Index: Source/JavaScriptCore/ChangeLog
===================================================================
--- Source/JavaScriptCore/ChangeLog	(revision 268822)
+++ Source/JavaScriptCore/ChangeLog	(working copy)
@@ -1,3 +1,139 @@
+2020-10-23  Saam Barati  <sbarati@apple.com>
+
+        Better cache our serialization of the outer TDZ environment when creating FunctionExecutables during bytecode generation
+        https://bugs.webkit.org/show_bug.cgi?id=199866
+        <rdar://problem/53333108>
+
+        Reviewed by NOBODY (OOPS!).
+
+        This patch removes performance pathologies regarding programs with
+        many variables under TDZ (let/const). We had an algorithm for caching
+        the results of gathering all variables under TDZ, but that algorithm
+        wasn't nearly aggressive enough in its caching. This lead us to worst
+        case quadratic runtime, which could happens in practice for large functions.
+        
+        There are a few fixes here:
+        - Instead of flattening the entire TDZ stack, and caching that result,
+        we now cache each stack entry individually. So as you push/pop to the
+        TDZ environment stack, we no longer invalidate everything. Instead, we
+        will just need to cache the newly pushed entry. We also no longer invalidate
+        the cache for lifting a TDZ check. The compromise here is we may emit
+        more runtime TDZ checks for closure variables. This is better than N^2
+        bytecode compile time perf, since a well predicted branch for a TDZ
+        check is essentially free.
+        - We no longer transform the CompactTDZEnvironment (formerly CompactVariableEnvironment)
+        from a Vector into a HashSet each time we generate code for an inner function. Instead,
+        CompactTDZEnvironment can be in two modes: compact and inflated. It starts life off in
+        compact mode (a vector), and will turn into an inflated mode if it's ever needed. Once
+        inflated, it'll stay this way until it's destructed. This improves our algorithm from being 
+        O(EnvSize * NumFunctions) to O(EnvSize) at the cost of using more space in a HashTable versus a 
+        Vector. In the future, we could consider just binary searching through this Vector, and never using
+        a hash table.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::popLexicalScopeInternal):
+        (JSC::BytecodeGenerator::needsTDZCheck):
+        (JSC::BytecodeGenerator::liftTDZCheckIfPossible):
+        (JSC::BytecodeGenerator::pushTDZVariables):
+        (JSC::BytecodeGenerator::getVariablesUnderTDZ):
+        (JSC::BytecodeGenerator::preserveTDZStack):
+        (JSC::BytecodeGenerator::restoreTDZStack):
+        (JSC::BytecodeGenerator::emitNewInstanceFieldInitializerFunction):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluateWithScopeExtension):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        (JSC::parse):
+        * parser/VariableEnvironment.cpp:
+        (JSC::CompactTDZEnvironment::sortCompact):
+        (JSC::CompactTDZEnvironment::CompactTDZEnvironment):
+        (JSC::CompactTDZEnvironment::operator== const):
+        (JSC::CompactTDZEnvironment::toTDZEnvironmentSlow const):
+        (JSC::CompactTDZEnvironmentMap::get):
+        (JSC::CompactTDZEnvironmentMap::Handle::~Handle):
+        (JSC::CompactTDZEnvironmentMap::Handle::Handle):
+        (JSC::CompactVariableEnvironment::CompactVariableEnvironment): Deleted.
+        (JSC::CompactVariableEnvironment::operator== const): Deleted.
+        (JSC::CompactVariableEnvironment::toVariableEnvironment const): Deleted.
+        (JSC::CompactVariableMap::get): Deleted.
+        (JSC::CompactVariableMap::Handle::~Handle): Deleted.
+        (JSC::CompactVariableMap::Handle::Handle): Deleted.
+        * parser/VariableEnvironment.h:
+        (JSC::CompactTDZEnvironment::toTDZEnvironment const):
+        (JSC::CompactTDZEnvironmentKey::CompactTDZEnvironmentKey):
+        (JSC::CompactTDZEnvironmentKey::hash):
+        (JSC::CompactTDZEnvironmentKey::equal):
+        (JSC::CompactTDZEnvironmentKey::makeDeletedValue):
+        (JSC::CompactTDZEnvironmentKey::isHashTableDeletedValue const):
+        (JSC::CompactTDZEnvironmentKey::environment):
+        (WTF::HashTraits<JSC::CompactTDZEnvironmentKey>::emptyValue):
+        (WTF::HashTraits<JSC::CompactTDZEnvironmentKey>::isEmptyValue):
+        (WTF::HashTraits<JSC::CompactTDZEnvironmentKey>::constructDeletedValue):
+        (WTF::HashTraits<JSC::CompactTDZEnvironmentKey>::isDeletedValue):
+        (JSC::CompactTDZEnvironmentMap::Handle::environment const):
+        (JSC::CompactVariableEnvironment::hash const): Deleted.
+        (JSC::CompactVariableMapKey::CompactVariableMapKey): Deleted.
+        (JSC::CompactVariableMapKey::hash): Deleted.
+        (JSC::CompactVariableMapKey::equal): Deleted.
+        (JSC::CompactVariableMapKey::makeDeletedValue): Deleted.
+        (JSC::CompactVariableMapKey::isHashTableDeletedValue const): Deleted.
+        (JSC::CompactVariableMapKey::isHashTableEmptyValue const): Deleted.
+        (JSC::CompactVariableMapKey::environment): Deleted.
+        (WTF::HashTraits<JSC::CompactVariableMapKey>::emptyValue): Deleted.
+        (WTF::HashTraits<JSC::CompactVariableMapKey>::isEmptyValue): Deleted.
+        (WTF::HashTraits<JSC::CompactVariableMapKey>::constructDeletedValue): Deleted.
+        (WTF::HashTraits<JSC::CompactVariableMapKey>::isDeletedValue): Deleted.
+        (JSC::CompactVariableMap::Handle::Handle): Deleted.
+        (JSC::CompactVariableMap::Handle::operator=): Deleted.
+        (JSC::CompactVariableMap::Handle::operator bool const): Deleted.
+        (JSC::CompactVariableMap::Handle::environment const): Deleted.
+        (JSC::CompactVariableMap::Handle::swap): Deleted.
+        * runtime/CachedTypes.cpp:
+        (JSC::Decoder::handleForTDZEnvironment const):
+        (JSC::Decoder::setHandleForTDZEnvironment):
+        (JSC::CachedCompactTDZEnvironment::encode):
+        (JSC::CachedCompactTDZEnvironment::decode const):
+        (JSC::CachedCompactTDZEnvironmentMapHandle::encode):
+        (JSC::CachedCompactTDZEnvironmentMapHandle::decode const):
+        (JSC::CachedFunctionExecutableRareData::decode const):
+        (JSC::Decoder::handleForEnvironment const): Deleted.
+        (JSC::Decoder::setHandleForEnvironment): Deleted.
+        (JSC::CachedCompactVariableEnvironment::encode): Deleted.
+        (JSC::CachedCompactVariableEnvironment::decode const): Deleted.
+        (JSC::CachedCompactVariableMapHandle::encode): Deleted.
+        (JSC::CachedCompactVariableMapHandle::decode const): Deleted.
+        * runtime/CachedTypes.h:
+        * runtime/CodeCache.cpp:
+        (JSC::generateUnlinkedCodeBlockImpl):
+        (JSC::generateUnlinkedCodeBlock):
+        (JSC::generateUnlinkedCodeBlockForDirectEval):
+        (JSC::recursivelyGenerateUnlinkedCodeBlockForProgram):
+        (JSC::recursivelyGenerateUnlinkedCodeBlockForModuleProgram):
+        (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
+        * runtime/CodeCache.h:
+        * runtime/Completion.cpp:
+        (JSC::generateProgramBytecode):
+        (JSC::generateModuleBytecode):
+        * runtime/DirectEvalExecutable.cpp:
+        (JSC::DirectEvalExecutable::create):
+        * runtime/DirectEvalExecutable.h:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::collectClosureVariablesUnderTDZ):
+        * runtime/JSScope.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
 2020-10-21  Caitlin Potter  <caitp@igalia.com>
 
         [JSC] support op_get_private_name in DFG and FTL
Index: Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp
===================================================================
--- Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp	(revision 268822)
+++ Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp	(working copy)
@@ -72,9 +72,9 @@ static UnlinkedFunctionCodeBlock* genera
 
     UnlinkedFunctionCodeBlock* result = UnlinkedFunctionCodeBlock::create(vm, FunctionCode, ExecutableInfo(function->usesEval(), kind == CodeForConstruct, functionKind == UnlinkedBuiltinFunction, executable->constructorKind(), scriptMode, executable->superBinding(), parseMode, executable->derivedContextType(), executable->needsClassFieldInitializer(), false, isClassContext, EvalContextType::FunctionEvalContext), codeGenerationMode);
 
-    VariableEnvironment parentScopeTDZVariables = executable->parentScopeTDZVariables();
+    auto parentScopeTDZVariables = executable->parentScopeTDZVariables();
     ECMAMode ecmaMode = executable->isInStrictContext() ? ECMAMode::strict() : ECMAMode::sloppy();
-    error = BytecodeGenerator::generate(vm, function.get(), source, result, codeGenerationMode, &parentScopeTDZVariables, ecmaMode);
+    error = BytecodeGenerator::generate(vm, function.get(), source, result, codeGenerationMode, parentScopeTDZVariables, ecmaMode);
 
     if (error.isValid())
         return nullptr;
@@ -82,7 +82,7 @@ static UnlinkedFunctionCodeBlock* genera
     return result;
 }
 
-UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM& vm, Structure* structure, const SourceCode& parentSource, FunctionMetadataNode* node, UnlinkedFunctionKind kind, ConstructAbility constructAbility, JSParserScriptMode scriptMode, Optional<CompactVariableMap::Handle> parentScopeTDZVariables, DerivedContextType derivedContextType, NeedsClassFieldInitializer needsClassFieldInitializer, bool isBuiltinDefaultClassConstructor)
+UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM& vm, Structure* structure, const SourceCode& parentSource, FunctionMetadataNode* node, UnlinkedFunctionKind kind, ConstructAbility constructAbility, JSParserScriptMode scriptMode, Optional<Vector<CompactTDZEnvironmentMap::Handle>> parentScopeTDZVariables, DerivedContextType derivedContextType, NeedsClassFieldInitializer needsClassFieldInitializer, bool isBuiltinDefaultClassConstructor)
     : Base(vm, structure)
     , m_firstLineOffset(node->firstLine() - parentSource.firstLine().oneBasedInt())
     , m_isInStrictContext(node->isInStrictContext())
Index: Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h
===================================================================
--- Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h	(revision 268822)
+++ Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h	(working copy)
@@ -70,7 +70,7 @@ public:
         return &vm.unlinkedFunctionExecutableSpace.space;
     }
 
-    static UnlinkedFunctionExecutable* create(VM& vm, const SourceCode& source, FunctionMetadataNode* node, UnlinkedFunctionKind unlinkedFunctionKind, ConstructAbility constructAbility, JSParserScriptMode scriptMode, Optional<CompactVariableMap::Handle> parentScopeTDZVariables, DerivedContextType derivedContextType, NeedsClassFieldInitializer needsClassFieldInitializer, bool isBuiltinDefaultClassConstructor = false)
+    static UnlinkedFunctionExecutable* create(VM& vm, const SourceCode& source, FunctionMetadataNode* node, UnlinkedFunctionKind unlinkedFunctionKind, ConstructAbility constructAbility, JSParserScriptMode scriptMode, Optional<Vector<CompactTDZEnvironmentMap::Handle>> parentScopeTDZVariables, DerivedContextType derivedContextType, NeedsClassFieldInitializer needsClassFieldInitializer, bool isBuiltinDefaultClassConstructor = false)
     {
         UnlinkedFunctionExecutable* instance = new (NotNull, allocateCell<UnlinkedFunctionExecutable>(vm.heap))
             UnlinkedFunctionExecutable(vm, vm.unlinkedFunctionExecutableStructure.get(), source, node, unlinkedFunctionKind, constructAbility, scriptMode, WTFMove(parentScopeTDZVariables), derivedContextType, needsClassFieldInitializer, isBuiltinDefaultClassConstructor);
@@ -168,11 +168,11 @@ public:
         return !m_rareData->m_classSource.isNull();
     }
 
-    VariableEnvironment parentScopeTDZVariables() const
+    Vector<CompactTDZEnvironmentMap::Handle> parentScopeTDZVariables() const
     {
-        if (!m_rareData || !m_rareData->m_parentScopeTDZVariables)
-            return VariableEnvironment();
-        return m_rareData->m_parentScopeTDZVariables.environment().toVariableEnvironment();
+        if (!m_rareData || m_rareData->m_parentScopeTDZVariables.isEmpty())
+            return { };
+        return m_rareData->m_parentScopeTDZVariables;
     }
     
     bool isArrowFunction() const { return isArrowFunctionParseMode(parseMode()); }
@@ -208,7 +208,7 @@ public:
         SourceCode m_classSource;
         String m_sourceURLDirective;
         String m_sourceMappingURLDirective;
-        CompactVariableMap::Handle m_parentScopeTDZVariables;
+        Vector<CompactTDZEnvironmentMap::Handle> m_parentScopeTDZVariables;
         Vector<JSTextPosition> m_instanceFieldLocations;
     };
 
@@ -229,7 +229,7 @@ public:
     }
 
 private:
-    UnlinkedFunctionExecutable(VM&, Structure*, const SourceCode&, FunctionMetadataNode*, UnlinkedFunctionKind, ConstructAbility, JSParserScriptMode, Optional<CompactVariableMap::Handle>,  JSC::DerivedContextType, JSC::NeedsClassFieldInitializer, bool isBuiltinDefaultClassConstructor);
+    UnlinkedFunctionExecutable(VM&, Structure*, const SourceCode&, FunctionMetadataNode*, UnlinkedFunctionKind, ConstructAbility, JSParserScriptMode, Optional<Vector<CompactTDZEnvironmentMap::Handle>>,  JSC::DerivedContextType, JSC::NeedsClassFieldInitializer, bool isBuiltinDefaultClassConstructor);
     UnlinkedFunctionExecutable(Decoder&, const CachedFunctionExecutable&);
 
     static void visitChildren(JSCell*, SlotVisitor&);
Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
===================================================================
--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(revision 268822)
+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp	(working copy)
@@ -48,6 +48,7 @@
 #include "Options.h"
 #include "PrivateFieldPutKind.h"
 #include "StrongInlines.h"
+#include "SuperSampler.h"
 #include "UnlinkedCodeBlock.h"
 #include "UnlinkedEvalCodeBlock.h"
 #include "UnlinkedFunctionCodeBlock.h"
@@ -288,7 +289,7 @@ ParserError BytecodeGenerator::generate(
     return ParserError(ParserError::ErrorNone);
 }
 
-BytecodeGenerator::BytecodeGenerator(VM& vm, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const VariableEnvironment* parentScopeTDZVariables, ECMAMode ecmaMode)
+BytecodeGenerator::BytecodeGenerator(VM& vm, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const CachedTDZStack& parentScopeTDZVariables, ECMAMode ecmaMode)
     : BytecodeGeneratorBase(makeUnique<UnlinkedCodeBlockGenerator>(vm, codeBlock), CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters())
     , m_codeGenerationMode(codeGenerationMode)
     , m_scopeNode(programNode)
@@ -300,11 +301,10 @@ BytecodeGenerator::BytecodeGenerator(VM&
     , m_isBuiltinFunction(false)
     , m_usesNonStrictEval(false)
     , m_inTailPosition(false)
-    , m_hasCachedVariablesUnderTDZ(false)
     , m_needsToUpdateArrowFunctionContext(programNode->usesArrowFunction() || programNode->usesEval())
     , m_ecmaMode(ecmaMode)
 {
-    ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables->size());
+    ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables.size());
 
     m_codeBlock->setNumParameters(1); // Allocate space for "this"
 
@@ -336,7 +336,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
     }
 }
 
-BytecodeGenerator::BytecodeGenerator(VM& vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const VariableEnvironment* parentScopeTDZVariables, ECMAMode ecmaMode)
+BytecodeGenerator::BytecodeGenerator(VM& vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const CachedTDZStack& parentScopeTDZVariables, ECMAMode ecmaMode)
     : BytecodeGeneratorBase(makeUnique<UnlinkedCodeBlockGenerator>(vm, codeBlock), CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters())
     , m_codeGenerationMode(codeGenerationMode)
     , m_scopeNode(functionNode)
@@ -355,7 +355,6 @@ BytecodeGenerator::BytecodeGenerator(VM&
     //
     // Note that we intentionally enable tail call for naked constructors since it does not have special code for "return".
     , m_inTailPosition(Options::useTailCalls() && !isConstructor() && constructorKind() == ConstructorKind::None && ecmaMode.isStrict())
-    , m_hasCachedVariablesUnderTDZ(false)
     , m_needsToUpdateArrowFunctionContext(functionNode->usesArrowFunction() || functionNode->usesEval())
     , m_ecmaMode(ecmaMode)
     , m_derivedContextType(codeBlock->derivedContextType())
@@ -364,6 +363,9 @@ BytecodeGenerator::BytecodeGenerator(VM&
     functionSymbolTable->setUsesNonStrictEval(m_usesNonStrictEval);
     int symbolTableConstantIndex = 0;
 
+    m_parentScopeTDZVariables = parentScopeTDZVariables;
+    m_cachedVariablesUnderTDZ = m_parentScopeTDZVariables;
+
     FunctionParameters& parameters = *functionNode->parameters(); 
     // http://www.ecma-international.org/ecma-262/6.0/index.html#sec-functiondeclarationinstantiation
     // This implements IsSimpleParameterList in the Ecma 2015 spec.
@@ -770,10 +772,6 @@ BytecodeGenerator::BytecodeGenerator(VM&
         emitPutDerivedConstructorToArrowFunctionContextScope();
     }
 
-    // All "addVar()"s needs to happen before "initializeDefaultParameterValuesAndSetupFunctionScopeStack()" is called
-    // because a function's default parameter ExpressionNodes will use temporary registers.
-    pushTDZVariables(*parentScopeTDZVariables, TDZCheckOptimization::DoNotOptimize, TDZRequirement::UnderTDZ);
-
     Ref<Label> catchLabel = newLabel();
     TryData* tryFormalParametersData = nullptr;
     bool needTryCatch = isAsyncFunctionWrapperParseMode(parseMode) && !isSimpleParameterList;
@@ -782,6 +780,8 @@ BytecodeGenerator::BytecodeGenerator(VM&
         tryFormalParametersData = pushTry(tryFormalParametersStart.get(), catchLabel.get(), HandlerType::SynthesizedCatch);
     }
 
+    // All "addVar()"s needs to happen before "initializeDefaultParameterValuesAndSetupFunctionScopeStack()" is called
+    // because a function's default parameter ExpressionNodes will use temporary registers.
     initializeDefaultParameterValuesAndSetupFunctionScopeStack(parameters, isSimpleParameterList, functionNode, functionSymbolTable, symbolTableConstantIndex, captures, shouldCreateArgumentsVariableInParameterScope);
 
     if (needTryCatch) {
@@ -840,7 +840,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
     pushLexicalScope(m_scopeNode, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, shouldInitializeBlockScopedFunctions);
 }
 
-BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const VariableEnvironment* parentScopeTDZVariables, ECMAMode ecmaMode)
+BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const CachedTDZStack& parentScopeTDZVariables, ECMAMode ecmaMode)
     : BytecodeGeneratorBase(makeUnique<UnlinkedCodeBlockGenerator>(vm, codeBlock), CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters())
     , m_codeGenerationMode(codeGenerationMode)
     , m_scopeNode(evalNode)
@@ -852,14 +852,14 @@ BytecodeGenerator::BytecodeGenerator(VM&
     , m_isBuiltinFunction(false)
     , m_usesNonStrictEval(codeBlock->usesEval() && !ecmaMode.isStrict())
     , m_inTailPosition(false)
-    , m_hasCachedVariablesUnderTDZ(false)
     , m_needsToUpdateArrowFunctionContext(evalNode->usesArrowFunction() || evalNode->usesEval())
     , m_ecmaMode(ecmaMode)
     , m_derivedContextType(codeBlock->derivedContextType())
 {
     m_codeBlock->setNumParameters(1);
 
-    pushTDZVariables(*parentScopeTDZVariables, TDZCheckOptimization::DoNotOptimize, TDZRequirement::UnderTDZ);
+    m_parentScopeTDZVariables = parentScopeTDZVariables;
+    m_cachedVariablesUnderTDZ = m_parentScopeTDZVariables;
 
     emitEnter();
 
@@ -904,7 +904,7 @@ BytecodeGenerator::BytecodeGenerator(VM&
     pushLexicalScope(m_scopeNode, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, shouldInitializeBlockScopedFunctions);
 }
 
-BytecodeGenerator::BytecodeGenerator(VM& vm, ModuleProgramNode* moduleProgramNode, UnlinkedModuleProgramCodeBlock* codeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const VariableEnvironment* parentScopeTDZVariables, ECMAMode ecmaMode)
+BytecodeGenerator::BytecodeGenerator(VM& vm, ModuleProgramNode* moduleProgramNode, UnlinkedModuleProgramCodeBlock* codeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const CachedTDZStack& parentScopeTDZVariables, ECMAMode ecmaMode)
     : BytecodeGeneratorBase(makeUnique<UnlinkedCodeBlockGenerator>(vm, codeBlock), CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters())
     , m_codeGenerationMode(codeGenerationMode)
     , m_scopeNode(moduleProgramNode)
@@ -916,11 +916,10 @@ BytecodeGenerator::BytecodeGenerator(VM&
     , m_isBuiltinFunction(false)
     , m_usesNonStrictEval(false)
     , m_inTailPosition(false)
-    , m_hasCachedVariablesUnderTDZ(false)
     , m_needsToUpdateArrowFunctionContext(moduleProgramNode->usesArrowFunction() || moduleProgramNode->usesEval())
     , m_ecmaMode(ecmaMode)
 {
-    ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables->size());
+    ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables.size());
 
     SymbolTable* moduleEnvironmentSymbolTable = SymbolTable::create(m_vm);
     moduleEnvironmentSymbolTable->setUsesNonStrictEval(m_usesNonStrictEval);
@@ -2170,7 +2169,7 @@ void BytecodeGenerator::popLexicalScopeI
     }
 
     m_TDZStack.removeLast();
-    m_cachedVariablesUnderTDZ = { };
+    m_cachedVariablesUnderTDZ.removeLast();
 }
 
 void BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration(VariableEnvironmentNode* node, RegisterID* loopSymbolTable)
@@ -2858,6 +2857,11 @@ bool BytecodeGenerator::needsTDZCheck(co
         return iter->value != TDZNecessityLevel::NotNeeded;
     }
 
+    for (unsigned i = m_parentScopeTDZVariables.size(); i--;) {
+        if (m_parentScopeTDZVariables[i].environment().toTDZEnvironment().contains(variable.ident().impl()))
+            return true;
+    }
+
     return false;
 }
 
@@ -2880,10 +2884,8 @@ void BytecodeGenerator::liftTDZCheckIfPo
     for (unsigned i = m_TDZStack.size(); i--;) {
         auto iter = m_TDZStack[i].find(identifier);
         if (iter != m_TDZStack[i].end()) {
-            if (iter->value == TDZNecessityLevel::Optimize) {
-                m_cachedVariablesUnderTDZ = { };
+            if (iter->value == TDZNecessityLevel::Optimize)
                 iter->value = TDZNecessityLevel::NotNeeded;
-            }
             break;
         }
     }
@@ -2908,59 +2910,55 @@ void BytecodeGenerator::pushTDZVariables
         map.add(entry.key, entry.value.isFunction() ? TDZNecessityLevel::NotNeeded : level);
 
     m_TDZStack.append(WTFMove(map));
-    m_cachedVariablesUnderTDZ = { };
+    m_cachedVariablesUnderTDZ.append({ });
 }
 
-Optional<CompactVariableMap::Handle> BytecodeGenerator::getVariablesUnderTDZ()
+Optional<BytecodeGenerator::CachedTDZStack> BytecodeGenerator::getVariablesUnderTDZ()
 {
-    if (m_cachedVariablesUnderTDZ) {
-        if (!m_hasCachedVariablesUnderTDZ) {
-            ASSERT(m_cachedVariablesUnderTDZ.environment().toVariableEnvironment().isEmpty());
-            return WTF::nullopt;
-        }
+    auto assertCacheIsCoherent = [&] {
+#if ASSERT_ENABLED
+        for (size_t i = 0; i < m_cachedVariablesUnderTDZ.size(); ++i)
+            ASSERT(!!m_cachedVariablesUnderTDZ[i]);
+#endif
+    };
+
+    RELEASE_ASSERT(m_TDZStack.size() + m_parentScopeTDZVariables.size() == m_cachedVariablesUnderTDZ.size());
+
+    if (m_cachedVariablesUnderTDZ.isEmpty())
+        return WTF::nullopt;
+
+    if (m_cachedVariablesUnderTDZ.last()) {
+        assertCacheIsCoherent();
         return m_cachedVariablesUnderTDZ;
     }
 
-    // We keep track of variablesThatDontNeedTDZ in this algorithm to prevent
-    // reporting that "x" is under TDZ if this function is called at "...".
-    //
-    //     {
-    //         {
-    //             let x;
-    //             ...
-    //         }
-    //         let x;
-    //     }
-    SmallPtrSet<UniquedStringImpl*, 16> variablesThatDontNeedTDZ;
-    VariableEnvironment environment;
-    for (unsigned i = m_TDZStack.size(); i--; ) {
+    for (size_t i = m_TDZStack.size(); i--;) {
+        if (m_cachedVariablesUnderTDZ[i + m_parentScopeTDZVariables.size()])
+            break;
+
         auto& map = m_TDZStack[i];
-        for (auto& entry : map)  {
-            if (entry.value != TDZNecessityLevel::NotNeeded) {
-                if (!variablesThatDontNeedTDZ.contains(entry.key.get()))
-                    environment.add(entry.key.get());
-            } else
-                variablesThatDontNeedTDZ.add(entry.key.get());
+        TDZEnvironment environment;
+        for (auto& entry : map) {
+            if (entry.value != TDZNecessityLevel::NotNeeded)
+                environment.add(entry.key.get());
         }
+        m_cachedVariablesUnderTDZ[i + m_parentScopeTDZVariables.size()] = m_vm.m_compactVariableMap->get(environment);
     }
 
-    m_cachedVariablesUnderTDZ = m_vm.m_compactVariableMap->get(environment);
-    m_hasCachedVariablesUnderTDZ = !environment.isEmpty();
-    if (!m_hasCachedVariablesUnderTDZ)
-        return WTF::nullopt;
-
+    assertCacheIsCoherent();
     return m_cachedVariablesUnderTDZ;
 }
 
 void BytecodeGenerator::preserveTDZStack(BytecodeGenerator::PreservedTDZStack& preservedStack)
 {
     preservedStack.m_preservedTDZStack = m_TDZStack;
+    preservedStack.m_cachedTDZStack = m_cachedVariablesUnderTDZ;
 }
 
 void BytecodeGenerator::restoreTDZStack(const BytecodeGenerator::PreservedTDZStack& preservedStack)
 {
     m_TDZStack = preservedStack.m_preservedTDZStack;
-    m_cachedVariablesUnderTDZ = { };
+    m_cachedVariablesUnderTDZ = preservedStack.m_cachedTDZStack;
 }
 
 RegisterID* BytecodeGenerator::emitNewObject(RegisterID* dst)
@@ -3147,7 +3145,7 @@ RegisterID* BytecodeGenerator::emitNewIn
         superBinding = SuperBinding::Needed;
     }
 
-    Optional<CompactVariableMap::Handle> variablesUnderTDZ = getVariablesUnderTDZ();
+    auto variablesUnderTDZ = getVariablesUnderTDZ();
     SourceParseMode parseMode = SourceParseMode::InstanceFieldInitializerMode;
     ConstructAbility constructAbility = ConstructAbility::CannotConstruct;
 
Index: Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
===================================================================
--- Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(revision 268822)
+++ Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h	(working copy)
@@ -407,11 +407,12 @@ namespace JSC {
 
     public:
         typedef DeclarationStacks::FunctionStack FunctionStack;
+        using CachedTDZStack = Vector<CompactTDZEnvironmentMap::Handle>;
 
-        BytecodeGenerator(VM&, ProgramNode*, UnlinkedProgramCodeBlock*, OptionSet<CodeGenerationMode>, const VariableEnvironment*, ECMAMode);
-        BytecodeGenerator(VM&, FunctionNode*, UnlinkedFunctionCodeBlock*, OptionSet<CodeGenerationMode>, const VariableEnvironment*, ECMAMode);
-        BytecodeGenerator(VM&, EvalNode*, UnlinkedEvalCodeBlock*, OptionSet<CodeGenerationMode>, const VariableEnvironment*, ECMAMode);
-        BytecodeGenerator(VM&, ModuleProgramNode*, UnlinkedModuleProgramCodeBlock*, OptionSet<CodeGenerationMode>, const VariableEnvironment*, ECMAMode);
+        BytecodeGenerator(VM&, ProgramNode*, UnlinkedProgramCodeBlock*, OptionSet<CodeGenerationMode>, const CachedTDZStack&, ECMAMode);
+        BytecodeGenerator(VM&, FunctionNode*, UnlinkedFunctionCodeBlock*, OptionSet<CodeGenerationMode>, const CachedTDZStack&, ECMAMode);
+        BytecodeGenerator(VM&, EvalNode*, UnlinkedEvalCodeBlock*, OptionSet<CodeGenerationMode>, const CachedTDZStack&, ECMAMode);
+        BytecodeGenerator(VM&, ModuleProgramNode*, UnlinkedModuleProgramCodeBlock*, OptionSet<CodeGenerationMode>, const CachedTDZStack&, ECMAMode);
 
         ~BytecodeGenerator();
         
@@ -431,14 +432,14 @@ namespace JSC {
         NeedsClassFieldInitializer needsClassFieldInitializer() const { return m_codeBlock->needsClassFieldInitializer(); }
 
         template<typename Node, typename UnlinkedCodeBlock>
-        static ParserError generate(VM& vm, Node* node, const SourceCode& sourceCode, UnlinkedCodeBlock* unlinkedCodeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const VariableEnvironment* environment, ECMAMode ecmaMode)
+        static ParserError generate(VM& vm, Node* node, const SourceCode& sourceCode, UnlinkedCodeBlock* unlinkedCodeBlock, OptionSet<CodeGenerationMode> codeGenerationMode, const CachedTDZStack& parentScopeTDZVariables, ECMAMode ecmaMode)
         {
             MonotonicTime before;
             if (UNLIKELY(Options::reportBytecodeCompileTimes()))
                 before = MonotonicTime::now();
 
             DeferGC deferGC(vm.heap);
-            auto bytecodeGenerator = makeUnique<BytecodeGenerator>(vm, node, unlinkedCodeBlock, codeGenerationMode, environment, ecmaMode);
+            auto bytecodeGenerator = makeUnique<BytecodeGenerator>(vm, node, unlinkedCodeBlock, codeGenerationMode, parentScopeTDZVariables, ecmaMode);
             auto result = bytecodeGenerator->generate();
 
             if (UNLIKELY(Options::reportBytecodeCompileTimes())) {
@@ -1185,7 +1186,7 @@ namespace JSC {
                     newDerivedContextType = DerivedContextType::DerivedMethodContext;
             }
 
-            Optional<CompactVariableMap::Handle> optionalVariablesUnderTDZ = getVariablesUnderTDZ();
+            auto optionalVariablesUnderTDZ = getVariablesUnderTDZ();
 
             // FIXME: These flags, ParserModes and propagation to XXXCodeBlocks should be reorganized.
             // https://bugs.webkit.org/show_bug.cgi?id=151547
@@ -1197,7 +1198,7 @@ namespace JSC {
             return UnlinkedFunctionExecutable::create(m_vm, m_scopeNode->source(), metadata, isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction, constructAbility, scriptMode(), WTFMove(optionalVariablesUnderTDZ), newDerivedContextType, needsClassFieldInitializer);
         }
 
-        Optional<CompactVariableMap::Handle> getVariablesUnderTDZ();
+        Optional<CachedTDZStack> getVariablesUnderTDZ();
 
         RegisterID* emitConstructVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
         template<typename CallOp>
@@ -1231,6 +1232,7 @@ namespace JSC {
         class PreservedTDZStack {
         private:
             Vector<TDZMap> m_preservedTDZStack;
+            CachedTDZStack m_cachedTDZStack;
             friend class BytecodeGenerator;
         };
 
@@ -1262,7 +1264,9 @@ namespace JSC {
         };
         Vector<LexicalScopeStackEntry> m_lexicalScopeStack;
 
+        CachedTDZStack m_parentScopeTDZVariables;
         Vector<TDZMap> m_TDZStack;
+        CachedTDZStack m_cachedVariablesUnderTDZ;
         Optional<size_t> m_varScopeLexicalScopeStackIndex;
         void pushTDZVariables(const VariableEnvironment&, TDZCheckOptimization, TDZRequirement);
 
@@ -1344,13 +1348,10 @@ namespace JSC {
         bool m_isBuiltinFunction { false };
         bool m_usesNonStrictEval { false };
         bool m_inTailPosition { false };
-        bool m_hasCachedVariablesUnderTDZ { false };
         bool m_needsToUpdateArrowFunctionContext : 1;
         ECMAMode m_ecmaMode;
         DerivedContextType m_derivedContextType { DerivedContextType::None };
 
-        CompactVariableMap::Handle m_cachedVariablesUnderTDZ;
-
         struct CatchEntry {
             TryData* tryData;
             VirtualRegister exceptionRegister;
Index: Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
===================================================================
--- Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(revision 268822)
+++ Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(working copy)
@@ -258,11 +258,12 @@ JSValue DebuggerCallFrame::evaluateWithS
     else 
         evalContextType = EvalContextType::None;
 
-    VariableEnvironment variablesUnderTDZ;
-    JSScope::collectClosureVariablesUnderTDZ(scope()->jsScope(), variablesUnderTDZ);
+    TDZEnvironment variablesUnderTDZ;
+    VariableEnvironment privateNames;
+    JSScope::collectClosureVariablesUnderTDZ(scope()->jsScope(), variablesUnderTDZ, privateNames);
 
     ECMAMode ecmaMode = codeBlock->ownerExecutable()->isInStrictContext() ? ECMAMode::strict() : ECMAMode::sloppy();
-    auto* eval = DirectEvalExecutable::create(globalObject, makeSource(script, callFrame->callerSourceOrigin(vm)), codeBlock->unlinkedCodeBlock()->derivedContextType(), codeBlock->unlinkedCodeBlock()->needsClassFieldInitializer(), codeBlock->unlinkedCodeBlock()->isArrowFunction(), codeBlock->ownerExecutable()->isInsideOrdinaryFunction(), evalContextType, &variablesUnderTDZ, ecmaMode);
+    auto* eval = DirectEvalExecutable::create(globalObject, makeSource(script, callFrame->callerSourceOrigin(vm)), codeBlock->unlinkedCodeBlock()->derivedContextType(), codeBlock->unlinkedCodeBlock()->needsClassFieldInitializer(), codeBlock->unlinkedCodeBlock()->isArrowFunction(), codeBlock->ownerExecutable()->isInsideOrdinaryFunction(), evalContextType, &variablesUnderTDZ, &privateNames, ecmaMode);
     if (UNLIKELY(catchScope.exception())) {
         exception = catchScope.exception();
         catchScope.clearException();
Index: Source/JavaScriptCore/interpreter/Interpreter.cpp
===================================================================
--- Source/JavaScriptCore/interpreter/Interpreter.cpp	(revision 268822)
+++ Source/JavaScriptCore/interpreter/Interpreter.cpp	(working copy)
@@ -143,9 +143,10 @@ JSValue eval(JSGlobalObject* globalObjec
             RETURN_IF_EXCEPTION(scope, JSValue());
         }
         
-        VariableEnvironment variablesUnderTDZ;
-        JSScope::collectClosureVariablesUnderTDZ(callerScopeChain, variablesUnderTDZ);
-        eval = DirectEvalExecutable::create(globalObject, makeSource(programSource, callerCodeBlock->source().provider()->sourceOrigin()), derivedContextType, callerUnlinkedCodeBlock->needsClassFieldInitializer(), isArrowFunctionContext, callerCodeBlock->ownerExecutable()->isInsideOrdinaryFunction(), evalContextType, &variablesUnderTDZ, ecmaMode);
+        TDZEnvironment variablesUnderTDZ;
+        VariableEnvironment privateNames;
+        JSScope::collectClosureVariablesUnderTDZ(callerScopeChain, variablesUnderTDZ, privateNames);
+        eval = DirectEvalExecutable::create(globalObject, makeSource(programSource, callerCodeBlock->source().provider()->sourceOrigin()), derivedContextType, callerUnlinkedCodeBlock->needsClassFieldInitializer(), isArrowFunctionContext, callerCodeBlock->ownerExecutable()->isInsideOrdinaryFunction(), evalContextType, &variablesUnderTDZ, &privateNames, ecmaMode);
         EXCEPTION_ASSERT(!!scope.exception() == !eval);
         if (!eval)
             return jsUndefined();
Index: Source/JavaScriptCore/parser/Parser.h
===================================================================
--- Source/JavaScriptCore/parser/Parser.h	(revision 268822)
+++ Source/JavaScriptCore/parser/Parser.h	(working copy)
@@ -2053,7 +2053,7 @@ private:
 
 template <typename LexerType>
 template <class ParsedNode>
-std::unique_ptr<ParsedNode> Parser<LexerType>::parse(ParserError& error, const Identifier& calleeName, SourceParseMode parseMode, ParsingContext parsingContext, Optional<int> functionConstructorParametersEndPosition, const VariableEnvironment* variablesUnderTDZ, const Vector<JSTextPosition>* instanceFieldLocations)
+std::unique_ptr<ParsedNode> Parser<LexerType>::parse(ParserError& error, const Identifier& calleeName, SourceParseMode parseMode, ParsingContext parsingContext, Optional<int> functionConstructorParametersEndPosition, const VariableEnvironment* parentScopePrivateNames, const Vector<JSTextPosition>* instanceFieldLocations)
 {
     int errLine;
     String errMsg;
@@ -2068,9 +2068,9 @@ std::unique_ptr<ParsedNode> Parser<Lexer
     ASSERT(m_source->startColumn() > OrdinalNumber::beforeFirst());
     unsigned startColumn = m_source->startColumn().zeroBasedInt();
 
-    if (isEvalNode<ParsedNode>() && variablesUnderTDZ && variablesUnderTDZ->privateNamesSize()) {
+    if (isEvalNode<ParsedNode>() && parentScopePrivateNames && parentScopePrivateNames->privateNamesSize()) {
         currentScope()->setIsPrivateNameScope();
-        variablesUnderTDZ->copyPrivateNamesTo(currentScope()->lexicalVariables());
+        parentScopePrivateNames->copyPrivateNamesTo(currentScope()->lexicalVariables());
     }
 
     auto parseResult = parseInner(calleeName, parseMode, parsingContext, functionConstructorParametersEndPosition, instanceFieldLocations);
@@ -2157,7 +2157,7 @@ std::unique_ptr<ParsedNode> parse(
     DerivedContextType derivedContextType = DerivedContextType::None,
     EvalContextType evalContextType = EvalContextType::None,
     DebuggerParseData* debuggerParseData = nullptr,
-    const VariableEnvironment* variablesUnderTDZ = nullptr,
+    const VariableEnvironment* parentScopePrivateNames = nullptr,
     const Vector<JSTextPosition>* instanceFieldLocations = nullptr,
     bool isInsideOrdinaryFunction = false)
 {
@@ -2170,7 +2170,7 @@ std::unique_ptr<ParsedNode> parse(
     std::unique_ptr<ParsedNode> result;
     if (source.provider()->source().is8Bit()) {
         Parser<Lexer<LChar>> parser(vm, source, builtinMode, strictMode, scriptMode, parseMode, superBinding, defaultConstructorKindForTopLevelFunction, derivedContextType, isEvalNode<ParsedNode>(), evalContextType, debuggerParseData, isInsideOrdinaryFunction);
-        result = parser.parse<ParsedNode>(error, name, parseMode, isEvalNode<ParsedNode>() ? ParsingContext::Eval : ParsingContext::Program, WTF::nullopt, variablesUnderTDZ, instanceFieldLocations);
+        result = parser.parse<ParsedNode>(error, name, parseMode, isEvalNode<ParsedNode>() ? ParsingContext::Eval : ParsingContext::Program, WTF::nullopt, parentScopePrivateNames, instanceFieldLocations);
         if (positionBeforeLastNewline)
             *positionBeforeLastNewline = parser.positionBeforeLastNewline();
         if (builtinMode == JSParserBuiltinMode::Builtin) {
@@ -2183,7 +2183,7 @@ std::unique_ptr<ParsedNode> parse(
     } else {
         ASSERT_WITH_MESSAGE(defaultConstructorKindForTopLevelFunction == ConstructorKind::None, "BuiltinExecutables's special constructors should always use a 8-bit string");
         Parser<Lexer<UChar>> parser(vm, source, builtinMode, strictMode, scriptMode, parseMode, superBinding, defaultConstructorKindForTopLevelFunction, derivedContextType, isEvalNode<ParsedNode>(), evalContextType, debuggerParseData, isInsideOrdinaryFunction);
-        result = parser.parse<ParsedNode>(error, name, parseMode, isEvalNode<ParsedNode>() ? ParsingContext::Eval : ParsingContext::Program, WTF::nullopt, variablesUnderTDZ, instanceFieldLocations);
+        result = parser.parse<ParsedNode>(error, name, parseMode, isEvalNode<ParsedNode>() ? ParsingContext::Eval : ParsingContext::Program, WTF::nullopt, parentScopePrivateNames, instanceFieldLocations);
         if (positionBeforeLastNewline)
             *positionBeforeLastNewline = parser.positionBeforeLastNewline();
     }
Index: Source/JavaScriptCore/parser/VariableEnvironment.cpp
===================================================================
--- Source/JavaScriptCore/parser/VariableEnvironment.cpp	(revision 268822)
+++ Source/JavaScriptCore/parser/VariableEnvironment.cpp	(working copy)
@@ -104,64 +104,88 @@ void VariableEnvironment::markVariableAs
     findResult->value.setIsExported();
 }
 
-CompactVariableEnvironment::CompactVariableEnvironment(const VariableEnvironment& env)
-    : m_isEverythingCaptured(env.isEverythingCaptured())
-{
-    Vector<std::pair<UniquedStringImpl*, VariableEnvironmentEntry>, 32> sortedEntries;
-    sortedEntries.reserveInitialCapacity(env.mapSize());
-    for (auto& pair : env)
-        sortedEntries.append({ pair.key.get(), pair.value });
 
-    std::sort(sortedEntries.begin(), sortedEntries.end(), [] (const auto& a, const auto& b) {
-        return a.first < b.first;
+void CompactTDZEnvironment::sortCompact(Compact& compact)
+{
+    std::sort(compact.begin(), compact.end(), [] (auto& a, auto& b) {
+        return a.get() < b.get();
     });
+}
+
+CompactTDZEnvironment::CompactTDZEnvironment(const TDZEnvironment& env)
+{
+    Compact compactVariables;
+    compactVariables.reserveCapacity(env.size());
 
-    m_hash = 0;
-    m_variables.reserveInitialCapacity(sortedEntries.size());
-    m_variableMetadata.reserveInitialCapacity(sortedEntries.size());
-    for (const auto& pair : sortedEntries) {
-        m_variables.append(pair.first);
-        m_variableMetadata.append(pair.second);
-        m_hash ^= pair.first->hash();
-        m_hash += pair.second.bits();
+    m_hash = 0; // Note: XOR is commutative so order doesn't matter here.
+    for (auto& key : env) {
+        compactVariables.append(key.get());
+        m_hash ^= key->hash();
     }
 
-    if (m_isEverythingCaptured)
-        m_hash *= 2;
+    sortCompact(compactVariables);
+    m_variables = WTFMove(compactVariables);
 }
 
-bool CompactVariableEnvironment::operator==(const CompactVariableEnvironment& other) const
+bool CompactTDZEnvironment::operator==(const CompactTDZEnvironment& other) const
 {
     if (this == &other)
         return true;
-    if (m_isEverythingCaptured != other.m_isEverythingCaptured)
-        return false;
-    if (m_variables != other.m_variables)
-        return false;
-    if (m_variableMetadata != other.m_variableMetadata)
+
+    if (m_hash != other.m_hash)
         return false;
-    return true;
-}
 
-VariableEnvironment CompactVariableEnvironment::toVariableEnvironment() const
-{
-    VariableEnvironment result;
-    ASSERT(m_variables.size() == m_variableMetadata.size());
-    for (size_t i = 0; i < m_variables.size(); ++i) {
-        auto addResult = result.add(m_variables[i]);
-        ASSERT(addResult.isNewEntry);
-        addResult.iterator->value = m_variableMetadata[i];
-    }
+    auto equal = [&] (const Compact& compact, const Inflated& inflated) {
+        if (compact.size() != inflated.size())
+            return false;
+        for (auto& ident : compact) {
+            if (!inflated.contains(ident))
+                return false;
+        }
+        return true;
+    };
 
-    if (m_isEverythingCaptured)
-        result.markAllVariablesAsCaptured();
+    bool result;
+    WTF::switchOn(m_variables,
+        [&] (const Compact& compact) {
+            WTF::switchOn(other.m_variables,
+                [&] (const Compact& otherCompact) {
+                    result = compact == otherCompact;
+                },
+                [&] (const Inflated& otherInflated) {
+                    result = equal(compact, otherInflated);
+                });
+        },
+        [&] (const Inflated& inflated) {
+            WTF::switchOn(other.m_variables,
+                [&] (const Compact& otherCompact) {
+                    result = equal(otherCompact, inflated);
+                },
+                [&] (const Inflated& otherInflated) {
+                    result = inflated == otherInflated;
+                });
+        });
 
     return result;
 }
 
-CompactVariableMap::Handle CompactVariableMap::get(const VariableEnvironment& env)
+TDZEnvironment& CompactTDZEnvironment::toTDZEnvironmentSlow() const
+{
+    Inflated inflated;
+    {
+        auto& compact = WTF::get<Compact>(m_variables);
+        for (size_t i = 0; i < compact.size(); ++i) {
+            auto addResult = inflated.add(compact[i]);
+            ASSERT_UNUSED(addResult, addResult.isNewEntry);
+        }
+    }
+    m_variables = Variables(WTFMove(inflated));
+    return const_cast<Inflated&>(WTF::get<Inflated>(m_variables));
+}
+
+CompactTDZEnvironmentMap::Handle CompactTDZEnvironmentMap::get(const TDZEnvironment& env)
 {
-    auto* environment = new CompactVariableEnvironment(env);
+    auto* environment = new CompactTDZEnvironment(env);
     bool isNewEntry;
     auto handle = get(environment, isNewEntry);
     if (!isNewEntry)
@@ -169,19 +193,19 @@ CompactVariableMap::Handle CompactVariab
     return handle;
 }
 
-CompactVariableMap::Handle CompactVariableMap::get(CompactVariableEnvironment* environment, bool& isNewEntry)
+CompactTDZEnvironmentMap::Handle CompactTDZEnvironmentMap::get(CompactTDZEnvironment* environment, bool& isNewEntry)
 {
-    CompactVariableMapKey key { *environment };
+    CompactTDZEnvironmentKey key { *environment };
     auto addResult = m_map.add(key, 1);
     isNewEntry = addResult.isNewEntry;
     if (addResult.isNewEntry)
-        return CompactVariableMap::Handle(*environment, *this);
+        return CompactTDZEnvironmentMap::Handle(*environment, *this);
 
     ++addResult.iterator->value;
-    return CompactVariableMap::Handle(addResult.iterator->key.environment(), *this);
+    return CompactTDZEnvironmentMap::Handle(addResult.iterator->key.environment(), *this);
 }
 
-CompactVariableMap::Handle::~Handle()
+CompactTDZEnvironmentMap::Handle::~Handle()
 {
     if (!m_map) {
         ASSERT(!m_environment);
@@ -190,7 +214,7 @@ CompactVariableMap::Handle::~Handle()
     }
 
     RELEASE_ASSERT(m_environment);
-    auto iter = m_map->m_map.find(CompactVariableMapKey { *m_environment });
+    auto iter = m_map->m_map.find(CompactTDZEnvironmentKey { *m_environment });
     RELEASE_ASSERT(iter != m_map->m_map.end());
     --iter->value;
     if (!iter->value) {
@@ -200,18 +224,18 @@ CompactVariableMap::Handle::~Handle()
     }
 }
 
-CompactVariableMap::Handle::Handle(const CompactVariableMap::Handle& other)
+CompactTDZEnvironmentMap::Handle::Handle(const CompactTDZEnvironmentMap::Handle& other)
     : m_environment(other.m_environment)
     , m_map(other.m_map)
 {
     if (m_map) {
-        auto iter = m_map->m_map.find(CompactVariableMapKey { *m_environment });
+        auto iter = m_map->m_map.find(CompactTDZEnvironmentKey { *m_environment });
         RELEASE_ASSERT(iter != m_map->m_map.end());
         ++iter->value;
     }
 }
 
-CompactVariableMap::Handle::Handle(CompactVariableEnvironment& environment, CompactVariableMap& map)
+CompactTDZEnvironmentMap::Handle::Handle(CompactTDZEnvironment& environment, CompactTDZEnvironmentMap& map)
     : m_environment(&environment)
     , m_map(&map)
 { 
Index: Source/JavaScriptCore/parser/VariableEnvironment.h
===================================================================
--- Source/JavaScriptCore/parser/VariableEnvironment.h	(revision 268822)
+++ Source/JavaScriptCore/parser/VariableEnvironment.h	(working copy)
@@ -29,6 +29,7 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/IteratorRange.h>
+#include <wtf/Variant.h>
 
 namespace JSC {
 
@@ -119,6 +120,7 @@ struct PrivateNameEntryHashTraits : Hash
 };
 
 class VariableEnvironment {
+    WTF_MAKE_FAST_ALLOCATED;
 private:
     typedef HashMap<PackedRefPtr<UniquedStringImpl>, VariableEnvironmentEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> Map;
     typedef HashMap<PackedRefPtr<UniquedStringImpl>, PrivateNameEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> PrivateNames;
@@ -262,56 +264,69 @@ private:
     std::unique_ptr<VariableEnvironment::RareData> m_rareData;
 };
 
-class CompactVariableEnvironment {
+using TDZEnvironment = HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash>;
+
+class CompactTDZEnvironment {
     WTF_MAKE_FAST_ALLOCATED;
-    WTF_MAKE_NONCOPYABLE(CompactVariableEnvironment);
+    WTF_MAKE_NONCOPYABLE(CompactTDZEnvironment);
 
-    friend class CachedCompactVariableEnvironment;
+    friend class CachedCompactTDZEnvironment;
+
+    using Compact = Vector<PackedRefPtr<UniquedStringImpl>>;
+    using Inflated = TDZEnvironment;
+    using Variables = Variant<Compact, Inflated>;
 
 public:
-    CompactVariableEnvironment(const VariableEnvironment&);
-    VariableEnvironment toVariableEnvironment() const;
+    CompactTDZEnvironment(const TDZEnvironment&);
 
-    bool operator==(const CompactVariableEnvironment&) const;
+    bool operator==(const CompactTDZEnvironment&) const;
     unsigned hash() const { return m_hash; }
 
+    static void sortCompact(Compact&);
+
+    TDZEnvironment& toTDZEnvironment() const
+    {
+        if (WTF::holds_alternative<Inflated>(m_variables))
+            return const_cast<TDZEnvironment&>(WTF::get<Inflated>(m_variables));
+        return toTDZEnvironmentSlow();
+    }
+
 private:
-    CompactVariableEnvironment() = default;
+    CompactTDZEnvironment() = default;
+    TDZEnvironment& toTDZEnvironmentSlow() const;
 
-    Vector<PackedRefPtr<UniquedStringImpl>> m_variables;
-    Vector<VariableEnvironmentEntry> m_variableMetadata;
+    mutable Variables m_variables;
     unsigned m_hash;
-    bool m_isEverythingCaptured;
 };
 
-struct CompactVariableMapKey {
-    CompactVariableMapKey()
+struct CompactTDZEnvironmentKey {
+    CompactTDZEnvironmentKey()
         : m_environment(nullptr)
     {
         ASSERT(isHashTableEmptyValue());
     }
 
-    CompactVariableMapKey(CompactVariableEnvironment& environment)
+    CompactTDZEnvironmentKey(CompactTDZEnvironment& environment)
         : m_environment(&environment)
     { }
 
-    static unsigned hash(const CompactVariableMapKey& key) { return key.m_environment->hash(); }
-    static bool equal(const CompactVariableMapKey& a, const CompactVariableMapKey& b) { return *a.m_environment == *b.m_environment; }
+    static unsigned hash(const CompactTDZEnvironmentKey& key) { return key.m_environment->hash(); }
+    static bool equal(const CompactTDZEnvironmentKey& a, const CompactTDZEnvironmentKey& b) { return *a.m_environment == *b.m_environment; }
     static constexpr bool safeToCompareToEmptyOrDeleted = false;
-    static void makeDeletedValue(CompactVariableMapKey& key)
+    static void makeDeletedValue(CompactTDZEnvironmentKey& key)
     {
-        key.m_environment = reinterpret_cast<CompactVariableEnvironment*>(1);
+        key.m_environment = reinterpret_cast<CompactTDZEnvironment*>(1);
     }
     bool isHashTableDeletedValue() const
     {
-        return m_environment == reinterpret_cast<CompactVariableEnvironment*>(1);
+        return m_environment == reinterpret_cast<CompactTDZEnvironment*>(1);
     }
     bool isHashTableEmptyValue() const
     {
         return !m_environment;
     }
 
-    CompactVariableEnvironment& environment()
+    CompactTDZEnvironment& environment()
     {
         RELEASE_ASSERT(!isHashTableDeletedValue());
         RELEASE_ASSERT(!isHashTableEmptyValue());
@@ -319,7 +334,7 @@ struct CompactVariableMapKey {
     }
 
 private:
-    CompactVariableEnvironment* m_environment;
+    CompactTDZEnvironment* m_environment;
 };
 
 } // namespace JSC
@@ -327,32 +342,32 @@ private:
 namespace WTF {
 
 template<typename T> struct DefaultHash;
-template<> struct DefaultHash<JSC::CompactVariableMapKey> : JSC::CompactVariableMapKey { };
+template<> struct DefaultHash<JSC::CompactTDZEnvironmentKey> : JSC::CompactTDZEnvironmentKey { };
 
-template<> struct HashTraits<JSC::CompactVariableMapKey> : GenericHashTraits<JSC::CompactVariableMapKey> {
+template<> struct HashTraits<JSC::CompactTDZEnvironmentKey> : GenericHashTraits<JSC::CompactTDZEnvironmentKey> {
     static constexpr bool emptyValueIsZero = true;
-    static JSC::CompactVariableMapKey emptyValue() { return JSC::CompactVariableMapKey(); }
+    static JSC::CompactTDZEnvironmentKey emptyValue() { return JSC::CompactTDZEnvironmentKey(); }
 
     static constexpr bool hasIsEmptyValueFunction = true;
-    static bool isEmptyValue(JSC::CompactVariableMapKey key) { return key.isHashTableEmptyValue(); }
+    static bool isEmptyValue(JSC::CompactTDZEnvironmentKey key) { return key.isHashTableEmptyValue(); }
 
-    static void constructDeletedValue(JSC::CompactVariableMapKey& key) { JSC::CompactVariableMapKey::makeDeletedValue(key); }
-    static bool isDeletedValue(JSC::CompactVariableMapKey key) { return key.isHashTableDeletedValue(); }
+    static void constructDeletedValue(JSC::CompactTDZEnvironmentKey& key) { JSC::CompactTDZEnvironmentKey::makeDeletedValue(key); }
+    static bool isDeletedValue(JSC::CompactTDZEnvironmentKey key) { return key.isHashTableDeletedValue(); }
 };
 
 } // namespace WTF
 
 namespace JSC {
 
-class CompactVariableMap : public RefCounted<CompactVariableMap> {
+class CompactTDZEnvironmentMap : public RefCounted<CompactTDZEnvironmentMap> {
 public:
     class Handle {
-        friend class CachedCompactVariableMapHandle;
+        friend class CachedCompactTDZEnvironmentMapHandle;
 
     public:
         Handle() = default;
 
-        Handle(CompactVariableEnvironment&, CompactVariableMap&);
+        Handle(CompactTDZEnvironment&, CompactTDZEnvironmentMap&);
 
         Handle(Handle&& other)
         {
@@ -377,7 +392,7 @@ public:
 
         explicit operator bool() const { return !!m_map; }
 
-        const CompactVariableEnvironment& environment() const
+        const CompactTDZEnvironment& environment() const
         {
             return *m_environment;
         }
@@ -389,19 +404,19 @@ public:
             std::swap(other.m_map, m_map);
         }
 
-        CompactVariableEnvironment* m_environment { nullptr };
-        RefPtr<CompactVariableMap> m_map;
+        CompactTDZEnvironment* m_environment { nullptr };
+        RefPtr<CompactTDZEnvironmentMap> m_map;
     };
 
-    Handle get(const VariableEnvironment&);
+    Handle get(const TDZEnvironment&);
 
 private:
     friend class Handle;
-    friend class CachedCompactVariableMapHandle;
+    friend class CachedCompactTDZEnvironmentMapHandle;
 
-    Handle get(CompactVariableEnvironment*, bool& isNewEntry);
+    Handle get(CompactTDZEnvironment*, bool& isNewEntry);
 
-    HashMap<CompactVariableMapKey, unsigned> m_map;
+    HashMap<CompactTDZEnvironmentKey, unsigned> m_map;
 };
 
 } // namespace JSC
Index: Source/JavaScriptCore/runtime/CachedTypes.cpp
===================================================================
--- Source/JavaScriptCore/runtime/CachedTypes.cpp	(revision 268822)
+++ Source/JavaScriptCore/runtime/CachedTypes.cpp	(working copy)
@@ -327,14 +327,14 @@ const void* Decoder::ptrForOffsetFromBas
     return m_cachedBytecode->data() + offset;
 }
 
-CompactVariableMap::Handle Decoder::handleForEnvironment(CompactVariableEnvironment* environment) const
+CompactTDZEnvironmentMap::Handle Decoder::handleForTDZEnvironment(CompactTDZEnvironment* environment) const
 {
     auto it = m_environmentToHandleMap.find(environment);
     RELEASE_ASSERT(it != m_environmentToHandleMap.end());
     return it->value;
 }
 
-void Decoder::setHandleForEnvironment(CompactVariableEnvironment* environment, const CompactVariableMap::Handle& handle)
+void Decoder::setHandleForTDZEnvironment(CompactTDZEnvironment* environment, const CompactTDZEnvironmentMap::Handle& handle)
 {
     auto addResult = m_environmentToHandleMap.add(environment, handle);
     RELEASE_ASSERT(addResult.isNewEntry);
@@ -1050,69 +1050,80 @@ private:
     CachedPtr<CachedVariableEnvironmentRareData> m_rareData;
 };
 
-class CachedCompactVariableEnvironment : public CachedObject<CompactVariableEnvironment> {
+class CachedCompactTDZEnvironment : public CachedObject<CompactTDZEnvironment> {
 public:
-    void encode(Encoder& encoder, const CompactVariableEnvironment& env)
+    void encode(Encoder& encoder, const CompactTDZEnvironment& env)
     {
-        m_variables.encode(encoder, env.m_variables);
-        m_variableMetadata.encode(encoder, env.m_variableMetadata);
+        if (WTF::holds_alternative<CompactTDZEnvironment::Compact>(env.m_variables))
+            m_variables.encode(encoder, WTF::get<CompactTDZEnvironment::Compact>(env.m_variables));
+        else {
+            CompactTDZEnvironment::Compact compact;
+            for (auto& key : WTF::get<CompactTDZEnvironment::Inflated>(env.m_variables))
+                compact.append(key);
+            m_variables.encode(encoder, compact);
+        }
         m_hash = env.m_hash;
-        m_isEverythingCaptured = env.m_isEverythingCaptured;
     }
 
-    void decode(Decoder& decoder, CompactVariableEnvironment& env) const
+    void decode(Decoder& decoder, CompactTDZEnvironment& env) const
     {
-        m_variables.decode(decoder, env.m_variables);
-        m_variableMetadata.decode(decoder, env.m_variableMetadata);
+        {
+            CompactTDZEnvironment::Compact compact;
+            m_variables.decode(decoder, compact);
+            CompactTDZEnvironment::sortCompact(compact);
+            env.m_variables = CompactTDZEnvironment::Variables(WTFMove(compact));
+        }
         env.m_hash = m_hash;
-        env.m_isEverythingCaptured = m_isEverythingCaptured;
     }
 
-    CompactVariableEnvironment* decode(Decoder& decoder) const
+    CompactTDZEnvironment* decode(Decoder& decoder) const
     {
-        CompactVariableEnvironment* env = new CompactVariableEnvironment;
+        CompactTDZEnvironment* env = new CompactTDZEnvironment;
         decode(decoder, *env);
         return env;
     }
 
 private:
     CachedVector<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>> m_variables;
-    CachedVector<VariableEnvironmentEntry> m_variableMetadata;
     unsigned m_hash;
-    bool m_isEverythingCaptured;
 };
 
-class CachedCompactVariableMapHandle : public CachedObject<CompactVariableMap::Handle> {
+class CachedCompactTDZEnvironmentMapHandle : public CachedObject<CompactTDZEnvironmentMap::Handle> {
 public:
-    void encode(Encoder& encoder, const CompactVariableMap::Handle& handle)
+    void encode(Encoder& encoder, const CompactTDZEnvironmentMap::Handle& handle)
     {
         m_environment.encode(encoder, handle.m_environment);
     }
 
-    CompactVariableMap::Handle decode(Decoder& decoder) const
+    CompactTDZEnvironmentMap::Handle decode(Decoder& decoder) const
     {
         bool isNewAllocation;
-        CompactVariableEnvironment* environment = m_environment.decode(decoder, isNewAllocation);
+        CompactTDZEnvironment* environment = m_environment.decode(decoder, isNewAllocation);
         if (!environment) {
             ASSERT(!isNewAllocation);
-            return CompactVariableMap::Handle();
+            return CompactTDZEnvironmentMap::Handle();
         }
 
         if (!isNewAllocation)
-            return decoder.handleForEnvironment(environment);
+            return decoder.handleForTDZEnvironment(environment);
         bool isNewEntry;
-        CompactVariableMap::Handle handle = decoder.vm().m_compactVariableMap->get(environment, isNewEntry);
+        CompactTDZEnvironmentMap::Handle handle = decoder.vm().m_compactVariableMap->get(environment, isNewEntry);
         if (!isNewEntry) {
             decoder.addFinalizer([=] {
                 delete environment;
             });
         }
-        decoder.setHandleForEnvironment(environment, handle);
+        decoder.setHandleForTDZEnvironment(environment, handle);
         return handle;
     }
 
+    void decode(Decoder& decoder, CompactTDZEnvironmentMap::Handle& handle) const
+    {
+        handle = decode(decoder);
+    }
+
 private:
-    CachedPtr<CachedCompactVariableEnvironment> m_environment;
+    CachedPtr<CachedCompactTDZEnvironment> m_environment;
 };
 
 template<typename T, typename Source = SourceType<T>>
@@ -1751,14 +1762,13 @@ public:
     {
         UnlinkedFunctionExecutable::RareData* rareData = new UnlinkedFunctionExecutable::RareData { };
         m_classSource.decode(decoder, rareData->m_classSource);
-        auto parentScopeTDZVariables = m_parentScopeTDZVariables.decode(decoder);
-        rareData->m_parentScopeTDZVariables = WTFMove(parentScopeTDZVariables);
+        m_parentScopeTDZVariables.decode(decoder, rareData->m_parentScopeTDZVariables);
         return rareData;
     }
 
 private:
     CachedSourceCodeWithoutProvider m_classSource;
-    CachedCompactVariableMapHandle m_parentScopeTDZVariables;
+    CachedVector<CachedCompactTDZEnvironmentMapHandle> m_parentScopeTDZVariables;
 };
 
 class CachedFunctionExecutable : public CachedObject<UnlinkedFunctionExecutable> {
Index: Source/JavaScriptCore/runtime/CachedTypes.h
===================================================================
--- Source/JavaScriptCore/runtime/CachedTypes.h	(revision 268822)
+++ Source/JavaScriptCore/runtime/CachedTypes.h	(working copy)
@@ -90,8 +90,8 @@ public:
     void cacheOffset(ptrdiff_t, void*);
     WTF::Optional<void*> cachedPtrForOffset(ptrdiff_t);
     const void* ptrForOffsetFromBase(ptrdiff_t);
-    CompactVariableMap::Handle handleForEnvironment(CompactVariableEnvironment*) const;
-    void setHandleForEnvironment(CompactVariableEnvironment*, const CompactVariableMap::Handle&);
+    CompactTDZEnvironmentMap::Handle handleForTDZEnvironment(CompactTDZEnvironment*) const;
+    void setHandleForTDZEnvironment(CompactTDZEnvironment*, const CompactTDZEnvironmentMap::Handle&);
     void addLeafExecutable(const UnlinkedFunctionExecutable*, ptrdiff_t);
     RefPtr<SourceProvider> provider() const;
 
@@ -105,7 +105,7 @@ private:
     Ref<CachedBytecode> m_cachedBytecode;
     HashMap<ptrdiff_t, void*> m_offsetToPtrMap;
     Vector<std::function<void()>> m_finalizers;
-    HashMap<CompactVariableEnvironment*, CompactVariableMap::Handle> m_environmentToHandleMap;
+    HashMap<CompactTDZEnvironment*, CompactTDZEnvironmentMap::Handle> m_environmentToHandleMap;
     RefPtr<SourceProvider> m_provider;
 };
 
Index: Source/JavaScriptCore/runtime/CodeCache.cpp
===================================================================
--- Source/JavaScriptCore/runtime/CodeCache.cpp	(revision 268822)
+++ Source/JavaScriptCore/runtime/CodeCache.cpp	(working copy)
@@ -71,12 +71,14 @@ static void generateUnlinkedCodeBlockFor
 }
 
 template <class UnlinkedCodeBlockType, class ExecutableType = ScriptExecutable>
-UnlinkedCodeBlockType* generateUnlinkedCodeBlockImpl(VM& vm, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, DerivedContextType derivedContextType, bool isArrowFunctionContext, const VariableEnvironment* variablesUnderTDZ, ExecutableType* executable = nullptr)
+UnlinkedCodeBlockType* generateUnlinkedCodeBlockImpl(VM& vm, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, DerivedContextType derivedContextType, bool isArrowFunctionContext, const TDZEnvironment* variablesUnderTDZ = nullptr, const VariableEnvironment* parentScopePrivateNames = nullptr, ExecutableType* executable = nullptr)
 {
     typedef typename CacheTypes<UnlinkedCodeBlockType>::RootNode RootNode;
     bool isInsideOrdinaryFunction = executable && executable->isInsideOrdinaryFunction();
+
     std::unique_ptr<RootNode> rootNode = parse<RootNode>(
-        vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin, strictMode, scriptMode, CacheTypes<UnlinkedCodeBlockType>::parseMode, SuperBinding::NotNeeded, error, nullptr, ConstructorKind::None, derivedContextType, evalContextType, nullptr, variablesUnderTDZ, nullptr, isInsideOrdinaryFunction);
+        vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin, strictMode, scriptMode, CacheTypes<UnlinkedCodeBlockType>::parseMode, SuperBinding::NotNeeded, error, nullptr, ConstructorKind::None, derivedContextType, evalContextType, nullptr, parentScopePrivateNames, nullptr, isInsideOrdinaryFunction);
+
     if (!rootNode)
         return nullptr;
 
@@ -103,7 +105,10 @@ UnlinkedCodeBlockType* generateUnlinkedC
     if (!source.provider()->sourceMappingURLDirective().isNull())
         unlinkedCodeBlock->setSourceMappingURLDirective(source.provider()->sourceMappingURLDirective());
 
-    error = BytecodeGenerator::generate(vm, rootNode.get(), source, unlinkedCodeBlock, codeGenerationMode, variablesUnderTDZ, ecmaMode);
+    Vector<CompactTDZEnvironmentMap::Handle> parentVariablesUnderTDZ;
+    if (variablesUnderTDZ)
+        parentVariablesUnderTDZ.append(vm.m_compactVariableMap->get(*variablesUnderTDZ));
+    error = BytecodeGenerator::generate(vm, rootNode.get(), source, unlinkedCodeBlock, codeGenerationMode, parentVariablesUnderTDZ, ecmaMode);
 
     if (error.isValid())
         return nullptr;
@@ -112,22 +117,22 @@ UnlinkedCodeBlockType* generateUnlinkedC
 }
 
 template <class UnlinkedCodeBlockType, class ExecutableType>
-UnlinkedCodeBlockType* generateUnlinkedCodeBlock(VM& vm, ExecutableType* executable, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
+UnlinkedCodeBlockType* generateUnlinkedCodeBlock(VM& vm, ExecutableType* executable, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, const TDZEnvironment* variablesUnderTDZ = nullptr, const VariableEnvironment* parentScopePrivateNames = nullptr)
 {
-    return generateUnlinkedCodeBlockImpl<UnlinkedCodeBlockType, ExecutableType>(vm, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, executable->derivedContextType(), executable->isArrowFunctionContext(), variablesUnderTDZ, executable);
+    return generateUnlinkedCodeBlockImpl<UnlinkedCodeBlockType, ExecutableType>(vm, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, executable->derivedContextType(), executable->isArrowFunctionContext(), variablesUnderTDZ, parentScopePrivateNames, executable);
 }
 
-UnlinkedEvalCodeBlock* generateUnlinkedCodeBlockForDirectEval(VM& vm, DirectEvalExecutable* executable, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
+UnlinkedEvalCodeBlock* generateUnlinkedCodeBlockForDirectEval(VM& vm, DirectEvalExecutable* executable, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, const TDZEnvironment* variablesUnderTDZ, const VariableEnvironment* parentScopePrivateNames)
 {
-    return generateUnlinkedCodeBlock<UnlinkedEvalCodeBlock>(vm, executable, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, variablesUnderTDZ);
+    return generateUnlinkedCodeBlock<UnlinkedEvalCodeBlock>(vm, executable, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, variablesUnderTDZ, parentScopePrivateNames);
 }
 
 template <class UnlinkedCodeBlockType>
 std::enable_if_t<!std::is_same<UnlinkedCodeBlockType, UnlinkedEvalCodeBlock>::value, UnlinkedCodeBlockType*>
-recursivelyGenerateUnlinkedCodeBlock(VM& vm, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
+recursivelyGenerateUnlinkedCodeBlock(VM& vm, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType)
 {
     bool isArrowFunctionContext = false;
-    UnlinkedCodeBlockType* unlinkedCodeBlock = generateUnlinkedCodeBlockImpl<UnlinkedCodeBlockType>(vm, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, DerivedContextType::None, isArrowFunctionContext, variablesUnderTDZ);
+    UnlinkedCodeBlockType* unlinkedCodeBlock = generateUnlinkedCodeBlockImpl<UnlinkedCodeBlockType>(vm, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, DerivedContextType::None, isArrowFunctionContext);
     if (!unlinkedCodeBlock)
         return nullptr;
 
@@ -135,14 +140,14 @@ recursivelyGenerateUnlinkedCodeBlock(VM&
     return unlinkedCodeBlock;
 }
 
-UnlinkedProgramCodeBlock* recursivelyGenerateUnlinkedCodeBlockForProgram(VM& vm, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
+UnlinkedProgramCodeBlock* recursivelyGenerateUnlinkedCodeBlockForProgram(VM& vm, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType)
 {
-    return recursivelyGenerateUnlinkedCodeBlock<UnlinkedProgramCodeBlock>(vm, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, variablesUnderTDZ);
+    return recursivelyGenerateUnlinkedCodeBlock<UnlinkedProgramCodeBlock>(vm, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType);
 }
 
-UnlinkedModuleProgramCodeBlock* recursivelyGenerateUnlinkedCodeBlockForModuleProgram(VM& vm, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
+UnlinkedModuleProgramCodeBlock* recursivelyGenerateUnlinkedCodeBlockForModuleProgram(VM& vm, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, OptionSet<CodeGenerationMode> codeGenerationMode, ParserError& error, EvalContextType evalContextType)
 {
-    return recursivelyGenerateUnlinkedCodeBlock<UnlinkedModuleProgramCodeBlock>(vm, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, variablesUnderTDZ);
+    return recursivelyGenerateUnlinkedCodeBlock<UnlinkedModuleProgramCodeBlock>(vm, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType);
 }
 
 template <class UnlinkedCodeBlockType, class ExecutableType>
@@ -168,8 +173,7 @@ UnlinkedCodeBlockType* CodeCache::getUnl
         return unlinkedCodeBlock;
     }
 
-    VariableEnvironment variablesUnderTDZ;
-    unlinkedCodeBlock = generateUnlinkedCodeBlock<UnlinkedCodeBlockType, ExecutableType>(vm, executable, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType, &variablesUnderTDZ);
+    unlinkedCodeBlock = generateUnlinkedCodeBlock<UnlinkedCodeBlockType, ExecutableType>(vm, executable, source, strictMode, scriptMode, codeGenerationMode, error, evalContextType);
 
     if (unlinkedCodeBlock && Options::useCodeCache()) {
         m_sourceCode.addCache(key, SourceCodeValue(vm, unlinkedCodeBlock, m_sourceCode.age()));
Index: Source/JavaScriptCore/runtime/CodeCache.h
===================================================================
--- Source/JavaScriptCore/runtime/CodeCache.h	(revision 268822)
+++ Source/JavaScriptCore/runtime/CodeCache.h	(working copy)
@@ -50,7 +50,8 @@ class ParserError;
 class ProgramExecutable;
 class SourceCode;
 class VM;
-class VariableEnvironment;
+
+using TDZEnvironment = HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash>;
 
 namespace CodeCacheInternal {
 static constexpr bool verbose = false;
@@ -253,9 +254,9 @@ template <> struct CacheTypes<UnlinkedMo
     static constexpr SourceParseMode parseMode = SourceParseMode::ModuleEvaluateMode;
 };
 
-UnlinkedEvalCodeBlock* generateUnlinkedCodeBlockForDirectEval(VM&, DirectEvalExecutable*, const SourceCode&, JSParserStrictMode, JSParserScriptMode, OptionSet<CodeGenerationMode>, ParserError&, EvalContextType, const VariableEnvironment* variablesUnderTDZ);
-UnlinkedProgramCodeBlock* recursivelyGenerateUnlinkedCodeBlockForProgram(VM&, const SourceCode&, JSParserStrictMode, JSParserScriptMode, OptionSet<CodeGenerationMode>, ParserError&, EvalContextType, const VariableEnvironment* variablesUnderTDZ);
-UnlinkedModuleProgramCodeBlock* recursivelyGenerateUnlinkedCodeBlockForModuleProgram(VM&, const SourceCode&, JSParserStrictMode, JSParserScriptMode, OptionSet<CodeGenerationMode>, ParserError&, EvalContextType, const VariableEnvironment* variablesUnderTDZ);
+UnlinkedEvalCodeBlock* generateUnlinkedCodeBlockForDirectEval(VM&, DirectEvalExecutable*, const SourceCode&, JSParserStrictMode, JSParserScriptMode, OptionSet<CodeGenerationMode>, ParserError&, EvalContextType, const TDZEnvironment* variablesUnderTDZ, const VariableEnvironment* parentScopePrivateNames);
+UnlinkedProgramCodeBlock* recursivelyGenerateUnlinkedCodeBlockForProgram(VM&, const SourceCode&, JSParserStrictMode, JSParserScriptMode, OptionSet<CodeGenerationMode>, ParserError&, EvalContextType);
+UnlinkedModuleProgramCodeBlock* recursivelyGenerateUnlinkedCodeBlockForModuleProgram(VM&, const SourceCode&, JSParserStrictMode, JSParserScriptMode, OptionSet<CodeGenerationMode>, ParserError&, EvalContextType);
 
 void writeCodeBlock(VM&, const SourceCodeKey&, const SourceCodeValue&);
 RefPtr<CachedBytecode> serializeBytecode(VM&, UnlinkedCodeBlock*, const SourceCode&, SourceCodeType, JSParserStrictMode, JSParserScriptMode, FileSystem::PlatformFileHandle fd, BytecodeCacheError&, OptionSet<CodeGenerationMode>);
Index: Source/JavaScriptCore/runtime/Completion.cpp
===================================================================
--- Source/JavaScriptCore/runtime/Completion.cpp	(revision 268822)
+++ Source/JavaScriptCore/runtime/Completion.cpp	(working copy)
@@ -91,13 +91,12 @@ RefPtr<CachedBytecode> generateProgramBy
     JSLockHolder lock(vm);
     RELEASE_ASSERT(vm.atomStringTable() == Thread::current().atomStringTable());
 
-    VariableEnvironment variablesUnderTDZ;
     JSParserStrictMode strictMode = JSParserStrictMode::NotStrict;
     JSParserScriptMode scriptMode = JSParserScriptMode::Classic;
     EvalContextType evalContextType = EvalContextType::None;
 
     ParserError parserError;
-    UnlinkedCodeBlock* unlinkedCodeBlock = recursivelyGenerateUnlinkedCodeBlockForProgram(vm, source, strictMode, scriptMode, { }, parserError, evalContextType, &variablesUnderTDZ);
+    UnlinkedCodeBlock* unlinkedCodeBlock = recursivelyGenerateUnlinkedCodeBlockForProgram(vm, source, strictMode, scriptMode, { }, parserError, evalContextType);
     if (parserError.isValid())
         error = parserError;
     if (!unlinkedCodeBlock)
@@ -111,13 +110,12 @@ RefPtr<CachedBytecode> generateModuleByt
     JSLockHolder lock(vm);
     RELEASE_ASSERT(vm.atomStringTable() == Thread::current().atomStringTable());
 
-    VariableEnvironment variablesUnderTDZ;
     JSParserStrictMode strictMode = JSParserStrictMode::Strict;
     JSParserScriptMode scriptMode = JSParserScriptMode::Module;
     EvalContextType evalContextType = EvalContextType::None;
 
     ParserError parserError;
-    UnlinkedCodeBlock* unlinkedCodeBlock = recursivelyGenerateUnlinkedCodeBlockForModuleProgram(vm, source, strictMode, scriptMode, { }, parserError, evalContextType, &variablesUnderTDZ);
+    UnlinkedCodeBlock* unlinkedCodeBlock = recursivelyGenerateUnlinkedCodeBlockForModuleProgram(vm, source, strictMode, scriptMode, { }, parserError, evalContextType);
     if (parserError.isValid())
         error = parserError;
     if (!unlinkedCodeBlock)
Index: Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp
===================================================================
--- Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp	(revision 268822)
+++ Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp	(working copy)
@@ -34,7 +34,7 @@
 
 namespace JSC {
 
-DirectEvalExecutable* DirectEvalExecutable::create(JSGlobalObject* globalObject, const SourceCode& source, DerivedContextType derivedContextType, NeedsClassFieldInitializer needsClassFieldInitializer, bool isArrowFunctionContext, bool isInsideOrdinaryFunction, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ, ECMAMode ecmaMode)
+DirectEvalExecutable* DirectEvalExecutable::create(JSGlobalObject* globalObject, const SourceCode& source, DerivedContextType derivedContextType, NeedsClassFieldInitializer needsClassFieldInitializer, bool isArrowFunctionContext, bool isInsideOrdinaryFunction, EvalContextType evalContextType, const TDZEnvironment* variablesUnderTDZ, const VariableEnvironment* privateNames, ECMAMode ecmaMode)
 {
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
@@ -52,7 +52,7 @@ DirectEvalExecutable* DirectEvalExecutab
     OptionSet<CodeGenerationMode> codeGenerationMode = globalObject->defaultCodeGenerationMode();
 
     // We don't bother with CodeCache here because direct eval uses a specialized DirectEvalCodeCache.
-    UnlinkedEvalCodeBlock* unlinkedEvalCode = generateUnlinkedCodeBlockForDirectEval(vm, executable, executable->source(), strictMode, JSParserScriptMode::Classic, codeGenerationMode, error, evalContextType, variablesUnderTDZ);
+    UnlinkedEvalCodeBlock* unlinkedEvalCode = generateUnlinkedCodeBlockForDirectEval(vm, executable, executable->source(), strictMode, JSParserScriptMode::Classic, codeGenerationMode, error, evalContextType, variablesUnderTDZ, privateNames);
 
     if (globalObject->hasDebugger())
         globalObject->debugger()->sourceParsed(globalObject, executable->source().provider(), error.line(), error.message());
Index: Source/JavaScriptCore/runtime/DirectEvalExecutable.h
===================================================================
--- Source/JavaScriptCore/runtime/DirectEvalExecutable.h	(revision 268822)
+++ Source/JavaScriptCore/runtime/DirectEvalExecutable.h	(working copy)
@@ -31,7 +31,7 @@ namespace JSC {
 
 class DirectEvalExecutable final : public EvalExecutable {
 public:
-    static DirectEvalExecutable* create(JSGlobalObject*, const SourceCode&, DerivedContextType, NeedsClassFieldInitializer, bool isArrowFunctionContext, bool isInsideOrdinaryFunction, EvalContextType, const VariableEnvironment*, ECMAMode);
+    static DirectEvalExecutable* create(JSGlobalObject*, const SourceCode&, DerivedContextType, NeedsClassFieldInitializer, bool isArrowFunctionContext, bool isInsideOrdinaryFunction, EvalContextType, const TDZEnvironment* parentScopeTDZVariables, const VariableEnvironment* privateNames, ECMAMode);
 private:
     DirectEvalExecutable(JSGlobalObject*, const SourceCode&, bool inStrictContext, DerivedContextType, NeedsClassFieldInitializer, bool isArrowFunctionContext, bool isInsideOrdinaryFunction, EvalContextType);
 };
Index: Source/JavaScriptCore/runtime/JSScope.cpp
===================================================================
--- Source/JavaScriptCore/runtime/JSScope.cpp	(revision 268822)
+++ Source/JavaScriptCore/runtime/JSScope.cpp	(working copy)
@@ -321,7 +321,7 @@ ResolveOp JSScope::abstractResolve(JSGlo
     return op;
 }
 
-void JSScope::collectClosureVariablesUnderTDZ(JSScope* scope, VariableEnvironment& result)
+void JSScope::collectClosureVariablesUnderTDZ(JSScope* scope, TDZEnvironment& result, VariableEnvironment& privateNames)
 {
     for (; scope; scope = scope->next()) {
         if (!scope->isLexicalScope() && !scope->isCatchScope())
@@ -338,9 +338,10 @@ void JSScope::collectClosureVariablesUnd
         ConcurrentJSLocker locker(symbolTable->m_lock);
         for (auto end = symbolTable->end(locker), iter = symbolTable->begin(locker); iter != end; ++iter)
             result.add(iter->key);
+
         if (symbolTable->hasPrivateNames()) {
             for (auto name : symbolTable->privateNames())
-                result.usePrivateName(name);    
+                privateNames.usePrivateName(name);    
         }
     }
 }
Index: Source/JavaScriptCore/runtime/JSScope.h
===================================================================
--- Source/JavaScriptCore/runtime/JSScope.h	(revision 268822)
+++ Source/JavaScriptCore/runtime/JSScope.h	(working copy)
@@ -35,6 +35,8 @@ class SymbolTable;
 class VariableEnvironment;
 class WatchpointSet;
 
+using TDZEnvironment = HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash>;
+
 class JSScope : public JSNonFinalObject {
 public:
     using Base = JSNonFinalObject;
@@ -60,7 +62,7 @@ public:
     static bool hasConstantScope(ResolveType);
     static JSScope* constantScopeForCodeBlock(ResolveType, CodeBlock*);
 
-    static void collectClosureVariablesUnderTDZ(JSScope*, VariableEnvironment& result);
+    static void collectClosureVariablesUnderTDZ(JSScope*, TDZEnvironment& result, VariableEnvironment& privateNames);
 
     static void visitChildren(JSCell*, SlotVisitor&);
 
Index: Source/JavaScriptCore/runtime/VM.cpp
===================================================================
--- Source/JavaScriptCore/runtime/VM.cpp	(revision 268822)
+++ Source/JavaScriptCore/runtime/VM.cpp	(working copy)
@@ -390,7 +390,7 @@ VM::VM(VMType vmType, HeapType heapType,
     , interpreter(nullptr)
     , entryScope(nullptr)
     , m_regExpCache(new RegExpCache(this))
-    , m_compactVariableMap(adoptRef(*(new CompactVariableMap)))
+    , m_compactVariableMap(adoptRef(*(new CompactTDZEnvironmentMap)))
 #if ENABLE(REGEXP_TRACING)
     , m_rtTraceList(new RTTraceList())
 #endif
Index: Source/JavaScriptCore/runtime/VM.h
===================================================================
--- Source/JavaScriptCore/runtime/VM.h	(revision 268822)
+++ Source/JavaScriptCore/runtime/VM.h	(working copy)
@@ -108,7 +108,7 @@ struct CheckpointOSRExitSideState;
 class CodeBlock;
 class CodeCache;
 class CommonIdentifiers;
-class CompactVariableMap;
+class CompactTDZEnvironmentMap;
 class ConservativeRoots;
 class ControlFlowProfiler;
 class CustomGetterSetter;
@@ -1004,7 +1004,7 @@ public:
     static constexpr size_t patternContextBufferSize = 0; // Space allocated to save nested parenthesis context
 #endif
 
-    Ref<CompactVariableMap> m_compactVariableMap;
+    Ref<CompactTDZEnvironmentMap> m_compactVariableMap;
 
     std::unique_ptr<HasOwnPropertyCache> m_hasOwnPropertyCache;
     ALWAYS_INLINE HasOwnPropertyCache* hasOwnPropertyCache() { return m_hasOwnPropertyCache.get(); }
Index: Source/WTF/ChangeLog
===================================================================
--- Source/WTF/ChangeLog	(revision 268822)
+++ Source/WTF/ChangeLog	(working copy)
@@ -1,3 +1,16 @@
+2020-10-23  Saam Barati  <sbarati@apple.com>
+
+        Better cache our serialization of the outer TDZ environment when creating FunctionExecutables during bytecode generation
+        https://bugs.webkit.org/show_bug.cgi?id=199866
+        <rdar://problem/53333108>
+
+        Reviewed by NOBODY (OOPS!).
+
+        * wtf/RefPtr.h:
+        (WTF::swap): Deleted.
+        This function is no longer necessary, and causes ADL (https://en.cppreference.com/w/cpp/language/adl)
+        compile errors when not using DumbPtrTraits and calling sort on a vector of that type.
+
 2020-10-20  Sihui Liu  <sihui_liu@apple.com>
 
         Add stubs for SpeechRecognition
Index: Source/WTF/wtf/RefPtr.h
===================================================================
--- Source/WTF/wtf/RefPtr.h	(revision 268822)
+++ Source/WTF/wtf/RefPtr.h	(working copy)
@@ -193,12 +193,6 @@ inline void RefPtr<T, U, V>::swap(RefPtr
     U::swap(m_ptr, o.m_ptr);
 }
 
-template<typename T, typename U, typename V, typename X, typename Y, typename Z, typename = std::enable_if_t<!std::is_same<U, DumbPtrTraits<T>>::value || !std::is_same<Y, DumbPtrTraits<X>>::value>>
-inline void swap(RefPtr<T, U, V>& a, RefPtr<X, Y, Z>& b)
-{
-    a.swap(b);
-}
-
 template<typename T, typename U, typename V, typename X, typename Y, typename Z>
 inline bool operator==(const RefPtr<T, U, V>& a, const RefPtr<X, Y, Z>& b)
 {