[turbofan] Fix invalid lowering of let variable in TDZ.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 44 matching lines @@
 
 Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode());
   Handle<Name> name = LoadGlobalParametersOf(node->op()).name();
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Try to lookup the name on the script context table first (lexical scoping).
   ScriptContextTableLookupResult result;
   if (LookupInScriptContextTable(name, &result)) {
+    if (result.context->is_the_hole(result.index)) return NoChange();
     Node* context = jsgraph()->Constant(result.context);
     Node* value = effect = graph()->NewNode(
         javascript()->LoadContext(0, result.index, result.immutable), context,
         context, effect);
     return Replace(node, value, effect);
   }
 
   // Lookup on the global object instead.  We only deal with own data
   // properties of the global object here (represented as PropertyCell).
   LookupIterator it(global_object(), name, LookupIterator::OWN);
@@ skipping 61 matching lines @@
   DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode());
   Handle<Name> name = StoreGlobalParametersOf(node->op()).name();
   Node* value = NodeProperties::GetValueInput(node, 2);
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Try to lookup the name on the script context table first (lexical scoping).
   ScriptContextTableLookupResult result;
   if (LookupInScriptContextTable(name, &result)) {
+    if (result.context->is_the_hole(result.index)) return NoChange();
     if (result.immutable) return NoChange();
     Node* context = jsgraph()->Constant(result.context);
     effect = graph()->NewNode(javascript()->StoreContext(0, result.index),
                               context, value, context, effect, control);
     return Replace(node, value, effect, control);
   }
 
   // Lookup on the global object instead.  We only deal with own data
   // properties of the global object here (represented as PropertyCell).
   LookupIterator it(global_object(), name, LookupIterator::OWN);
@@ skipping 507 matching lines @@
   if (!name->IsString()) return false;
   Handle<ScriptContextTable> script_context_table(
       global_object()->native_context()->script_context_table());
   ScriptContextTable::LookupResult lookup_result;
   if (!ScriptContextTable::Lookup(script_context_table,
                                   Handle<String>::cast(name), &lookup_result)) {
     return false;
   }
   Handle<Context> script_context = ScriptContextTable::GetContext(
       script_context_table, lookup_result.context_index);
-  if (script_context->is_the_hole(lookup_result.slot_index)) return false;
   result->context = script_context;
   result->immutable = IsImmutableVariableMode(lookup_result.mode);
   result->index = lookup_result.slot_index;
   return true;
 }
 
 
 Graph* JSNativeContextSpecialization::graph() const {
   return jsgraph()->graph();
 }
@@ skipping 24 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8