx">     , m_usesNonStrictEval(codeBlock-&gt;usesEval() &amp;&amp; !codeBlock-&gt;isStrictMode())
</span><del>-    , m_isDerivedConstructorContext(codeBlock-&gt;isDerivedConstructorContext())
-    , m_needsToUpdateArrowFunctionContext(evalNode-&gt;usesArrowFunction() || evalNode-&gt;usesEval())
</del><span class="cx"> {
</span><span class="cx">     for (auto&amp; constantRegister : m_linkTimeConstantRegisters)
</span><span class="cx">         constantRegister = nullptr;
</span><span class="lines">@@ -624,14 +603,6 @@
</span><span class="cx"> 
</span><span class="cx">     m_TDZStack.append(std::make_pair(*parentScopeTDZVariables, false));
</span><span class="cx"> 
</span><del>-    if (codeBlock-&gt;isArrowFunctionContext() &amp;&amp; evalNode-&gt;usesThis())
-        emitLoadThisFromArrowFunctionLexicalEnvironment();
-
-    if (needsToUpdateArrowFunctionContext() &amp;&amp; !codeBlock-&gt;isArrowFunctionContext()) {
-        initializeArrowFunctionContextScopeIfNeeded();
-        emitPutThisToArrowFunctionContextScope();
-    }
-    
</del><span class="cx">     pushLexicalScope(m_scopeNode, true);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -644,8 +615,6 @@
</span><span class="cx">     , m_codeType(ModuleCode)
</span><span class="cx">     , m_vm(&amp;vm)
</span><span class="cx">     , m_usesNonStrictEval(false)
</span><del>-    , m_isDerivedConstructorContext(false)
-    , m_needsToUpdateArrowFunctionContext(moduleProgramNode-&gt;usesArrowFunction() || moduleProgramNode-&gt;usesEval())
</del><span class="cx"> {
</span><span class="cx">     ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables-&gt;size());
</span><span class="cx"> 
</span><span class="lines">@@ -881,59 +850,6 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded(SymbolTable* symbolTable)
-{
-    if (m_arrowFunctionContextLexicalEnvironmentRegister != nullptr)
-        return;
-    
-    if (m_lexicalEnvironmentRegister != nullptr) {
-        m_arrowFunctionContextLexicalEnvironmentRegister = m_lexicalEnvironmentRegister;
-        
-        if (!m_codeBlock-&gt;isArrowFunction()) {
-            ScopeOffset offset;
-
-            offset = symbolTable-&gt;takeNextScopeOffset();
-            symbolTable-&gt;set(propertyNames().thisIdentifier.impl(), SymbolTableEntry(VarOffset(offset)));
-
-            if (m_codeType == FunctionCode) {
-                offset = symbolTable-&gt;takeNextScopeOffset();
-                symbolTable-&gt;set(propertyNames().newTargetLocalPrivateName.impl(), SymbolTableEntry(VarOffset(offset)));
-            }
-            
-            if (isConstructor() &amp;&amp; constructorKind() == ConstructorKind::Derived) {
-                offset = symbolTable-&gt;takeNextScopeOffset();
-                symbolTable-&gt;set(propertyNames().derivedConstructorPrivateName.impl(), SymbolTableEntry(VarOffset(offset)));
-            }
-        }
-
-        return;
-    }
-
-    VariableEnvironment environment;
-    auto addResult = environment.add(propertyNames().thisIdentifier);
-    addResult.iterator-&gt;value.setIsCaptured();
-    addResult.iterator-&gt;value.setIsConst();
-    
-    if (m_codeType == FunctionCode)  {
-        auto addTarget = environment.add(propertyNames().newTargetLocalPrivateName);
-        addTarget.iterator-&gt;value.setIsCaptured();
-        addTarget.iterator-&gt;value.setIsLet();
-    }
-
-    if (isConstructor() &amp;&amp; constructorKind() == ConstructorKind::Derived) {
-        auto derivedConstructor = environment.add(propertyNames().derivedConstructorPrivateName);
-        derivedConstructor.iterator-&gt;value.setIsCaptured();
-        derivedConstructor.iterator-&gt;value.setIsLet();
-    }
-
-    size_t size = m_symbolTableStack.size();
-    pushLexicalScopeInternal(environment, true, nullptr, TDZRequirement::UnderTDZ, ScopeType::LetConstScope, ScopeRegisterType::Block);
-
-    ASSERT_UNUSED(size, m_symbolTableStack.size() == size + 1);
-
-    m_arrowFunctionContextLexicalEnvironmentRegister = m_symbolTableStack.last().m_scope;
-}
-
</del><span class="cx"> RegisterID* BytecodeGenerator::initializeNextParameter()
</span><span class="cx"> {
</span><span class="cx">     VirtualRegister reg = virtualRegisterForArgument(m_codeBlock-&gt;numParameters());
</span><span class="lines">@@ -1976,9 +1892,9 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-Variable BytecodeGenerator::variable(const Identifier&amp; property, ThisResolutionType thisResolutionType)
</del><ins>+Variable BytecodeGenerator::variable(const Identifier&amp; property)
</ins><span class="cx"> {
</span><del>-    if (property == propertyNames().thisIdentifier &amp;&amp; thisResolutionType == ThisResolutionType::Local) {
</del><ins>+    if (property == propertyNames().thisIdentifier) {
</ins><span class="cx">         return Variable(property, VarOffset(thisRegister()-&gt;virtualRegister()), thisRegister(),
</span><span class="cx">             ReadOnly, Variable::SpecialVariable, 0, false);
</span><span class="cx">     }
</span><span class="lines">@@ -2673,6 +2589,9 @@
</span><span class="cx">     instructions().append(dst-&gt;index());
</span><span class="cx">     instructions().append(scopeRegister()-&gt;index());
</span><span class="cx">     instructions().append(index);
</span><ins>+    
+    if (opcodeID == op_new_arrow_func_exp)
+        instructions().append(thisRegister()-&gt;index());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> RegisterID* BytecodeGenerator::emitNewFunctionExpression(RegisterID* dst, FuncExprNode* func)
</span><span class="lines">@@ -2683,7 +2602,11 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* BytecodeGenerator::emitNewArrowFunctionExpression(RegisterID* dst, ArrowFuncExprNode* func)
</span><span class="cx"> {
</span><del>-    ASSERT(func-&gt;metadata()-&gt;parseMode() == SourceParseMode::ArrowFunctionMode);    
</del><ins>+    ASSERT(func-&gt;metadata()-&gt;parseMode() == SourceParseMode::ArrowFunctionMode);
+    bool isClassConstructor = m_codeBlock-&gt;isConstructor() &amp;&amp; constructorKind() != ConstructorKind::None;
+    if (isClassConstructor || generatorThisMode() == GeneratorThisMode::Empty)
+        emitTDZCheck(thisRegister());
+    
</ins><span class="cx">     emitNewFunctionExpressionCommon(dst, func);
</span><span class="cx">     return dst;
</span><span class="cx"> }
</span><span class="lines">@@ -3292,6 +3215,13 @@
</span><span class="cx">     m_topMostScope = addVar();
</span><span class="cx">     emitMove(m_topMostScope, scopeRegister());
</span><span class="cx"> }
</span><ins>+
+RegisterID* BytecodeGenerator::emitLoadArrowFunctionThis(RegisterID* arrowFunctionThis)
+{
+    emitOpcode(op_load_arrowfunction_this);
+    instructions().append(arrowFunctionThis-&gt;index());
+    return arrowFunctionThis;
+}
</ins><span class="cx">     
</span><span class="cx"> void BytecodeGenerator::emitComplexPopScopes(RegisterID* scope, ControlFlowContext* topScope, ControlFlowContext* bottomScope)
</span><span class="cx"> {
</span><span class="lines">@@ -3978,64 +3908,6 @@
</span><span class="cx">     m_forInContextStack.removeLast();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment()
-{
-    ASSERT(m_codeBlock-&gt;isArrowFunction() || m_codeBlock-&gt;isArrowFunctionContext() || constructorKind() == ConstructorKind::Derived);
-    
-    m_resolvedArrowFunctionScopeContextRegister = emitResolveScope(nullptr, variable(propertyNames().thisIdentifier, ThisResolutionType::Scoped));
-    return m_resolvedArrowFunctionScopeContextRegister.get();
-}
-
-void BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment()
-{
-    emitGetFromScope(thisRegister(), emitLoadArrowFunctionLexicalEnvironment(), variable(propertyNames().thisIdentifier, ThisResolutionType::Scoped), DoNotThrowIfNotFound);
-}
-    
-RegisterID* BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment()
-{
-    m_isNewTargetLoadedInArrowFunction = true;
-
-    Variable newTargetVar = variable(propertyNames().newTargetLocalPrivateName);
-    emitMove(m_newTargetRegister, emitGetFromScope(newTemporary(), emitLoadArrowFunctionLexicalEnvironment(), newTargetVar, ThrowIfNotFound));
-    
-    return m_newTargetRegister;
-}
-
-RegisterID* BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment()
-{
-    Variable protoScopeVar = variable(propertyNames().derivedConstructorPrivateName);
-    return emitGetFromScope(newTemporary(), emitLoadArrowFunctionLexicalEnvironment(), protoScopeVar, ThrowIfNotFound);
-}
-    
-void BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope()
-{
-    ASSERT(m_arrowFunctionContextLexicalEnvironmentRegister != nullptr);
-        
-    Variable newTargetVar = variable(propertyNames().newTargetLocalPrivateName);
-    emitPutToScope(m_arrowFunctionContextLexicalEnvironmentRegister, newTargetVar, newTarget(), DoNotThrowIfNotFound, Initialization);
-}
-    
-void BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope()
-{
-    if (isConstructor() &amp;&amp; constructorKind() == ConstructorKind::Derived) {
-        ASSERT(m_arrowFunctionContextLexicalEnvironmentRegister != nullptr);
-            
-        Variable protoScope = variable(propertyNames().derivedConstructorPrivateName);
-        emitPutToScope(m_arrowFunctionContextLexicalEnvironmentRegister, protoScope, &amp;m_calleeRegister, DoNotThrowIfNotFound, Initialization);
-    }
-}
-    
-void BytecodeGenerator::emitPutThisToArrowFunctionContextScope()
-{
-    ASSERT(isDerivedConstructorContext() || m_arrowFunctionContextLexicalEnvironmentRegister != nullptr);
-        
-    if (isDerivedConstructorContext())
-        emitLoadArrowFunctionLexicalEnvironment();
-
-    Variable thisVar = variable(propertyNames().thisIdentifier, ThisResolutionType::Scoped);
-    emitPutToScope(isDerivedConstructorContext() ? m_resolvedArrowFunctionScopeContextRegister.get() : m_arrowFunctionContextLexicalEnvironmentRegister, thisVar, thisRegister(), DoNotThrowIfNotFound, NotInitialization);
-}
-
</del><span class="cx"> void BytecodeGenerator::pushStructureForInScope(RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
</span><span class="cx"> {
</span><span class="cx">     if (!localRegister)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -66,8 +66,6 @@
</span><span class="cx">         ExpectArrayConstructor
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-    enum class ThisResolutionType { Local, Scoped };
-    
</del><span class="cx">     class CallArguments {
</span><span class="cx">     public:
</span><span class="cx">         CallArguments(BytecodeGenerator&amp;, ArgumentsNode*, unsigned additionalArguments = 0);
</span><span class="lines">@@ -282,11 +280,6 @@
</span><span class="cx">         const CommonIdentifiers&amp; propertyNames() const { return *m_vm-&gt;propertyNames; }
</span><span class="cx"> 
</span><span class="cx">         bool isConstructor() const { return m_codeBlock-&gt;isConstructor(); }
</span><del>-        bool isDerivedConstructorContext() const { return m_codeBlock-&gt;isDerivedConstructorContext(); }
-        bool usesArrowFunction() const { return m_scopeNode-&gt;usesArrowFunction(); }
-        bool needsToUpdateArrowFunctionContext() const { return m_needsToUpdateArrowFunctionContext; }
-        bool usesEval() const { return m_scopeNode-&gt;usesEval(); }
-        bool usesThis() const { return m_scopeNode-&gt;usesThis(); }
</del><span class="cx">         ConstructorKind constructorKind() const { return m_codeBlock-&gt;constructorKind(); }
</span><span class="cx">         GeneratorThisMode generatorThisMode() const { return m_codeBlock-&gt;generatorThisMode(); }
</span><span class="cx">         SuperBinding superBinding() const { return m_codeBlock-&gt;superBinding(); }
</span><span class="lines">@@ -295,7 +288,7 @@
</span><span class="cx"> 
</span><span class="cx">         bool isArgumentNumber(const Identifier&amp;, int);
</span><span class="cx"> 
</span><del>-        Variable variable(const Identifier&amp;, ThisResolutionType = ThisResolutionType::Local);
</del><ins>+        Variable variable(const Identifier&amp;);
</ins><span class="cx">         
</span><span class="cx">         enum ExistingVariableMode { VerifyExisting, IgnoreExisting };
</span><span class="cx">         void createVariable(const Identifier&amp;, VarKind, SymbolTable*, ExistingVariableMode = VerifyExisting); // Creates the variable, or asserts that the already-created variable is sufficiently compatible.
</span><span class="lines">@@ -303,11 +296,7 @@
</span><span class="cx">         // Returns the register storing &quot;this&quot;
</span><span class="cx">         RegisterID* thisRegister() { return &amp;m_thisRegister; }
</span><span class="cx">         RegisterID* argumentsRegister() { return m_argumentsRegister; }
</span><del>-        RegisterID* newTarget()
-        {
-            return !m_codeBlock-&gt;isArrowFunction() || m_isNewTargetLoadedInArrowFunction
-                ? m_newTargetRegister : emitLoadNewTargetFromArrowFunctionLexicalEnvironment();
-        }
</del><ins>+        RegisterID* newTarget() { return m_newTargetRegister; }
</ins><span class="cx"> 
</span><span class="cx">         RegisterID* scopeRegister() { return m_scopeRegister; }
</span><span class="cx"> 
</span><span class="lines">@@ -495,10 +484,6 @@
</span><span class="cx">         void emitProfileType(RegisterID* registerToProfile, const JSTextPosition&amp; startDivot, const JSTextPosition&amp; endDivot);
</span><span class="cx"> 
</span><span class="cx">         void emitProfileControlFlow(int);
</span><del>-        
-        RegisterID* emitLoadArrowFunctionLexicalEnvironment();
-        void emitLoadThisFromArrowFunctionLexicalEnvironment();
-        RegisterID* emitLoadNewTargetFromArrowFunctionLexicalEnvironment();
</del><span class="cx"> 
</span><span class="cx">         RegisterID* emitLoad(RegisterID* dst, bool);
</span><span class="cx">         RegisterID* emitLoad(RegisterID* dst, const Identifier&amp;);
</span><span class="lines">@@ -643,10 +628,6 @@
</span><span class="cx">         void emitGetScope();
</span><span class="cx">         RegisterID* emitPushWithScope(RegisterID* objectScope);
</span><span class="cx">         void emitPopWithScope();
</span><del>-        void emitPutThisToArrowFunctionContextScope();
-        void emitPutNewTargetToArrowFunctionContextScope();
-        void emitPutDerivedConstructorToArrowFunctionContextScope();
-        RegisterID* emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment();
</del><span class="cx"> 
</span><span class="cx">         void emitDebugHook(DebugHookID, unsigned line, unsigned charOffset, unsigned lineStart);
</span><span class="cx"> 
</span><span class="lines">@@ -739,6 +720,7 @@
</span><span class="cx"> 
</span><span class="cx">         void allocateCalleeSaveSpace();
</span><span class="cx">         void allocateAndEmitScope();
</span><ins>+        RegisterID* emitLoadArrowFunctionThis(RegisterID*);
</ins><span class="cx">         void emitComplexPopScopes(RegisterID*, ControlFlowContext* topScope, ControlFlowContext* bottomScope);
</span><span class="cx"> 
</span><span class="cx">         typedef HashMap&lt;double, JSValue&gt; NumberMap;
</span><span class="lines">@@ -790,8 +772,6 @@
</span><span class="cx">         
</span><span class="cx">         UnlinkedFunctionExecutable* makeFunction(FunctionMetadataNode* metadata)
</span><span class="cx">         {
</span><del>-            bool newisDerivedConstructorContext = constructorKind() == ConstructorKind::Derived || (m_isDerivedConstructorContext &amp;&amp; metadata-&gt;parseMode() == SourceParseMode::ArrowFunctionMode);
-
</del><span class="cx">             VariableEnvironment variablesUnderTDZ;
</span><span class="cx">             getVariablesUnderTDZ(variablesUnderTDZ);
</span><span class="cx"> 
</span><span class="lines">@@ -810,7 +790,7 @@
</span><span class="cx">             if (parseMode == SourceParseMode::GeneratorBodyMode &amp;&amp; isConstructor())
</span><span class="cx">                 generatorThisMode = GeneratorThisMode::Empty;
</span><span class="cx"> 
</span><del>-            return UnlinkedFunctionExecutable::create(m_vm, m_scopeNode-&gt;source(), metadata, isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction, constructAbility, generatorThisMode, variablesUnderTDZ, newisDerivedConstructorContext);
</del><ins>+            return UnlinkedFunctionExecutable::create(m_vm, m_scopeNode-&gt;source(), metadata, isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction, constructAbility, generatorThisMode, variablesUnderTDZ);
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         void getVariablesUnderTDZ(VariableEnvironment&amp;);
</span><span class="lines">@@ -821,7 +801,6 @@
</span><span class="cx">         void initializeParameters(FunctionParameters&amp;);
</span><span class="cx">         void initializeVarLexicalEnvironment(int symbolTableConstantIndex);
</span><span class="cx">         void initializeDefaultParameterValuesAndSetupFunctionScopeStack(FunctionParameters&amp;, FunctionNode*, SymbolTable*, int symbolTableConstantIndex, const std::function&lt;bool (UniquedStringImpl*)&gt;&amp; captures);
</span><del>-        void initializeArrowFunctionContextScopeIfNeeded(SymbolTable* = nullptr);
</del><span class="cx"> 
</span><span class="cx">     public:
</span><span class="cx">         JSString* addStringConstant(const Identifier&amp;);
</span><span class="lines">@@ -864,8 +843,6 @@
</span><span class="cx">         RegisterID* m_globalObjectRegister { nullptr };
</span><span class="cx">         RegisterID* m_newTargetRegister { nullptr };
</span><span class="cx">         RegisterID* m_linkTimeConstantRegisters[LinkTimeConstantCount];
</span><del>-        RegisterID* m_arrowFunctionContextLexicalEnvironmentRegister { nullptr };
-        RefPtr&lt;RegisterID&gt; m_resolvedArrowFunctionScopeContextRegister;
</del><span class="cx"> 
</span><span class="cx">         SegmentedVector&lt;RegisterID*, 16&gt; m_localRegistersForCalleeSaveRegisters;
</span><span class="cx">         SegmentedVector&lt;RegisterID, 32&gt; m_constantPoolRegisters;
</span><span class="lines">@@ -921,9 +898,6 @@
</span><span class="cx">         bool m_isBuiltinFunction { false };
</span><span class="cx">         bool m_usesNonStrictEval { false };
</span><span class="cx">         bool m_inTailPosition { false };
</span><del>-        bool m_isDerivedConstructorContext { false };
-        bool m_needsToUpdateArrowFunctionContext;
-        bool m_isNewTargetLoadedInArrowFunction { false };
</del><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -146,10 +146,7 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* ThisNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    if (generator.constructorKind() == ConstructorKind::Derived &amp;&amp; generator.needsToUpdateArrowFunctionContext())
-        generator.emitLoadThisFromArrowFunctionLexicalEnvironment();
-
-    if (m_shouldAlwaysEmitTDZCheck || generator.constructorKind() == ConstructorKind::Derived || generator.generatorThisMode() == GeneratorThisMode::Empty || generator.isDerivedConstructorContext())
</del><ins>+    if (m_shouldAlwaysEmitTDZCheck || generator.constructorKind() == ConstructorKind::Derived || generator.generatorThisMode() == GeneratorThisMode::Empty)
</ins><span class="cx">         generator.emitTDZCheck(generator.thisRegister());
</span><span class="cx"> 
</span><span class="cx">     if (dst == generator.ignoredResult())
</span><span class="lines">@@ -168,9 +165,6 @@
</span><span class="cx">     if (dst == generator.ignoredResult())
</span><span class="cx">         return 0;
</span><span class="cx"> 
</span><del>-    if (generator.isDerivedConstructorContext())
-        return generator.emitGetById(generator.finalDestination(dst), generator.emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment(), generator.propertyNames().underscoreProto);
-
</del><span class="cx">     RegisterID callee;
</span><span class="cx">     callee.setIndex(JSStack::Callee);
</span><span class="cx"> 
</span><span class="lines">@@ -702,21 +696,6 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    // We need try to load 'this' before call eval in constructor, because 'this' can created by 'super' in some of the arrow function
-    // var A = class A {
-    //   constructor () { this.id = 'A'; }
-    // }
-    //
-    // var B = class B extend A {
-    //    constructor () {
-    //       var arrow = () =&gt; super();
-    //       arrow();
-    //       eval(&quot;this.id = 'B'&quot;);
-    //    }
-    // }
-    if (generator.constructorKind() == ConstructorKind::Derived &amp;&amp; generator.needsToUpdateArrowFunctionContext())
-        generator.emitLoadThisFromArrowFunctionLexicalEnvironment();
-
</del><span class="cx">     Variable var = generator.variable(generator.propertyNames().eval);
</span><span class="cx">     if (RegisterID* local = var.local()) {
</span><span class="cx">         RefPtr&lt;RegisterID&gt; func = generator.emitMove(generator.tempDestination(dst), local);
</span><span class="lines">@@ -744,16 +723,11 @@
</span><span class="cx">     RefPtr&lt;RegisterID&gt; returnValue = generator.finalDestination(dst, func.get());
</span><span class="cx">     CallArguments callArguments(generator, m_args);
</span><span class="cx">     if (m_expr-&gt;isSuperNode()) {
</span><del>-        ASSERT(generator.isConstructor() || generator.isDerivedConstructorContext());
-        ASSERT(generator.constructorKind() == ConstructorKind::Derived || generator.isDerivedConstructorContext());
</del><ins>+        ASSERT(generator.isConstructor());
+        ASSERT(generator.constructorKind() == ConstructorKind::Derived);
</ins><span class="cx">         generator.emitMove(callArguments.thisRegister(), generator.newTarget());
</span><span class="cx">         RegisterID* ret = generator.emitConstruct(returnValue.get(), func.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd());
</span><span class="cx">         generator.emitMove(generator.thisRegister(), ret);
</span><del>-        
-        bool isConstructorKindDerived = generator.constructorKind() == ConstructorKind::Derived;
-        if (generator.isDerivedConstructorContext() || (isConstructorKindDerived &amp;&amp; generator.needsToUpdateArrowFunctionContext()))
-            generator.emitPutThisToArrowFunctionContextScope();
-        
</del><span class="cx">         return ret;
</span><span class="cx">     }
</span><span class="cx">     generator.emitLoad(callArguments.thisRegister(), jsUndefined());
</span><span class="lines">@@ -3078,9 +3052,6 @@
</span><span class="cx"> 
</span><span class="cx">         // If there is no return we must automatically insert one.
</span><span class="cx">         if (!returnNode) {
</span><del>-            if (generator.constructorKind() == ConstructorKind::Derived &amp;&amp; generator.needsToUpdateArrowFunctionContext())
-                generator.emitLoadThisFromArrowFunctionLexicalEnvironment(); // Arrow function can invoke 'super' in constructor and before leave constructor we need load 'this' from lexical arrow function environment
-            
</del><span class="cx">             RegisterID* r0 = generator.isConstructor() ? generator.thisRegister() : generator.emitLoad(0, jsUndefined());
</span><span class="cx">             generator.emitProfileType(r0, ProfileTypeBytecodeFunctionReturnStatement); // Do not emit expression info for this profile because it's not in the user's source code.
</span><span class="cx">             ASSERT(startOffset() &gt;= lineStartOffset());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerCallFramecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -196,7 +196,7 @@
</span><span class="cx">     VariableEnvironment variablesUnderTDZ;
</span><span class="cx">     JSScope::collectVariablesUnderTDZ(scope()-&gt;jsScope(), variablesUnderTDZ);
</span><span class="cx"> 
</span><del>-    EvalExecutable* eval = EvalExecutable::create(callFrame, makeSource(script), codeBlock.isStrictMode(), thisTDZMode, codeBlock.unlinkedCodeBlock()-&gt;isDerivedConstructorContext(), codeBlock.unlinkedCodeBlock()-&gt;isArrowFunction(), &amp;variablesUnderTDZ);
</del><ins>+    EvalExecutable* eval = EvalExecutable::create(callFrame, makeSource(script), codeBlock.isStrictMode(), thisTDZMode, &amp;variablesUnderTDZ);
</ins><span class="cx">     if (vm.exception()) {
</span><span class="cx">         exception = vm.exception();
</span><span class="cx">         vm.clearException();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1810,6 +1810,15 @@
</span><span class="cx">         forNode(node).setType(m_graph, SpecObjectOther);
</span><span class="cx">         break;
</span><span class="cx"> 
</span><ins>+    case LoadArrowFunctionThis:
+        if (JSValue base = forNode(node-&gt;child1()).m_value) {
+            JSArrowFunction* function = jsDynamicCast&lt;JSArrowFunction*&gt;(base);
+            setConstant(node, *m_graph.freeze(function-&gt;boundThis()));
+            break;
+        }
+        forNode(node).setType(m_graph, SpecFinalObject);
+        break;
+            
</ins><span class="cx">     case SkipScope: {
</span><span class="cx">         JSValue child = forNode(node-&gt;child1()).value();
</span><span class="cx">         if (child) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -4507,6 +4507,17 @@
</span><span class="cx">             set(VirtualRegister(currentInstruction[1].u.operand), result);
</span><span class="cx">             NEXT_OPCODE(op_get_scope);
</span><span class="cx">         }
</span><ins>+
+        case op_load_arrowfunction_this: {
+            Node* callee = get(VirtualRegister(JSStack::Callee));
+            Node* result;
+            if (JSArrowFunction* function = callee-&gt;dynamicCastConstant&lt;JSArrowFunction*&gt;())
+                result = jsConstant(function-&gt;boundThis());
+            else
+                result = addToGraph(LoadArrowFunctionThis, callee);
+            set(VirtualRegister(currentInstruction[1].u.operand), result);
+            NEXT_OPCODE(op_load_arrowfunction_this);
+        }
</ins><span class="cx">             
</span><span class="cx">         case op_create_direct_arguments: {
</span><span class="cx">             noticeArgumentsUse();
</span><span class="lines">@@ -4556,20 +4567,24 @@
</span><span class="cx">             NEXT_OPCODE(op_new_func);
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case op_new_func_exp:
</del><ins>+        case op_new_func_exp: {
+            FunctionExecutable* expr = m_inlineStackTop-&gt;m_profiledBlock-&gt;functionExpr(currentInstruction[3].u.operand);
+            FrozenValue* frozen = m_graph.freezeStrong(expr);
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(NewFunction, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
+            NEXT_OPCODE(op_new_func_exp);
+        }
+
</ins><span class="cx">         case op_new_arrow_func_exp: {
</span><span class="cx">             FunctionExecutable* expr = m_inlineStackTop-&gt;m_profiledBlock-&gt;functionExpr(currentInstruction[3].u.operand);
</span><span class="cx">             FrozenValue* frozen = m_graph.freezeStrong(expr);
</span><ins>+
</ins><span class="cx">             set(VirtualRegister(currentInstruction[1].u.operand),
</span><del>-                addToGraph(NewFunction, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
</del><ins>+                addToGraph(NewArrowFunction, OpInfo(frozen),
+                    get(VirtualRegister(currentInstruction[2].u.operand)),
+                    get(VirtualRegister(currentInstruction[4].u.operand))));
</ins><span class="cx">             
</span><del>-            if (opcodeID == op_new_func_exp) {
-                // Curly braces are necessary
-                NEXT_OPCODE(op_new_func_exp);
-            } else {
-                // Curly braces are necessary
-                NEXT_OPCODE(op_new_arrow_func_exp);
-            }
</del><ins>+            NEXT_OPCODE(op_new_arrow_func_exp);
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         case op_typeof: {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -202,6 +202,7 @@
</span><span class="cx">     case op_switch_char:
</span><span class="cx">     case op_in:
</span><span class="cx">     case op_get_scope:
</span><ins>+    case op_load_arrowfunction_this:
</ins><span class="cx">     case op_get_from_scope:
</span><span class="cx">     case op_get_enumerable_length:
</span><span class="cx">     case op_has_generic_property:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -139,6 +139,7 @@
</span><span class="cx">     case ArithCos:
</span><span class="cx">     case ArithLog:
</span><span class="cx">     case GetScope:
</span><ins>+    case LoadArrowFunctionThis:
</ins><span class="cx">     case SkipScope:
</span><span class="cx">     case StringCharCodeAt:
</span><span class="cx">     case StringFromCharCode:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -107,6 +107,7 @@
</span><span class="cx">     case GetButterflyReadOnly:
</span><span class="cx">     case CheckArray:
</span><span class="cx">     case GetScope:
</span><ins>+    case LoadArrowFunctionThis:
</ins><span class="cx">     case SkipScope:
</span><span class="cx">     case GetClosureVar:
</span><span class="cx">     case PutClosureVar:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1026,6 +1026,11 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        case LoadArrowFunctionThis: {
+            fixEdge&lt;KnownCellUse&gt;(node-&gt;child1());
+            break;
+        }
+
</ins><span class="cx">         case SkipScope:
</span><span class="cx">         case GetScope:
</span><span class="cx">         case GetGetter:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -207,6 +207,7 @@
</span><span class="cx">     macro(MultiPutByOffset, NodeMustGenerate) \
</span><span class="cx">     macro(GetArrayLength, NodeResultInt32) \
</span><span class="cx">     macro(GetTypedArrayByteOffset, NodeResultInt32) \
</span><ins>+    macro(LoadArrowFunctionThis, NodeResultJS) \
</ins><span class="cx">     macro(GetScope, NodeResultJS) \
</span><span class="cx">     macro(SkipScope, NodeResultJS) \
</span><span class="cx">     macro(GetClosureVar, NodeResultJS) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGObjectAllocationSinkingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -838,14 +838,17 @@
</span><span class="cx"> 
</span><span class="cx">         case NewFunction:
</span><span class="cx">         case NewArrowFunction: {
</span><ins>+            bool isArrowFunction = node-&gt;op() == NewArrowFunction;
</ins><span class="cx">             if (node-&gt;castOperand&lt;FunctionExecutable*&gt;()-&gt;singletonFunction()-&gt;isStillValid()) {
</span><span class="cx">                 m_heap.escape(node-&gt;child1().node());
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">             
</span><del>-            target = &amp;m_heap.newAllocation(node, Allocation::Kind::Function);
</del><ins>+            target = &amp;m_heap.newAllocation(node, isArrowFunction ? Allocation::Kind::NewArrowFunction : Allocation::Kind::Function);
</ins><span class="cx">             writes.add(FunctionExecutablePLoc, LazyNode(node-&gt;cellOperand()));
</span><span class="cx">             writes.add(FunctionActivationPLoc, LazyNode(node-&gt;child1().node()));
</span><ins>+            if (isArrowFunction)
+                writes.add(ArrowFunctionBoundThisPLoc, LazyNode(node-&gt;child2().node()));
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -1015,6 +1018,14 @@
</span><span class="cx">                 m_heap.escape(node-&gt;child1().node());
</span><span class="cx">             break;
</span><span class="cx"> 
</span><ins>+        case LoadArrowFunctionThis:
+            target = m_heap.onlyLocalAllocation(node-&gt;child1().node());
+            if (target &amp;&amp; target-&gt;isArrowFunctionAllocation())
+                exactRead = ArrowFunctionBoundThisPLoc;
+            else
+                m_heap.escape(node-&gt;child1().node());
+            break;
+        
</ins><span class="cx">         case GetScope:
</span><span class="cx">             target = m_heap.onlyLocalAllocation(node-&gt;child1().node());
</span><span class="cx">             if (target &amp;&amp; target-&gt;isFunctionAllocation())
</span><span class="lines">@@ -2034,8 +2045,9 @@
</span><span class="cx">         
</span><span class="cx">         case NewFunction:
</span><span class="cx">         case NewArrowFunction: {
</span><ins>+            bool isArrowFunction = node-&gt;op() == NewArrowFunction;
</ins><span class="cx">             Vector&lt;PromotedHeapLocation&gt; locations = m_locationsForAllocation.get(escapee);
</span><del>-            ASSERT(locations.size() == 2);
</del><ins>+            ASSERT(locations.size() == (isArrowFunction ? 3 : 2));
</ins><span class="cx">                 
</span><span class="cx">             PromotedHeapLocation executable(FunctionExecutablePLoc, allocation.identifier());
</span><span class="cx">             ASSERT_UNUSED(executable, locations.contains(executable));
</span><span class="lines">@@ -2044,6 +2056,13 @@
</span><span class="cx">             ASSERT(locations.contains(activation));
</span><span class="cx"> 
</span><span class="cx">             node-&gt;child1() = Edge(resolve(block, activation), KnownCellUse);
</span><ins>+            
+            if (isArrowFunction) {
+                PromotedHeapLocation boundThis(ArrowFunctionBoundThisPLoc, allocation.identifier());
+                ASSERT(locations.contains(boundThis));
+                node-&gt;child2() = Edge(resolve(block, boundThis), CellUse);
+            }
+            
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -616,6 +616,10 @@
</span><span class="cx">             changed |= setPrediction(SpecObjectOther);
</span><span class="cx">             break;
</span><span class="cx"> 
</span><ins>+        case LoadArrowFunctionThis:
+            changed |= setPrediction(SpecFinalObject);
+            break;
+
</ins><span class="cx">         case In:
</span><span class="cx">             changed |= setPrediction(SpecBoolean);
</span><span class="cx">             break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPromotedHeapLocationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -102,6 +102,10 @@
</span><span class="cx">     case ClosureVarPLoc:
</span><span class="cx">         out.print(&quot;ClosureVarPLoc&quot;);
</span><span class="cx">         return;
</span><ins>+
+    case ArrowFunctionBoundThisPLoc:
+        out.print(&quot;ArrowFunctionBoundThisPLoc&quot;);
+        return;
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPromotedHeapLocationh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -46,7 +46,8 @@
</span><span class="cx">     FunctionExecutablePLoc,
</span><span class="cx">     FunctionActivationPLoc,
</span><span class="cx">     ActivationScopePLoc,
</span><del>-    ClosureVarPLoc
</del><ins>+    ClosureVarPLoc,
+    ArrowFunctionBoundThisPLoc
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class PromotedLocationDescriptor {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -202,6 +202,7 @@
</span><span class="cx">     case Arrayify:
</span><span class="cx">     case ArrayifyToStructure:
</span><span class="cx">     case GetScope:
</span><ins>+    case LoadArrowFunctionThis:
</ins><span class="cx">     case SkipScope:
</span><span class="cx">     case GetClosureVar:
</span><span class="cx">     case PutClosureVar:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -4842,7 +4842,16 @@
</span><span class="cx">     m_jit.loadPtr(JITCompiler::Address(function.gpr(), JSFunction::offsetOfScopeChain()), result.gpr());
</span><span class="cx">     cellResult(result.gpr(), node);
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx">     
</span><ins>+void SpeculativeJIT::compileLoadArrowFunctionThis(Node* node)
+{
+    SpeculateCellOperand function(this, node-&gt;child1());
+    GPRTemporary result(this, Reuse, function);
+    m_jit.loadPtr(JITCompiler::Address(function.gpr(), JSArrowFunction::offsetOfThisValue()), result.gpr());
+    cellResult(result.gpr(), node);
+}
+    
</ins><span class="cx"> void SpeculativeJIT::compileSkipScope(Node* node)
</span><span class="cx"> {
</span><span class="cx">     SpeculateCellOperand scope(this, node-&gt;child1());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -2200,6 +2200,7 @@
</span><span class="cx">     void compileGetByValOnScopedArguments(Node*);
</span><span class="cx">     
</span><span class="cx">     void compileGetScope(Node*);
</span><ins>+    void compileLoadArrowFunctionThis(Node*);
</ins><span class="cx">     void compileSkipScope(Node*);
</span><span class="cx"> 
</span><span class="cx">     void compileGetArrayLength(Node*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -3799,6 +3799,10 @@
</span><span class="cx">     case GetScope:
</span><span class="cx">         compileGetScope(node);
</span><span class="cx">         break;
</span><ins>+
+    case LoadArrowFunctionThis:
+        compileLoadArrowFunctionThis(node);
+        break;
</ins><span class="cx">             
</span><span class="cx">     case SkipScope:
</span><span class="cx">         compileSkipScope(node);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -3837,6 +3837,10 @@
</span><span class="cx">         compileGetScope(node);
</span><span class="cx">         break;
</span><span class="cx">             
</span><ins>+    case LoadArrowFunctionThis:
+        compileLoadArrowFunctionThis(node);
+        break;
+            
</ins><span class="cx">     case SkipScope:
</span><span class="cx">         compileSkipScope(node);
</span><span class="cx">         break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -152,6 +152,7 @@
</span><span class="cx">     case CountExecution:
</span><span class="cx">     case GetExecutable:
</span><span class="cx">     case GetScope:
</span><ins>+    case LoadArrowFunctionThis:
</ins><span class="cx">     case GetCallee:
</span><span class="cx">     case GetArgumentCount:
</span><span class="cx">     case ToString:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -812,6 +812,9 @@
</span><span class="cx">         case GetScope:
</span><span class="cx">             compileGetScope();
</span><span class="cx">             break;
</span><ins>+        case LoadArrowFunctionThis:
+            compileLoadArrowFunctionThis();
+            break;
</ins><span class="cx">         case SkipScope:
</span><span class="cx">             compileSkipScope();
</span><span class="cx">             break;
</span><span class="lines">@@ -4557,6 +4560,11 @@
</span><span class="cx">         setJSValue(m_out.loadPtr(lowCell(m_node-&gt;child1()), m_heaps.JSFunction_scope));
</span><span class="cx">     }
</span><span class="cx">     
</span><ins>+    void compileLoadArrowFunctionThis()
+    {
+        setJSValue(m_out.loadPtr(lowCell(m_node-&gt;child1()), m_heaps.JSArrowFunction_this));
+    }
+    
</ins><span class="cx">     void compileSkipScope()
</span><span class="cx">     {
</span><span class="cx">         setJSValue(m_out.loadPtr(lowCell(m_node-&gt;child1()), m_heaps.JSScope_next));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -164,17 +164,25 @@
</span><span class="cx">         // Figure out what the executable and activation are
</span><span class="cx">         FunctionExecutable* executable = nullptr;
</span><span class="cx">         JSScope* activation = nullptr;
</span><ins>+        JSValue boundThis;
+        bool isArrowFunction = false;
</ins><span class="cx">         for (unsigned i = materialization-&gt;properties().size(); i--;) {
</span><span class="cx">             const ExitPropertyValue&amp; property = materialization-&gt;properties()[i];
</span><span class="cx">             if (property.location() == PromotedLocationDescriptor(FunctionExecutablePLoc))
</span><span class="cx">                 executable = jsCast&lt;FunctionExecutable*&gt;(JSValue::decode(values[i]));
</span><span class="cx">             if (property.location() == PromotedLocationDescriptor(FunctionActivationPLoc))
</span><span class="cx">                 activation = jsCast&lt;JSScope*&gt;(JSValue::decode(values[i]));
</span><ins>+            if (property.location() == PromotedLocationDescriptor(ArrowFunctionBoundThisPLoc)) {
+                isArrowFunction = true;
+                boundThis = JSValue::decode(values[i]);
+            }
</ins><span class="cx">         }
</span><span class="cx">         RELEASE_ASSERT(executable &amp;&amp; activation);
</span><span class="cx"> 
</span><span class="cx">         
</span><del>-        JSFunction* result = JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
</del><ins>+        JSFunction* result = isArrowFunction
+            ? JSArrowFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation, boundThis)
+            : JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
</ins><span class="cx"> 
</span><span class="cx">         return result;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterInterpretercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -180,8 +180,7 @@
</span><span class="cx">         // If the literal parser bailed, it should not have thrown exceptions.
</span><span class="cx">         ASSERT(!callFrame-&gt;vm().exception());
</span><span class="cx"> 
</span><del>-        eval = callerCodeBlock-&gt;evalCodeCache().getSlow(callFrame, callerCodeBlock, callerCodeBlock-&gt;isStrictMode(), thisTDZMode, callerCodeBlock-&gt;unlinkedCodeBlock()-&gt;isDerivedConstructorContext(), callerCodeBlock-&gt;unlinkedCodeBlock()-&gt;isArrowFunction(), sourceCode, callerScopeChain);
-
</del><ins>+        eval = callerCodeBlock-&gt;evalCodeCache().getSlow(callFrame, callerCodeBlock, callerCodeBlock-&gt;isStrictMode(), thisTDZMode, sourceCode, callerScopeChain);
</ins><span class="cx">         if (!eval)
</span><span class="cx">             return jsUndefined();
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -223,6 +223,7 @@
</span><span class="cx">         DEFINE_OP(op_end)
</span><span class="cx">         DEFINE_OP(op_enter)
</span><span class="cx">         DEFINE_OP(op_get_scope)
</span><ins>+        DEFINE_OP(op_load_arrowfunction_this)
</ins><span class="cx">         DEFINE_OP(op_eq)
</span><span class="cx">         DEFINE_OP(op_eq_null)
</span><span class="cx">         case op_get_array_length:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/jit/JIT.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -502,6 +502,7 @@
</span><span class="cx">         void emit_op_end(Instruction*);
</span><span class="cx">         void emit_op_enter(Instruction*);
</span><span class="cx">         void emit_op_get_scope(Instruction*);
</span><ins>+        void emit_op_load_arrowfunction_this(Instruction*);
</ins><span class="cx">         void emit_op_eq(Instruction*);
</span><span class="cx">         void emit_op_eq_null(Instruction*);
</span><span class="cx">         void emit_op_get_by_id(Instruction*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -667,6 +667,14 @@
</span><span class="cx">     loadPtr(Address(regT0, JSFunction::offsetOfScopeChain()), regT0);
</span><span class="cx">     emitStoreCell(dst, regT0);
</span><span class="cx"> }
</span><ins>+    
+void JIT::emit_op_load_arrowfunction_this(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    emitGetFromCallFrameHeaderPtr(JSStack::Callee, regT0);
+    loadPtr(Address(regT0, JSArrowFunction::offsetOfThisValue()), regT0);
+    emitStoreCell(dst, regT0);
+}
</ins><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_to_this(Instruction* currentInstruction)
</span><span class="cx"> {
</span><span class="lines">@@ -961,14 +969,23 @@
</span><span class="cx"> 
</span><span class="cx"> void JIT::emitNewFuncExprCommon(Instruction* currentInstruction)
</span><span class="cx"> {
</span><ins>+    OpcodeID opcodeID = m_vm-&gt;interpreter-&gt;getOpcodeID(currentInstruction-&gt;u.opcode);
+    bool isArrowFunction = opcodeID == op_new_arrow_func_exp;
+    
</ins><span class="cx">     Jump notUndefinedScope;
</span><span class="cx">     int dst = currentInstruction[1].u.operand;
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="cx">     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
</span><ins>+    if (isArrowFunction)
+        emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
</ins><span class="cx">     notUndefinedScope = branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsUndefined())));
</span><span class="cx">     store64(TrustedImm64(JSValue::encode(jsUndefined())), Address(callFrameRegister, sizeof(Register) * dst));
</span><span class="cx"> #else
</span><span class="cx">     emitLoadPayload(currentInstruction[2].u.operand, regT0);
</span><ins>+    if (isArrowFunction) {
+        int value = currentInstruction[4].u.operand;
+        emitLoad(value, regT3, regT2);
+    }
</ins><span class="cx">     notUndefinedScope = branch32(NotEqual, tagFor(currentInstruction[2].u.operand), TrustedImm32(JSValue::UndefinedTag));
</span><span class="cx">     emitStore(dst, jsUndefined());
</span><span class="cx"> #endif
</span><span class="lines">@@ -976,15 +993,20 @@
</span><span class="cx">     notUndefinedScope.link(this);
</span><span class="cx">         
</span><span class="cx">     FunctionExecutable* function = m_codeBlock-&gt;functionExpr(currentInstruction[3].u.operand);
</span><del>-    OpcodeID opcodeID = m_vm-&gt;interpreter-&gt;getOpcodeID(currentInstruction-&gt;u.opcode);
-
-    if (opcodeID == op_new_func_exp || opcodeID == op_new_arrow_func_exp)
-        callOperation(operationNewFunction, dst, regT0, function);
</del><ins>+    if (isArrowFunction)
+#if USE(JSVALUE64)
+        callOperation(operationNewArrowFunction, dst, regT0, function, regT1);
+#else 
+        callOperation(operationNewArrowFunction, dst, regT0, function, regT3, regT2);
+#endif
</ins><span class="cx">     else {
</span><del>-        ASSERT(opcodeID == op_new_generator_func_exp);
-        callOperation(operationNewGeneratorFunction, dst, regT0, function);
</del><ins>+        if (opcodeID == op_new_func_exp)
+            callOperation(operationNewFunction, dst, regT0, function);
+        else {
+            ASSERT(opcodeID == op_new_generator_func_exp);
+            callOperation(operationNewGeneratorFunction, dst, regT0, function);
+        }
</ins><span class="cx">     }
</span><del>-
</del><span class="cx">     done.link(this);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -938,6 +938,14 @@
</span><span class="cx">     emitStoreCell(dst, regT0);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void JIT::emit_op_load_arrowfunction_this(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    emitGetFromCallFrameHeaderPtr(JSStack::Callee, regT0);
+    loadPtr(Address(regT0, JSArrowFunction::offsetOfThisValue()), regT0);
+    emitStoreCell(dst, regT0);
+}
+
</ins><span class="cx"> void JIT::emit_op_create_this(Instruction* currentInstruction)
</span><span class="cx"> {
</span><span class="cx">     int callee = currentInstruction[2].u.operand;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1079,12 +1079,13 @@
</span><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_new_arrow_func_exp)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN();
</span><del>-    
</del><ins>+
+    JSValue thisValue = LLINT_OP_C(4).jsValue();
</ins><span class="cx">     CodeBlock* codeBlock = exec-&gt;codeBlock();
</span><span class="cx">     JSScope* scope = exec-&gt;uncheckedR(pc[2].u.operand).Register::scope();
</span><span class="cx">     FunctionExecutable* executable = codeBlock-&gt;functionExpr(pc[3].u.operand);
</span><span class="cx">     
</span><del>-    LLINT_RETURN(JSFunction::create(vm, executable, scope));
</del><ins>+    LLINT_RETURN(JSArrowFunction::create(vm, executable, scope, thisValue));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc, JSValue callee, CodeSpecializationKind kind)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1472,7 +1472,7 @@
</span><span class="cx"> _llint_op_new_arrow_func_exp:
</span><span class="cx">     traceExecution()
</span><span class="cx">     callSlowPath(_llint_slow_path_new_arrow_func_exp)
</span><del>-    dispatch(4)
</del><ins>+    dispatch(5)
</ins><span class="cx"> 
</span><span class="cx"> _llint_op_call:
</span><span class="cx">     traceExecution()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -2422,6 +2422,16 @@
</span><span class="cx">     dispatch(2)
</span><span class="cx"> 
</span><span class="cx"> 
</span><ins>+_llint_op_load_arrowfunction_this:
+    traceExecution()
+    loadi Callee + PayloadOffset[cfr], t0
+    loadi JSArrowFunction::m_boundThis[t0], t0
+    loadisFromInstruction(1, t1)
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    dispatch(2)
+
+
</ins><span class="cx"> _llint_op_get_rest_length:
</span><span class="cx">     traceExecution()
</span><span class="cx">     loadi PayloadOffset + ArgumentCount[cfr], t0
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -2284,14 +2284,22 @@
</span><span class="cx"> .opProfileTypeDone:
</span><span class="cx">     dispatch(6)
</span><span class="cx"> 
</span><del>-
-
</del><span class="cx"> _llint_op_profile_control_flow:
</span><span class="cx">     traceExecution()
</span><span class="cx">     loadpFromInstruction(1, t0)
</span><span class="cx">     addq 1, BasicBlockLocation::m_executionCount[t0]
</span><span class="cx">     dispatch(2)
</span><span class="cx"> 
</span><ins>+
+_llint_op_load_arrowfunction_this:
+    traceExecution()
+    loadp Callee[cfr], t0
+    loadp JSArrowFunction::m_boundThis[t0], t0
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+    dispatch(2)
+
+
</ins><span class="cx"> _llint_op_get_rest_length:
</span><span class="cx">     traceExecution()
</span><span class="cx">     loadi PayloadOffset + ArgumentCount[cfr], t0
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserASTBuilderh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/ASTBuilder.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/ASTBuilder.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/parser/ASTBuilder.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -376,7 +376,7 @@
</span><span class="cx"> 
</span><span class="cx">     ExpressionNode* createArrowFunctionExpr(const JSTokenLocation&amp; location, const ParserFunctionInfo&lt;ASTBuilder&gt;&amp; functionInfo)
</span><span class="cx">     {
</span><del>-        usesArrowFunction();
</del><ins>+        usesThis();
</ins><span class="cx">         SourceCode source = m_sourceCode-&gt;subExpression(functionInfo.startOffset, functionInfo.body-&gt;isArrowFunctionBodyExpression() ? functionInfo.endOffset - 1 : functionInfo.endOffset, functionInfo.startLine, functionInfo.bodyStartColumn);
</span><span class="cx">         ArrowFuncExprNode* result = new (m_parserArena) ArrowFuncExprNode(location, *functionInfo.name, functionInfo.body, source);
</span><span class="cx">         functionInfo.body-&gt;setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
</span><span class="lines">@@ -917,7 +917,6 @@
</span><span class="cx"> 
</span><span class="cx">     void incConstants() { m_scope.m_numConstants++; }
</span><span class="cx">     void usesThis() { m_scope.m_features |= ThisFeature; }
</span><del>-    void usesArrowFunction() { m_scope.m_features |= ArrowFunctionFeature; }
</del><span class="cx">     void usesArguments() { m_scope.m_features |= ArgumentsFeature; }
</span><span class="cx">     void usesWith() { m_scope.m_features |= WithFeature; }
</span><span class="cx">     void usesEval() 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserNodesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/Nodes.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/Nodes.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/parser/Nodes.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1559,7 +1559,6 @@
</span><span class="cx"> 
</span><span class="cx">         bool usesEval() const { return m_features &amp; EvalFeature; }
</span><span class="cx">         bool usesArguments() const { return (m_features &amp; ArgumentsFeature) &amp;&amp; !(m_features &amp; ShadowsArgumentsFeature); }
</span><del>-        bool usesArrowFunction() const { return m_features &amp; ArrowFunctionFeature; }
</del><span class="cx">         bool modifiesParameter() const { return m_features &amp; ModifiedParameterFeature; }
</span><span class="cx">         bool modifiesArguments() const { return m_features &amp; (EvalFeature | ModifiedArgumentsFeature); }
</span><span class="cx">         bool isStrictMode() const { return m_features &amp; StrictModeFeature; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/Parser.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/Parser.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/parser/Parser.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1978,11 +1978,11 @@
</span><span class="cx">         semanticFailIfTrue(m_vm-&gt;propertyNames-&gt;arguments == *functionInfo.name, &quot;'&quot;, functionInfo.name-&gt;impl(), &quot;' is not a valid function name in strict mode&quot;);
</span><span class="cx">         semanticFailIfTrue(m_vm-&gt;propertyNames-&gt;eval == *functionInfo.name, &quot;'&quot;, functionInfo.name-&gt;impl(), &quot;' is not a valid function name in strict mode&quot;);
</span><span class="cx">     }
</span><del>-    if (functionScope-&gt;hasDirectSuper() &amp;&amp; functionBodyType == StandardFunctionBodyBlock) {
</del><ins>+    if (functionScope-&gt;hasDirectSuper()) {
</ins><span class="cx">         semanticFailIfTrue(!isClassConstructor, &quot;Cannot call super() outside of a class constructor&quot;);
</span><span class="cx">         semanticFailIfTrue(constructorKind != ConstructorKind::Derived, &quot;Cannot call super() in a base class constructor&quot;);
</span><span class="cx">     }
</span><del>-    if (functionScope-&gt;needsSuperBinding() &amp;&amp; functionBodyType == StandardFunctionBodyBlock)
</del><ins>+    if (functionScope-&gt;needsSuperBinding())
</ins><span class="cx">         semanticFailIfTrue(expectedSuperBinding == SuperBinding::NotNeeded, &quot;super can only be used in a method of a derived class&quot;);
</span><span class="cx"> 
</span><span class="cx">     JSTokenLocation location = JSTokenLocation(m_token.m_location);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserParserModesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/ParserModes.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/ParserModes.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/parser/ParserModes.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -147,19 +147,17 @@
</span><span class="cx"> 
</span><span class="cx"> typedef unsigned CodeFeatures;
</span><span class="cx"> 
</span><del>-const CodeFeatures NoFeatures =                       0;
-const CodeFeatures EvalFeature =                 1 &lt;&lt; 0;
-const CodeFeatures ArgumentsFeature =            1 &lt;&lt; 1;
-const CodeFeatures WithFeature =                 1 &lt;&lt; 2;
-const CodeFeatures ThisFeature =                 1 &lt;&lt; 3;
-const CodeFeatures StrictModeFeature =           1 &lt;&lt; 4;
-const CodeFeatures ShadowsArgumentsFeature =     1 &lt;&lt; 5;
-const CodeFeatures ModifiedParameterFeature =    1 &lt;&lt; 6;
-const CodeFeatures ModifiedArgumentsFeature =    1 &lt;&lt; 7;
-const CodeFeatures ArrowFunctionFeature =        1 &lt;&lt; 8;
-const CodeFeatures ArrowFunctionContextFeature = 1 &lt;&lt; 9;
</del><ins>+const CodeFeatures NoFeatures =                    0;
+const CodeFeatures EvalFeature =              1 &lt;&lt; 0;
+const CodeFeatures ArgumentsFeature =         1 &lt;&lt; 1;
+const CodeFeatures WithFeature =              1 &lt;&lt; 2;
+const CodeFeatures ThisFeature =              1 &lt;&lt; 3;
+const CodeFeatures StrictModeFeature =        1 &lt;&lt; 4;
+const CodeFeatures ShadowsArgumentsFeature =  1 &lt;&lt; 5;
+const CodeFeatures ModifiedParameterFeature = 1 &lt;&lt; 6;
+const CodeFeatures ModifiedArgumentsFeature = 1 &lt;&lt; 7;
</ins><span class="cx"> 
</span><del>-const CodeFeatures AllFeatures = EvalFeature | ArgumentsFeature | WithFeature | ThisFeature | StrictModeFeature | ShadowsArgumentsFeature | ModifiedParameterFeature | ArrowFunctionFeature | ArrowFunctionContextFeature;
</del><ins>+const CodeFeatures AllFeatures = EvalFeature | ArgumentsFeature | WithFeature | ThisFeature | StrictModeFeature | ShadowsArgumentsFeature | ModifiedParameterFeature;
</ins><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCodeCachecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CodeCache.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CodeCache.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/runtime/CodeCache.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -83,7 +83,8 @@
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> template &lt;class UnlinkedCodeBlockType, class ExecutableType&gt;
</span><del>-UnlinkedCodeBlockType* CodeCache::getGlobalCodeBlock(VM&amp; vm, ExecutableType* executable, const SourceCode&amp; source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, bool, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error, const VariableEnvironment* variablesUnderTDZ)
</del><ins>+UnlinkedCodeBlockType* CodeCache::getGlobalCodeBlock(VM&amp; vm, ExecutableType* executable, const SourceCode&amp; source, JSParserBuiltinMode builtinMode,
+    JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error, const VariableEnvironment* variablesUnderTDZ)
</ins><span class="cx"> {
</span><span class="cx">     SourceCodeKey key = SourceCodeKey(source, String(), CacheTypes&lt;UnlinkedCodeBlockType&gt;::codeType, builtinMode, strictMode, thisTDZMode);
</span><span class="cx">     SourceCodeValue* cache = m_sourceCode.findCacheAndUpdateAge(key);
</span><span class="lines">@@ -111,8 +112,7 @@
</span><span class="cx">     bool endColumnIsOnStartLine = !lineCount;
</span><span class="cx">     unsigned unlinkedEndColumn = rootNode-&gt;endColumn();
</span><span class="cx">     unsigned endColumn = unlinkedEndColumn + (endColumnIsOnStartLine ? startColumn : 1);
</span><del>-    unsigned arrowContextFeature = executable-&gt;isArrowFunctionContext() ? ArrowFunctionContextFeature : 0;
-    executable-&gt;recordParse(rootNode-&gt;features() | arrowContextFeature, rootNode-&gt;hasCapturedVariables(), rootNode-&gt;firstLine(), rootNode-&gt;lastLine(), startColumn, endColumn);
</del><ins>+    executable-&gt;recordParse(rootNode-&gt;features(), rootNode-&gt;hasCapturedVariables(), rootNode-&gt;firstLine(), rootNode-&gt;lastLine(), startColumn, endColumn);
</ins><span class="cx"> 
</span><span class="cx">     UnlinkedCodeBlockType* unlinkedCodeBlock = UnlinkedCodeBlockType::create(&amp;vm, executable-&gt;executableInfo());
</span><span class="cx">     unlinkedCodeBlock-&gt;recordParse(rootNode-&gt;features(), rootNode-&gt;hasCapturedVariables(), rootNode-&gt;firstLine() - source.firstLine(), lineCount, unlinkedEndColumn);
</span><span class="lines">@@ -132,18 +132,18 @@
</span><span class="cx"> UnlinkedProgramCodeBlock* CodeCache::getProgramCodeBlock(VM&amp; vm, ProgramExecutable* executable, const SourceCode&amp; source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</span><span class="cx"> {
</span><span class="cx">     VariableEnvironment emptyParentTDZVariables;
</span><del>-    return getGlobalCodeBlock&lt;UnlinkedProgramCodeBlock&gt;(vm, executable, source, builtinMode, strictMode, ThisTDZMode::CheckIfNeeded, false, debuggerMode, profilerMode, error, &amp;emptyParentTDZVariables);
</del><ins>+    return getGlobalCodeBlock&lt;UnlinkedProgramCodeBlock&gt;(vm, executable, source, builtinMode, strictMode, ThisTDZMode::CheckIfNeeded, debuggerMode, profilerMode, error, &amp;emptyParentTDZVariables);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(VM&amp; vm, EvalExecutable* executable, const SourceCode&amp; source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, bool isArrowFunctionContext, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error, const VariableEnvironment* variablesUnderTDZ)
</del><ins>+UnlinkedEvalCodeBlock* CodeCache::getEvalCodeBlock(VM&amp; vm, EvalExecutable* executable, const SourceCode&amp; source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, ThisTDZMode thisTDZMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error, const VariableEnvironment* variablesUnderTDZ)
</ins><span class="cx"> {
</span><del>-    return getGlobalCodeBlock&lt;UnlinkedEvalCodeBlock&gt;(vm, executable, source, builtinMode, strictMode, thisTDZMode, isArrowFunctionContext, debuggerMode, profilerMode, error, variablesUnderTDZ);
</del><ins>+    return getGlobalCodeBlock&lt;UnlinkedEvalCodeBlock&gt;(vm, executable, source, builtinMode, strictMode, thisTDZMode, debuggerMode, profilerMode, error, variablesUnderTDZ);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> UnlinkedModuleProgramCodeBlock* CodeCache::getModuleProgramCodeBlock(VM&amp; vm, ModuleProgramExecutable* executable, const SourceCode&amp; source, JSParserBuiltinMode builtinMode, DebuggerMode debuggerMode, ProfilerMode profilerMode, ParserError&amp; error)
</span><span class="cx"> {
</span><span class="cx">     VariableEnvironment emptyParentTDZVariables;
</span><del>-    return getGlobalCodeBlock&lt;UnlinkedModuleProgramCodeBlock&gt;(vm, executable, source, builtinMode, JSParserStrictMode::Strict, ThisTDZMode::CheckIfNeeded, false, debuggerMode, profilerMode, error, &amp;emptyParentTDZVariables);
</del><ins>+    return getGlobalCodeBlock&lt;UnlinkedModuleProgramCodeBlock&gt;(vm, executable, source, builtinMode, JSParserStrictMode::Strict, ThisTDZMode::CheckIfNeeded, debuggerMode, profilerMode, error, &amp;emptyParentTDZVariables);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // FIXME: There's no need to add the function's name to the key here. It's already in the source code.
</span><span class="lines">@@ -188,7 +188,7 @@
</span><span class="cx">     metadata-&gt;setEndPosition(positionBeforeLastNewline);
</span><span class="cx">     // The Function constructor only has access to global variables, so no variables will be under TDZ.
</span><span class="cx">     VariableEnvironment emptyTDZVariables;
</span><del>-    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&amp;vm, source, metadata, UnlinkedNormalFunction, ConstructAbility::CanConstruct, GeneratorThisMode::NonEmpty, emptyTDZVariables, false);
</del><ins>+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&amp;vm, source, metadata, UnlinkedNormalFunction, ConstructAbility::CanConstruct, GeneratorThisMode::NonEmpty, emptyTDZVariables);
</ins><span class="cx">     functionExecutable-&gt;m_nameValue.set(vm, functionExecutable, jsString(&amp;vm, name.string()));
</span><span class="cx"> 
</span><span class="cx">     m_sourceCode.addCache(key, SourceCodeValue(vm, functionExecutable, m_sourceCode.age()));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCodeCacheh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CodeCache.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CodeCache.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/runtime/CodeCache.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -194,7 +194,7 @@
</span><span class="cx">     ~CodeCache();
</span><span class="cx"> 
</span><span class="cx">     UnlinkedProgramCodeBlock* getProgramCodeBlock(VM&amp;, ProgramExecutable*, const SourceCode&amp;, JSParserBuiltinMode, JSParserStrictMode, DebuggerMode, ProfilerMode, ParserError&amp;);
</span><del>-    UnlinkedEvalCodeBlock* getEvalCodeBlock(VM&amp;, EvalExecutable*, const SourceCode&amp;, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, bool, DebuggerMode, ProfilerMode, ParserError&amp;, const VariableEnvironment*);
</del><ins>+    UnlinkedEvalCodeBlock* getEvalCodeBlock(VM&amp;, EvalExecutable*, const SourceCode&amp;, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&amp;, const VariableEnvironment*);
</ins><span class="cx">     UnlinkedModuleProgramCodeBlock* getModuleProgramCodeBlock(VM&amp;, ModuleProgramExecutable*, const SourceCode&amp;, JSParserBuiltinMode, DebuggerMode, ProfilerMode, ParserError&amp;);
</span><span class="cx">     UnlinkedFunctionExecutable* getFunctionExecutableFromGlobalCode(VM&amp;, const Identifier&amp;, const SourceCode&amp;, ParserError&amp;);
</span><span class="cx"> 
</span><span class="lines">@@ -205,7 +205,7 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     template &lt;class UnlinkedCodeBlockType, class ExecutableType&gt; 
</span><del>-    UnlinkedCodeBlockType* getGlobalCodeBlock(VM&amp;, ExecutableType*, const SourceCode&amp;, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, bool, DebuggerMode, ProfilerMode, ParserError&amp;, const VariableEnvironment*);
</del><ins>+    UnlinkedCodeBlockType* getGlobalCodeBlock(VM&amp;, ExecutableType*, const SourceCode&amp;, JSParserBuiltinMode, JSParserStrictMode, ThisTDZMode, DebuggerMode, ProfilerMode, ParserError&amp;, const VariableEnvironment*);
</ins><span class="cx"> 
</span><span class="cx">     CodeCacheMap m_sourceCode;
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonIdentifiersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -341,8 +341,6 @@
</span><span class="cx">     macro(Collator) \
</span><span class="cx">     macro(DateTimeFormat) \
</span><span class="cx">     macro(NumberFormat) \
</span><del>-    macro(newTargetLocal) \
-    macro(derivedConstructor) \
</del><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Executable.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Executable.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/runtime/Executable.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -131,15 +131,13 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo ScriptExecutable::s_info = { &quot;ScriptExecutable&quot;, &amp;ExecutableBase::s_info, 0, CREATE_METHOD_TABLE(ScriptExecutable) };
</span><span class="cx"> 
</span><del>-ScriptExecutable::ScriptExecutable(Structure* structure, VM&amp; vm, const SourceCode&amp; source, bool isInStrictContext, bool isInDerivedConstructorContext, bool isInArrowFunctionContext)
</del><ins>+ScriptExecutable::ScriptExecutable(Structure* structure, VM&amp; vm, const SourceCode&amp; source, bool isInStrictContext)
</ins><span class="cx">     : ExecutableBase(vm, structure, NUM_PARAMETERS_NOT_COMPILED)
</span><span class="cx">     , m_source(source)
</span><span class="cx">     , m_features(isInStrictContext ? StrictModeFeature : 0)
</span><span class="cx">     , m_hasCapturedVariables(false)
</span><span class="cx">     , m_neverInline(false)
</span><span class="cx">     , m_didTryToEnterInLoop(false)
</span><del>-    , m_isDerivedConstructorContext(isInDerivedConstructorContext)
-    , m_isArrowFunctionContext(isInArrowFunctionContext)
</del><span class="cx">     , m_overrideLineNumber(-1)
</span><span class="cx">     , m_firstLine(-1)
</span><span class="cx">     , m_lastLine(-1)
</span><span class="lines">@@ -414,7 +412,7 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo EvalExecutable::s_info = { &quot;EvalExecutable&quot;, &amp;ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(EvalExecutable) };
</span><span class="cx"> 
</span><del>-EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode&amp; source, bool isInStrictContext, ThisTDZMode thisTDZMode, bool isDerivedConstructorContext, bool isArrowFunctionContext, const VariableEnvironment* variablesUnderTDZ)
</del><ins>+EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode&amp; source, bool isInStrictContext, ThisTDZMode thisTDZMode, const VariableEnvironment* variablesUnderTDZ)
</ins><span class="cx"> {
</span><span class="cx">     JSGlobalObject* globalObject = exec-&gt;lexicalGlobalObject();
</span><span class="cx">     if (!globalObject-&gt;evalEnabled()) {
</span><span class="lines">@@ -422,10 +420,10 @@
</span><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    EvalExecutable* executable = new (NotNull, allocateCell&lt;EvalExecutable&gt;(*exec-&gt;heap())) EvalExecutable(exec, source, isInStrictContext, isDerivedConstructorContext, isArrowFunctionContext);
</del><ins>+    EvalExecutable* executable = new (NotNull, allocateCell&lt;EvalExecutable&gt;(*exec-&gt;heap())) EvalExecutable(exec, source, isInStrictContext);
</ins><span class="cx">     executable-&gt;finishCreation(exec-&gt;vm());
</span><span class="cx"> 
</span><del>-    UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject-&gt;createEvalCodeBlock(exec, executable, thisTDZMode, isArrowFunctionContext, variablesUnderTDZ);
</del><ins>+    UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject-&gt;createEvalCodeBlock(exec, executable, thisTDZMode, variablesUnderTDZ);
</ins><span class="cx">     if (!unlinkedEvalCode)
</span><span class="cx">         return 0;
</span><span class="cx"> 
</span><span class="lines">@@ -434,8 +432,8 @@
</span><span class="cx">     return executable;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode&amp; source, bool inStrictContext, bool isDerivedConstructorContext, bool isArrowFunctionContext)
-    : ScriptExecutable(exec-&gt;vm().evalExecutableStructure.get(), exec-&gt;vm(), source, inStrictContext, isDerivedConstructorContext, isArrowFunctionContext)
</del><ins>+EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode&amp; source, bool inStrictContext)
+    : ScriptExecutable(exec-&gt;vm().evalExecutableStructure.get(), exec-&gt;vm(), source, inStrictContext)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -447,7 +445,7 @@
</span><span class="cx"> const ClassInfo ProgramExecutable::s_info = { &quot;ProgramExecutable&quot;, &amp;ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(ProgramExecutable) };
</span><span class="cx"> 
</span><span class="cx"> ProgramExecutable::ProgramExecutable(ExecState* exec, const SourceCode&amp; source)
</span><del>-    : ScriptExecutable(exec-&gt;vm().programExecutableStructure.get(), exec-&gt;vm(), source, false, false, false)
</del><ins>+    : ScriptExecutable(exec-&gt;vm().programExecutableStructure.get(), exec-&gt;vm(), source, false)
</ins><span class="cx"> {
</span><span class="cx">     m_typeProfilingStartOffset = 0;
</span><span class="cx">     m_typeProfilingEndOffset = source.length() - 1;
</span><span class="lines">@@ -463,7 +461,7 @@
</span><span class="cx"> const ClassInfo ModuleProgramExecutable::s_info = { &quot;ModuleProgramExecutable&quot;, &amp;ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(ModuleProgramExecutable) };
</span><span class="cx"> 
</span><span class="cx"> ModuleProgramExecutable::ModuleProgramExecutable(ExecState* exec, const SourceCode&amp; source)
</span><del>-    : ScriptExecutable(exec-&gt;vm().moduleProgramExecutableStructure.get(), exec-&gt;vm(), source, false, false, false)
</del><ins>+    : ScriptExecutable(exec-&gt;vm().moduleProgramExecutableStructure.get(), exec-&gt;vm(), source, false)
</ins><span class="cx"> {
</span><span class="cx">     m_typeProfilingStartOffset = 0;
</span><span class="cx">     m_typeProfilingEndOffset = source.length() - 1;
</span><span class="lines">@@ -494,8 +492,10 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo FunctionExecutable::s_info = { &quot;FunctionExecutable&quot;, &amp;ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(FunctionExecutable) };
</span><span class="cx"> 
</span><del>-FunctionExecutable::FunctionExecutable(VM&amp; vm, const SourceCode&amp; source, UnlinkedFunctionExecutable* unlinkedExecutable, unsigned firstLine, unsigned lastLine, unsigned startColumn, unsigned endColumn)
-    : ScriptExecutable(vm.functionExecutableStructure.get(), vm, source, unlinkedExecutable-&gt;isInStrictContext(), unlinkedExecutable-&gt;isDerivedConstructorContext(), false)
</del><ins>+FunctionExecutable::FunctionExecutable(VM&amp; vm, const SourceCode&amp; source, 
+    UnlinkedFunctionExecutable* unlinkedExecutable, unsigned firstLine, 
+    unsigned lastLine, unsigned startColumn, unsigned endColumn)
+    : ScriptExecutable(vm.functionExecutableStructure.get(), vm, source, unlinkedExecutable-&gt;isInStrictContext())
</ins><span class="cx">     , m_unlinkedExecutable(vm, this, unlinkedExecutable)
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT(!source.isNull());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Executable.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Executable.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/runtime/Executable.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -344,9 +344,7 @@
</span><span class="cx">     bool usesEval() const { return m_features &amp; EvalFeature; }
</span><span class="cx">     bool usesArguments() const { return m_features &amp; ArgumentsFeature; }
</span><span class="cx">     bool needsActivation() const { return m_hasCapturedVariables || m_features &amp; (EvalFeature | WithFeature); }
</span><del>-    bool isArrowFunctionContext() const { return m_isArrowFunctionContext; }
</del><span class="cx">     bool isStrictMode() const { return m_features &amp; StrictModeFeature; }
</span><del>-    bool isDerivedConstructorContext() const { return m_isDerivedConstructorContext; }
</del><span class="cx">     ECMAMode ecmaMode() const { return isStrictMode() ? StrictMode : NotStrictMode; }
</span><span class="cx">         
</span><span class="cx">     void setNeverInline(bool value) { m_neverInline = value; }
</span><span class="lines">@@ -395,7 +393,7 @@
</span><span class="cx">     JSObject* prepareForExecutionImpl(ExecState*, JSFunction*, JSScope*, CodeSpecializationKind);
</span><span class="cx"> 
</span><span class="cx"> protected:
</span><del>-    ScriptExecutable(Structure*, VM&amp;, const SourceCode&amp;, bool isInStrictContext, bool isInDerivedConstructorContext, bool isInArrowFunctionContext);
</del><ins>+    ScriptExecutable(Structure* structure, VM&amp; vm, const SourceCode&amp; source, bool isInStrictContext);
</ins><span class="cx"> 
</span><span class="cx">     void finishCreation(VM&amp; vm)
</span><span class="cx">     {
</span><span class="lines">@@ -414,8 +412,6 @@
</span><span class="cx">     bool m_neverInline;
</span><span class="cx">     bool m_neverOptimize { false };
</span><span class="cx">     bool m_didTryToEnterInLoop;
</span><del>-    bool m_isDerivedConstructorContext;
-    bool m_isArrowFunctionContext;
</del><span class="cx">     int m_overrideLineNumber;
</span><span class="cx">     int m_firstLine;
</span><span class="cx">     int m_lastLine;
</span><span class="lines">@@ -438,7 +434,7 @@
</span><span class="cx">         return m_evalCodeBlock.get();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static EvalExecutable* create(ExecState*, const SourceCode&amp;, bool isInStrictContext, ThisTDZMode, bool isDerivedConstructorContext, bool isArrowFunctionContext, const VariableEnvironment*);
</del><ins>+    static EvalExecutable* create(ExecState*, const SourceCode&amp;, bool isInStrictContext, ThisTDZMode, const VariableEnvironment*);
</ins><span class="cx"> 
</span><span class="cx">     PassRefPtr&lt;JITCode&gt; generatedJITCode()
</span><span class="cx">     {
</span><span class="lines">@@ -452,16 +448,15 @@
</span><span class="cx">         
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><ins>+    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, GeneratorThisMode::NonEmpty, SuperBinding::NotNeeded, SourceParseMode::ProgramMode); }
</ins><span class="cx"> 
</span><del>-    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, GeneratorThisMode::NonEmpty, SuperBinding::NotNeeded, SourceParseMode::ProgramMode, isDerivedConstructorContext(), isArrowFunctionContext()); }
-
</del><span class="cx">     unsigned numVariables() { return m_unlinkedEvalCodeBlock-&gt;numVariables(); }
</span><span class="cx">     unsigned numberOfFunctionDecls() { return m_unlinkedEvalCodeBlock-&gt;numberOfFunctionDecls(); }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     friend class ExecutableBase;
</span><span class="cx">     friend class ScriptExecutable;
</span><del>-    EvalExecutable(ExecState*, const SourceCode&amp;, bool inStrictContext, bool isDerivedConstructorContext, bool isArrowFunctionContext);
</del><ins>+    EvalExecutable(ExecState*, const SourceCode&amp;, bool);
</ins><span class="cx"> 
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx"> 
</span><span class="lines">@@ -506,7 +501,7 @@
</span><span class="cx">         
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><del>-    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, GeneratorThisMode::NonEmpty, SuperBinding::NotNeeded, SourceParseMode::ProgramMode, isDerivedConstructorContext(), false); }
</del><ins>+    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, GeneratorThisMode::NonEmpty, SuperBinding::NotNeeded, SourceParseMode::ProgramMode); }
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     friend class ExecutableBase;
</span><span class="lines">@@ -547,8 +542,7 @@
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><del>-    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, GeneratorThisMode::NonEmpty, SuperBinding::NotNeeded, SourceParseMode::ModuleEvaluateMode, isDerivedConstructorContext(), false); }
-
</del><ins>+    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, GeneratorThisMode::NonEmpty, SuperBinding::NotNeeded, SourceParseMode::ModuleEvaluateMode); }
</ins><span class="cx">     UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock() { return m_unlinkedModuleProgramCodeBlock.get(); }
</span><span class="cx"> 
</span><span class="cx">     SymbolTable* moduleEnvironmentSymbolTable() { return m_moduleEnvironmentSymbolTable.get(); }
</span><span class="lines">@@ -656,15 +650,13 @@
</span><span class="cx">     FunctionMode functionMode() { return m_unlinkedExecutable-&gt;functionMode(); }
</span><span class="cx">     bool isBuiltinFunction() const { return m_unlinkedExecutable-&gt;isBuiltinFunction(); }
</span><span class="cx">     ConstructAbility constructAbility() const { return m_unlinkedExecutable-&gt;constructAbility(); }
</span><del>-    // TODO:Think about avoid using isArrowFunction veriabl
-    bool isArrowFunction() const { return parseMode() == SourceParseMode::ArrowFunctionMode; }
-    bool isDerivedConstructorContext() const { return m_unlinkedExecutable-&gt;isDerivedConstructorContext(); }
</del><span class="cx">     bool isClassConstructorFunction() const { return m_unlinkedExecutable-&gt;isClassConstructorFunction(); }
</span><span class="cx">     const Identifier&amp; name() { return m_unlinkedExecutable-&gt;name(); }
</span><span class="cx">     const Identifier&amp; inferredName() { return m_unlinkedExecutable-&gt;inferredName(); }
</span><span class="cx">     JSString* nameValue() const { return m_unlinkedExecutable-&gt;nameValue(); }
</span><span class="cx">     size_t parameterCount() const { return m_unlinkedExecutable-&gt;parameterCount(); } // Excluding 'this'!
</span><span class="cx">     SourceParseMode parseMode() const { return m_unlinkedExecutable-&gt;parseMode(); }
</span><ins>+    bool isArrowFunction() const { return parseMode() == SourceParseMode::ArrowFunctionMode; }
</ins><span class="cx"> 
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue proto)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -972,14 +972,14 @@
</span><span class="cx">     return unlinkedCodeBlock;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, ThisTDZMode thisTDZMode, bool isArrowFunctionContext, const VariableEnvironment* variablesUnderTDZ)
</del><ins>+UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, ThisTDZMode thisTDZMode, const VariableEnvironment* variablesUnderTDZ)
</ins><span class="cx"> {
</span><span class="cx">     ParserError error;
</span><span class="cx">     JSParserStrictMode strictMode = executable-&gt;isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
</span><span class="cx">     DebuggerMode debuggerMode = hasDebugger() ? DebuggerOn : DebuggerOff;
</span><span class="cx">     ProfilerMode profilerMode = hasProfiler() ? ProfilerOn : ProfilerOff;
</span><span class="cx">     UnlinkedEvalCodeBlock* unlinkedCodeBlock = vm().codeCache()-&gt;getEvalCodeBlock(
</span><del>-        vm(), executable, executable-&gt;source(), JSParserBuiltinMode::NotBuiltin, strictMode, thisTDZMode, isArrowFunctionContext, debuggerMode, profilerMode, error, variablesUnderTDZ);
</del><ins>+        vm(), executable, executable-&gt;source(), JSParserBuiltinMode::NotBuiltin, strictMode, thisTDZMode, debuggerMode, profilerMode, error, variablesUnderTDZ);
</ins><span class="cx"> 
</span><span class="cx">     if (hasDebugger())
</span><span class="cx">         debugger()-&gt;sourceParsed(callFrame, executable-&gt;source().provider(), error.line(), error.message());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -669,7 +669,7 @@
</span><span class="cx">     unsigned weakRandomInteger() { return m_weakRandom.getUint32(); }
</span><span class="cx"> 
</span><span class="cx">     UnlinkedProgramCodeBlock* createProgramCodeBlock(CallFrame*, ProgramExecutable*, JSObject** exception);
</span><del>-    UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*, ThisTDZMode, bool isArrowFunctionContext, const VariableEnvironment*);
</del><ins>+    UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*, ThisTDZMode, const VariableEnvironment*);
</ins><span class="cx">     UnlinkedModuleProgramCodeBlock* createModuleProgramCodeBlock(CallFrame*, ModuleProgramExecutable*);
</span><span class="cx"> 
</span><span class="cx"> protected:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -581,7 +581,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSGlobalObject* calleeGlobalObject = exec-&gt;callee()-&gt;globalObject();
</span><span class="cx">     VariableEnvironment emptyTDZVariables; // Indirect eval does not have access to the lexical scope.
</span><del>-    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false, ThisTDZMode::CheckIfNeeded, false, false, &amp;emptyTDZVariables);
</del><ins>+    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false, ThisTDZMode::CheckIfNeeded, &amp;emptyTDZVariables);
</ins><span class="cx">     if (!eval)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestses6yaml"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/es6.yaml (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/es6.yaml        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/es6.yaml        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -745,7 +745,7 @@
</span><span class="cx"> - path: es6/arrow_functions_lexical_arguments_binding.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/arrow_functions_lexical_new.target_binding.js
</span><del>-  cmd: runES6 :normal
</del><ins>+  cmd: runES6 :fail
</ins><span class="cx"> - path: es6/arrow_functions_lexical_super_binding.js
</span><span class="cx">   cmd: runES6 :fail
</span><span class="cx"> - path: es6/arrow_functions_no_prototype_property.js
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionactivationsinkosrexitjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-activation-sink-osrexit.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-activation-sink-osrexit.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-activation-sink-osrexit.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,4 +1,4 @@
</span><del>-var n = 100000;
</del><ins>+var n = 1000000;
</ins><span class="cx"> 
</span><span class="cx"> function bar() { }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionactivationsinkjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-activation-sink.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-activation-sink.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-activation-sink.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,4 +1,4 @@
</span><del>-var n = 1000000;
</del><ins>+var n = 10000000;
</ins><span class="cx"> 
</span><span class="cx"> function bar(f) { f(10); }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindnewtargetjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-newtarget.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-newtarget.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-newtarget.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,78 +0,0 @@
</span><del>-var testCase = function (actual, expected, message) {
-    if (actual !== expected) {
-        throw message + &quot;. Expected '&quot; + expected + &quot;', but was '&quot; + actual + &quot;'&quot;;
-    }
-};
-
-function getTarget(name) {
-    return x =&gt; new.target;
-}
-
-noInline(getTarget)
-
-for (var i=0; i &lt; 1000; i++) {
-    var undefinedTarget = getTarget()();
-    testCase(undefinedTarget, undefined, &quot;Error: new.target is not lexically binded inside of the arrow function #1&quot;);
-}
-
-for (var i = 0; i &lt; 1000; i++) {
-    var newTarget = new getTarget()();
-    testCase(newTarget, getTarget, &quot;Error: new.target is not lexically binded inside of the arrow function #2&quot;);
-}
-
-var passed = false;
-var A = class A {
-    constructor() {
-        this.idValue = 123;
-        passed = passed &amp;&amp; new.target === B;
-    }
-};
-
-var B  = class B extends A {
-    constructor() {
-        var f = () =&gt; {
-            passed = new.target === B;
-            super();
-        };
-        f();
-    }
-};
-
-for (var i = 0; i &lt; 1000; i++) {
-    passed = false;
-    var b = new B();
-
-    testCase(passed, true, &quot;Error: new.target is not lexically binded inside of the arrow function in constructor #3&quot;);
-}
-
-var C = class C extends A {
-    constructor(tryToAccessToVarInArrow) {
-        var f = () =&gt; {
-            super();
-            if (tryToAccessToVarInArrow)
-                this.id2 = newTargetLocal;
-        };
-
-        f();
-
-        if (!tryToAccessToVarInArrow)
-            this.id = newTargetLocal;
-    }
-};
-
-var tryToCreateClass = function (val) {
-    var result = false;
-    try {
-        new C(val);
-    }
-    catch (e) {
-        result = e instanceof ReferenceError; 
-    }
-
-    return result;
-};
-
-for (var i = 0; i &lt; 1000; i++) {
-    testCase(tryToCreateClass(true), true, &quot;Error: newTargetLocal should be hided variable&quot;);
-    testCase(tryToCreateClass(false), true, &quot;Error: newTargetLocal should be hided variable&quot;);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindsupercall1js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-1.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-1.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-1.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,67 +0,0 @@
</span><del>-var testCase = function (actual, expected, message) {
-    if (actual !== expected) {
-        throw message + &quot;. Expected '&quot; + expected + &quot;', but was '&quot; + actual + &quot;'&quot;;
-    }
-};
-
-var testValue  = 'test-value';
-
-var A = class A {
-    constructor() {
-        this.idValue = testValue;
-    }
-};
-
-var B = class B extends A {
-    constructor (inArrowFuction, inConstructor) {
-        var arrow = () =&gt; {
-            if (inArrowFuction) {
-                super();
-                testCase(this.idValue, testValue, &quot;Error: super() should create this and put value into idValue property&quot;);
-            }
-        }
-
-        if (inArrowFuction)
-            arrow();
-
-        if (inConstructor)
-            super();
-
-        testCase(this.idValue, testValue, &quot;Error: arrow function should return this to constructor&quot;);
-    }
-};
-
-for (var i = 0; i &lt; 1000; i++) {
-    new B(true, false);
-    new B(false, true);
-}
-
-var testException = function (value1, value2, index) {
-    var exception;
-    try {
-        new B(value1, value2);
-    } catch (e) {
-        exception = e;
-        if (!(e instanceof ReferenceError))
-            throw &quot;Exception thrown was not a reference error&quot;;
-    }
-
-    if (!exception)
-        throw &quot;Exception not thrown for an unitialized this at iteration &quot; + index;
-}
-
-for (var i=0; i &lt; 1000; i++) {
-    testException(false, false, i);
-}
-
-var C = class C extends A {
-    constructor() {
-        eval(&quot;var x = 20&quot;);
-        super();
-        let f = () =&gt; this;
-        let xf = f();
-        xf.id = 'test-id';
-    }
-};
-
-var c = new C();
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindsupercall2js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-2.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-2.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-2.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,176 +0,0 @@
</span><del>-var testCase = function (actual, expected, message) {
-    if (actual !== expected) {
-        throw message + &quot;. Expected '&quot; + expected + &quot;', but was '&quot; + actual + &quot;'&quot;;
-    }
-};
-
-var testValue  = 'test-value';
-
-var A = class A {
-    constructor() {
-        this.idValue = testValue;
-    }
-};
-
-var B = class B extends A {
-    constructor (inArrowFuction, inConstructor, setProtoToNull) {
-        var arrow = () =&gt; () =&gt; () =&gt; {
-            if (inArrowFuction) {
-              super();
-              testCase(this.idValue, testValue, &quot;Error: super() should create this and put value into idValue property&quot;);
-            }
-        };
-
-        if (inArrowFuction)
-            arrow()()();
-
-        if (inConstructor)
-            super();
-
-        testCase(this.idValue, testValue, &quot;Error: arrow function should return this to constructor&quot;);
-    }
-};
-
-for (var i=0; i &lt; 1000; i++) {
-    new B(true, false);
-    new B(false, true);
-}
-
-var testException = function (index) {
-    var exception;
-    try {
-        new B(false, false);
-    } catch (e) {
-        exception = e;
-        if (!(e instanceof ReferenceError))
-            throw &quot;Exception thrown was not a correct error. Expected ReferenceError but was &quot; + e.name;
-    }
-
-    if (!exception)
-        throw &quot;Exception not thrown for an unitialized this at iteration #&quot; + index;
-}
-
-for (var i = 0; i &lt; 1000; i++) {
-  testException(i, ReferenceError);
-}
-
-var C = class C extends A {
-    constructor () {
-      var arrow = () =&gt; {
-          let __proto__ = 'some-text';
-          var arr = () =&gt; {
-              testCase(typeof  __proto__, 'string', &quot;Erorr: __proto__ variable has wrong type&quot;);
-              super();
-              testCase(this.idValue, testValue, &quot;Error: super() should create this and put value into idValue property&quot;);
-           };
-           arr();
-       };
-
-      arrow();
-
-      testCase(this.idValue, testValue, &quot;Error: arrow function should return this to constructor&quot;);
-    }
-};
-
-for (var i = 0; i &lt; 1000; i++) {
-    new C();
-}
-
-class D extends A {
-    constructor(doReplaceProto) {
-        var arrow = () =&gt; super();
-        if (doReplaceProto)
-            D.__proto__ = function () {};
-        arrow();
-    }
-}
-
-testCase((new D(false)).idValue, testValue, &quot;Error: arrow function bound wrong super&quot;);
-testCase(typeof (new D(true)).idValue, &quot;undefined&quot; , &quot;Error: arrow function bound wrong super&quot;);
-
-class E extends A {
-    constructor(doReplaceProto) {
-        var arrow = () =&gt; {
-            if (doReplaceProto)
-                E.__proto__ = function () {};
-            super();
-        };
-
-        arrow();
-    }
-}
-
-testCase((new E(false)).idValue, testValue, &quot;Error: arrow function bound wrong super #1&quot;);
-testCase(typeof (new E(true)).idValue, &quot;undefined&quot; , &quot;Error: arrow function bound wrong super #1&quot;);
-
-
-class F extends A {
-    constructor(doReplaceProto) {
-        var arrow = () =&gt; {
-            F.__proto__ = null;
-            super();
-        };
-
-        arrow();
-    }
-}
-
-var testTypeErrorException = function (index) {
-    var exception;
-    try {
-        new F();
-    } catch (e) {
-        exception = e;
-        if (!(e instanceof TypeError))
-            throw &quot;Exception thrown was not a correct error. Expected TypeError but was &quot; + e.name;
-    }
-
-    if (!exception)
-        throw &quot;Exception not thrown for an unitialized this at iteration #&quot; + index;
-}
-
-for (var i = 0; i &lt; 1000; i++) {
-  testTypeErrorException(i);
-}
-
-var errorStack;
-
-var ParentClass = class ParentClass {
-    constructor() {
-        try {
-            this.idValue = testValue;
-            throw new Error('Error');
-        } catch (e) {
-            errorStack  = e.stack;
-        }
-    }
-};
-
-var ChildClass = class ChildClass extends ParentClass {
-    constructor () {
-        var arrowInChildConstructor = () =&gt; {
-            var nestedArrow = () =&gt; {
-                super();
-            }
-
-            nestedArrow();
-        };
-
-        arrowInChildConstructor();
-    }
-};
-
-for (var i = 0; i &lt; 1000; i++) {
-    errorStack = '';
-    let c = new ChildClass();
-
-    let parentClassIndexOf = errorStack.indexOf('ParentClass');
-    let nestedArrowIndexOf = errorStack.indexOf('nestedArrow');
-    let arrowInChildConstructorIndexOf = errorStack.indexOf('arrowInChildConstructor');
-    let childClassIndexOf = errorStack.indexOf('ChildClass');
-
-    testCase(parentClassIndexOf &gt; -1 &amp;&amp; errorStack.indexOf('ParentClass', parentClassIndexOf + 1) === -1, true, &quot;Error: stack of error should contain ParentClass text&quot;);
-    testCase(nestedArrowIndexOf &gt; -1 &amp;&amp; errorStack.indexOf('nestedArrow', nestedArrowIndexOf + 1) === -1, true, &quot;Error: stack of error should contain nestedArrow text&quot;);
-    testCase(arrowInChildConstructorIndexOf &gt; -1 &amp;&amp; errorStack.indexOf('arrowInChildConstructor', arrowInChildConstructorIndexOf + 1) === -1, true, &quot;Error: stack of error should contain arrowInChildConstructor text&quot;);
-    testCase(childClassIndexOf &gt; -1 &amp;&amp; errorStack.indexOf('ChildClass', childClassIndexOf + 1) === -1, true, &quot;Error: stack of error should contains ChildClass text&quot;);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindsupercall3js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-3.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-3.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-3.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,52 +0,0 @@
</span><del>-var testCase = function (actual, expected, message) {
-    if (actual !== expected) {
-        throw message + &quot;. Expected '&quot; + expected + &quot;', but was '&quot; + actual + &quot;'&quot;;
-    }
-};
-
-var testValue  = 'test-value';
-
-var A = class A {
-    constructor() {
-        this.idValue = testValue;
-    }
-};
-
-var B = class B extends A {
-    constructor (beforeSuper) {
-        var arrow = () =&gt; eval('(() =&gt; this.idValue)()');
-
-        if (beforeSuper) {
-            var result = arrow();
-            super();
-            testCase(result, testValue, &quot;Error: has to be TDZ error&quot;);
-        } else {
-            super();
-            let result= arrow();
-            testCase(result, testValue, &quot;Error: super() should create this and put value into idValue property&quot;);
-        }
-    }
-};
-
-for (var i = 0; i &lt; 1000; i++) {
-    var b = new B(false);
-}
-
-var testException = function (value, index) {
-  var exception;
-  try {
-       new B(value);
-  } catch (e) {
-      exception = e;
-      if (!(e instanceof ReferenceError))
-          throw &quot;Exception thrown was not a reference error&quot;;
-  }
-
-  if (!exception)
-      throw &quot;Exception not thrown for an unitialized this at iteration #&quot; + index;
-}
-
-
-for (var i = 0; i &lt; 1000; i++) {
-    testException(true, i);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindsupercall4js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-4.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-4.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-supercall-4.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,80 +0,0 @@
</span><del>-var testCase = function (actual, expected, message) {
-    if (actual !== expected) {
-        throw message + &quot;. Expected '&quot; + expected + &quot;', but was '&quot; + actual + &quot;'&quot;;
-    }
-};
-
-var testValue  = 'test-value';
-
-var A = class A {
-    constructor() {
-        this.idValue = testValue;
-    }
-};
-
-var B = class B extends A {
-  constructor (beforeSuper) {
-
-      var arrow = () =&gt; eval('(() =&gt; super())()');
-
-      if (beforeSuper) {
-          arrow();
-          testCase(this.idValue, testValue, &quot;Error: super() should create this and put value into idValue property&quot;);
-      } else {
-          testCase(this.idValue, testValue, &quot;Error: has to be TDZ error&quot;);
-          arrow();
-      }
-  }
-};
-
-var C = class C extends A {
-    constructor () {
-        var arrow = () =&gt; eval('(() =&gt; super())()');
-        arrow();
-        return {};
-    }
-};
-
-var D = class D extends A {
-    constructor () {
-        var arrow = () =&gt; eval('(() =&gt; super())()');
-        arrow();
-        eval('this.id=&quot;new-value&quot;');
-    }
-};
-
-var E = class E extends A {
-    constructor () {
-        var arrow = () =&gt; eval(&quot;eval('(() =&gt; super())()')&quot;);
-        arrow();
-        eval('eval(&quot;this.id=\'new-value\'&quot;)');
-    }
-};
-
-for (var i=0; i &lt; 1000; i++) {
-    new B(true);
-    var c = new C();
-    testCase(typeof c.id, 'undefined', 'Error during set value in eval #1');
-    var d = new D();
-    testCase(d.id, 'new-value', 'Error during set value in eval #2');
-    var e = new E();
-    testCase(e.id, 'new-value', 'Error during set value in eval #3');
-}
-
-var testException = function (value, index) {
-    var exception;
-    try {
-        new B(value);
-    } catch (e) {
-        exception = e;
-        if (!(e instanceof ReferenceError))
-            throw &quot;Exception thrown was not a reference error&quot;;
-    }
-
-    if (!exception)
-        throw &quot;Exception not thrown for an unitialized this at iteration #&quot; + index;
-}
-
-for (var i=0; i &lt; 1000; i++) {
-    testException(false, i);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindthis1js"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-this-1.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-this-1.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-this-1.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -8,7 +8,6 @@
</span><span class="cx">   this.name = name;
</span><span class="cx">   this.getName = () =&gt; eval(&quot;this.name&quot;);
</span><span class="cx">   this.getNameHard = () =&gt; eval(&quot;(() =&gt; this.name)()&quot;);
</span><del>-  this.getNameReallyHard = () =&gt; eval(&quot;eval('(() =&gt; this.name)()')&quot;);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> noInline(Dog)
</span><span class="lines">@@ -17,5 +16,4 @@
</span><span class="cx">   var d = new Dog(&quot;Max&quot;);
</span><span class="cx">   testCase(d.getName(), d.name, &quot;Error: this is not lexically binded inside of the arrow function #1&quot;);
</span><span class="cx">   testCase(d.getNameHard(), d.name, &quot;Error: this is not lexically binded inside of the arrow function #2&quot;);
</span><del>-  testCase(d.getNameReallyHard(), d.name, &quot;Error: this is not lexically binded inside of the arrow function #3&quot;);
</del><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctionlexicalbindthis7js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-this-7.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-this-7.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-lexical-bind-this-7.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,24 +0,0 @@
</span><del>-var testCase = function (actual, expected, message) {
-    if (actual !== expected) {
-        throw message + &quot;. Expected '&quot; + expected + &quot;', but was '&quot; + actual + &quot;'&quot;;
-    }
-};
-
-var deepScope = function (x, y) {
-    var _x = x, _y = y;
-    return ()=&gt; _x + _y + this.val;
-};
-
-var a = deepScope.call({val:'A'}, 'D', 'E');
-var b = deepScope.call({val:'B'}, 'D', 'F');
-var c = deepScope.call({val:'C'}, 'D', 'G');
-
-var anotherScope = function (_af) {
-    return _af();
-};
-
-for (var i = 0; i &lt; 1000; i++) {
-    testCase(c(), anotherScope.call({val:'I'}, c), &quot;Error: this is not lexically binded inside of the arrow function #1&quot;);
-    testCase(b(), anotherScope.call({val:'J'}, b), &quot;Error: this is not lexically binded inside of the arrow function #2&quot;);
-    testCase(a(), anotherScope.call({val:'K'}, a), &quot;Error: this is not lexically binded inside of the arrow function #3&quot;);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctiontdz1js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-1.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-1.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-1.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,31 +0,0 @@
</span><del>-var A = class A { };
-var B = class B extends A {
-    constructor(beforeSuper, returnThis) {
-        var f = () =&gt; returnThis ? this : {};
-        if (beforeSuper) {
-            let val = f();
-            super();
-        } else {
-            super();
-            let val = f();
-        }
-    }
-};
-
-var exception = null;
-for (var i=0; i &lt; 10000; i++) {
-    try {
-        new B(true, true);
-    } catch (e) {
-        exception = e;
-        if (!(e instanceof ReferenceError))
-            throw &quot;Exception thrown was not a reference error&quot;;
-    }
-
-    if (!exception)
-        throw &quot;Exception not thrown for an unitialized this at iteration&quot;;
-
-    var a = new B(false, true);
-    var b = new B(false, false);
-    var c = new B(true, false);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctiontdz2js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-2.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-2.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-2.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,32 +0,0 @@
</span><del>-var A = class A { };
-var B = class B extends A {
-    constructor(beforeSuper, returnThis) {
-        var f = () =&gt; returnThis ? (() =&gt; this ) : (()=&gt;{});
-        let af = f();
-        if (beforeSuper) {
-            let result = af();
-            super();
-        } else {
-            super();
-            let result = af();
-        }
-    }
-};
-
-var exception = null;
-for (var i = 0; i &lt; 10000; i++) {
-    try {
-        new B(true, true);
-    } catch (e) {
-        exception = e;
-        if (!(e instanceof ReferenceError))
-            throw &quot;Exception thrown was not a reference error&quot;;
-    }
-
-    if (!exception)
-        throw &quot;Exception not thrown for an unitialized this at iteration&quot;;
-
-    var a = new B(false, true);
-    var b = new B(false, false);
-    var c = new B(true, false);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctiontdz3js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-3.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-3.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-3.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,177 +0,0 @@
</span><del>-var testCase = function (actual, expected, message) {
-  if (actual !== expected) {
-    throw message + &quot;. Expected '&quot; + expected + &quot;', but was '&quot; + actual + &quot;'&quot;;
-  }
-};
-
-var A = class A {
-   constructor() {
-      this.id = 'A'
-   }
-};
-
-var B = class B extends A {
-  constructor(beforeSuper) {
-    var f = () =&gt; {
-      if (this.id === 'A') {
-        return 'ok';
-      }
-      return 'ok';
-    };
-    let val;
-    if (beforeSuper) {
-      val = f();
-      super();
-    } else {
-      super();
-      val = f();
-    }
-    this.res = val;
-  }
-};
-
-var C = class C extends A {
-  constructor(beforeSuper) {
-    var f = () =&gt; {
-      if (this &gt; 5) {
-        return 'ok';
-      }
-      return 'ok';
-    };
-    let val;
-    if (beforeSuper) {
-      val = f();
-      super();
-    } else {
-      super();
-      val = f();
-    }
-    this.res = val;
-  }
-};
-
-var D = class D extends A {
-  constructor(beforeSuper) {
-    var f = () =&gt; {
-      if (this &lt; 5) {
-        return 'ok';
-      }
-      return 'ok';
-    };
-    let val;
-    if (beforeSuper) {
-      val = f();
-      super();
-    } else {
-      super();
-      val = f();
-    }
-    this.res = val;
-  }
-};
-
-var E = class E extends A {
-  constructor(beforeSuper) {
-    var f = () =&gt; {
-      if (this !== 5) {
-        return 'ok';
-      }
-      return 'ok';
-    };
-    let val;
-    if (beforeSuper) {
-      val = f();
-      super();
-    } else {
-      super();
-       val = f();
-    }
-    this.res = val;
-  }
-};
-
-var F = class F extends A {
-  constructor(beforeSuper) {
-    var f = () =&gt; {
-      if (this &lt;= 5) {
-        return 'ok';
-      }
-      return 'ok';
-    };
-    let val;
-    if (beforeSuper) {
-      val = f();
-      super();
-    } else {
-      super();
-      val = f();
-    }
-    this.res = val;
-  }
-};
-
-var G = class G extends A {
-  constructor(beforeSuper) {
-    var f = () =&gt; {
-      if (this &gt;= 5) {
-        return 'ok';
-      }
-      return 'ok';
-    };
-    let val;
-    if (beforeSuper) {
-      val = f();
-      super();
-    } else {
-      super();
-      val = f();
-    }
-    this.res = val;
-  }
-};
-
-var G = class G extends A {
-  constructor(beforeSuper) {
-    var f = () =&gt; {
-      if (this === 5) {
-        return 'ok';
-      }
-      return 'ok';
-    };
-    let val;
-    if (beforeSuper) {
-      val = f();
-      super();
-    } else {
-      super();
-      val = f();
-    }
-    this.res = val;
-  }
-};
-
-var tryToCreate = function (classForCreate) {
-  var result = false;
-  try {
-       new classForCreate(true);
-  } catch (e) {
-      result = e instanceof ReferenceError;
-  }
-
-  return result;
-}
-
-var check = function (classForCheck) {
-  testCase(tryToCreate(classForCheck), true, 'Exception wasn\'t thrown or was not a reference error');
-  var result = new classForCheck(false);
-  testCase(result.res, 'ok', 'Error in setting id ');
-}
-
-for (var i = 0; i &lt; 10000; i++) {
-  check(B);
-  check(C);
-  check(D);
-  check(E);
-  check(F);
-  check(G);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctiontdz4js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-4.js (193605 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-4.js        2015-12-07 01:16:22 UTC (rev 193605)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz-4.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -1,46 +0,0 @@
</span><del>-var testCase = function (actual, expected, message) {
-    if (actual !== expected) {
-        throw message + &quot;. Expected '&quot; + expected + &quot;', but was '&quot; + actual + &quot;'&quot;;
-    }
-};
-
-var testValue  = 'test-value';
-
-var A = class A {
-    constructor() {
-        this.idValue = testValue;
-    }
-};
-
-var B = class B extends A {
-  constructor (doRunSuper) {
-      var arrow = () =&gt; {
-          if (doRunSuper) {
-              super();
-              testCase(this.idValue, testValue, &quot;Error: super() should create this and put value into idValue property&quot;);
-          }
-      }
-
-      if (doRunSuper) {
-          arrow();
-          testCase(this.idValue, testValue, &quot;Error: arrow function should return this to constructor&quot;);
-      } else {
-          var value = this.idValue;//force TDZ error
-          debug(value);
-      }
-  }
-};
-
-for (var i=0; i &lt; 10000; i++) {
-    var exception;
-    try {
-        new B(false);
-    } catch (e) {
-        exception = e;
-        if (!(e instanceof ReferenceError))
-            throw &quot;Exception thrown was not a reference error&quot;;
-    }
-
-    if (!exception)
-        throw &quot;Exception not thrown for an unitialized this at iteration #&quot; + i;
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrowfunctiontdzjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz.js (0 => 193606)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/arrowfunction-tdz.js        2015-12-07 01:54:43 UTC (rev 193606)
</span><span class="lines">@@ -0,0 +1,27 @@
</span><ins>+var A = class A { };
+var B = class B extends A {
+  constructor(accessThisBeforeSuper) {
+    if (accessThisBeforeSuper) {
+      var f = () =&gt; this;
+      super();
+    } else {
+      super();
+    }
+  }
+};
+
+var exception = null;
+for (var i=0; i&lt;10000; i++) {
+  try {
+       new B(true);
+  } catch (e) {
+      exception = e;
+      if (!(e instanceof ReferenceError))
+          throw &quot;Exception thrown was not a reference error&quot;;
+  }
+
+  if (!exception)
+      throw &quot;Exception not thrown for an unitialized this at iteration&quot;;
+
+  var e = new B(false);
+}
</ins></span></pre>
</div>
</div>

</body>
</html>