Cherry-pick 0291f23. rdar://123909602

    [JSC] Remove some hot CommonSlowPaths
    https://bugs.webkit.org/show_bug.cgi?id=270363
    rdar://123909602

    Reviewed by Alexey Shvayka.

    CommonSlowPaths is always slower than normal operations in Baseline JIT since CommonSlowPaths accesses a lot of data like bytecode etc.
    This is OK for rare operations, but not OK for hot operations. This patch made following opcodes using operations. They are picked based
    on trace data.

        1. op_create_lexical_environment
        2. op_create_direct_arguments
        3. op_create_scoped_arguments
        4. op_create_cloned_arguments

    And move CommonSlowPaths for them to LLIntSlowPaths. Since LLInt needs to access to these bytecode etc. to retrieve information (JIT can skip it),
    SlowPath performance is the same to operations.

    * Source/JavaScriptCore/jit/JIT.cpp:
    (JSC::JIT::privateCompileMainPass):
    * Source/JavaScriptCore/jit/JIT.h:
    * Source/JavaScriptCore/jit/JITOpcodes.cpp:
    (JSC::JIT::emit_op_create_lexical_environment):
    (JSC::JIT::emit_op_create_direct_arguments):
    (JSC::JIT::emit_op_create_scoped_arguments):
    (JSC::JIT::emit_op_create_cloned_arguments):
    * Source/JavaScriptCore/jit/JITOperations.cpp:
    (JSC::JSC_DEFINE_JIT_OPERATION):
    * Source/JavaScriptCore/jit/JITOperations.h:
    * Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:
    (JSC::LLInt::LLINT_SLOW_PATH_DECL):
    * Source/JavaScriptCore/llint/LLIntSlowPaths.h:
    * Source/JavaScriptCore/llint/LowLevelInterpreter.asm:
    * Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:
    * Source/JavaScriptCore/runtime/CommonSlowPaths.h:

    Canonical link: https://commits.webkit.org/275570@main

Canonical link: https://commits.webkit.org/274941.67@safari-7619.1.5-branch

Source/JavaScriptCore/jit/JIT.cpp

@@ -271,7 +271,6 @@ void JIT::privateCompileMainPass()
         DEFINE_SLOW_OP(typeof_is_object)
         DEFINE_SLOW_OP(strcat)
         DEFINE_SLOW_OP(push_with_scope)
-        DEFINE_SLOW_OP(create_lexical_environment)
         DEFINE_SLOW_OP(put_by_id_with_this)
         DEFINE_SLOW_OP(put_by_val_with_this)
         DEFINE_SLOW_OP(resolve_scope_for_hoisting_func_decl_in_eval)
@@ -283,9 +282,6 @@ void JIT::privateCompileMainPass()
         DEFINE_SLOW_OP(new_array_with_species)
         DEFINE_SLOW_OP(new_array_buffer)
         DEFINE_SLOW_OP(spread)
-        DEFINE_SLOW_OP(create_direct_arguments)
-        DEFINE_SLOW_OP(create_scoped_arguments)
-        DEFINE_SLOW_OP(create_cloned_arguments)
         DEFINE_SLOW_OP(create_rest)
         DEFINE_SLOW_OP(create_promise)
         DEFINE_SLOW_OP(new_promise)
@@ -412,6 +408,10 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_new_regexp)
         DEFINE_OP(op_not)
         DEFINE_OP(op_nstricteq)
+        DEFINE_OP(op_create_lexical_environment)
+        DEFINE_OP(op_create_direct_arguments)
+        DEFINE_OP(op_create_scoped_arguments)
+        DEFINE_OP(op_create_cloned_arguments)
         DEFINE_OP(op_dec)
         DEFINE_OP(op_inc)
         DEFINE_OP(op_profile_type)

Source/JavaScriptCore/jit/JIT.h

@@ -485,6 +485,10 @@ namespace JSC {
         void emit_op_new_async_generator_func_exp(const JSInstruction*);
         void emit_op_new_object(const JSInstruction*);
         void emit_op_new_regexp(const JSInstruction*);
+        void emit_op_create_lexical_environment(const JSInstruction*);
+        void emit_op_create_direct_arguments(const JSInstruction*);
+        void emit_op_create_scoped_arguments(const JSInstruction*);
+        void emit_op_create_cloned_arguments(const JSInstruction*);
         void emit_op_not(const JSInstruction*);
         void emit_op_nstricteq(const JSInstruction*);
         void emit_op_dec(const JSInstruction*);
@@ -685,6 +689,8 @@ namespace JSC {
         void appendCallWithExceptionCheck(Address);
         MacroAssembler::Call appendCallWithExceptionCheckSetJSValueResult(const CodePtr<CFunctionPtrTag>, VirtualRegister result);
         void appendCallWithExceptionCheckSetJSValueResult(Address, VirtualRegister result);
+        MacroAssembler::Call appendCallSetJSValueResult(const CodePtr<CFunctionPtrTag>, VirtualRegister result);
+        void appendCallSetJSValueResult(Address, VirtualRegister result);
         template<typename Bytecode>
         MacroAssembler::Call appendCallWithExceptionCheckSetJSValueResultWithProfile(const Bytecode&, const CodePtr<CFunctionPtrTag>, VirtualRegister result);
         template<typename Bytecode>
@@ -706,6 +712,22 @@ namespace JSC {
             return appendCallWithExceptionCheckSetJSValueResult(Address(GPRInfo::nonArgGPR0, target.offset), result);
         }
 
+        template<typename OperationType, typename... Args>
+        std::enable_if_t<FunctionTraits<OperationType>::hasResult, MacroAssembler::Call>
+        callOperationNoExceptionCheck(OperationType operation, VirtualRegister result, Args... args)
+        {
+            setupArguments<OperationType>(args...);
+            return appendCallSetJSValueResult(operation, result);
+        }
+
+        template<typename OperationType, typename... Args>
+        std::enable_if_t<FunctionTraits<OperationType>::hasResult, void>
+        callOperationNoExceptionCheck(Address target, VirtualRegister result, Args... args)
+        {
+            setupArgumentsForIndirectCall<OperationType>(target, args...);
+            return appendCallSetJSValueResult(Address(GPRInfo::nonArgGPR0, target.offset), result);
+        }
+
 #if OS(WINDOWS) && CPU(X86_64)
         template<typename Type>
         struct is64BitType {

Source/JavaScriptCore/jit/JITInlines.h

@@ -109,6 +109,19 @@ ALWAYS_INLINE void JIT::appendCallWithExceptionCheck(Address function)
     exceptionCheck();
 }
 
+ALWAYS_INLINE MacroAssembler::Call JIT::appendCallSetJSValueResult(const CodePtr<CFunctionPtrTag> function, VirtualRegister dst)
+{
+    MacroAssembler::Call call = appendCallWithExceptionCheck(function);
+    emitPutVirtualRegister(dst, returnValueJSR);
+    return call;
+}
+
+ALWAYS_INLINE void JIT::appendCallSetJSValueResult(Address function, VirtualRegister dst)
+{
+    appendCallWithExceptionCheck(function);
+    emitPutVirtualRegister(dst, returnValueJSR);
+}
+
 ALWAYS_INLINE MacroAssembler::Call JIT::appendCallWithExceptionCheckSetJSValueResult(const CodePtr<CFunctionPtrTag> function, VirtualRegister dst)
 {
     MacroAssembler::Call call = appendCallWithExceptionCheck(function);

Source/JavaScriptCore/jit/JITOpcodes.cpp

@@ -1852,6 +1852,53 @@ void JIT::emit_op_new_array_with_size(const JSInstruction* currentInstruction)
     callOperation(operationNewArrayWithSizeAndProfile, dst, globalObjectGPR, profileGPR, sizeJSR);
 }
 
+void JIT::emit_op_create_lexical_environment(const JSInstruction* currentInstruction)
+{
+    auto bytecode = currentInstruction->as<OpCreateLexicalEnvironment>();
+    VirtualRegister dst = bytecode.m_dst;
+    VirtualRegister scope = bytecode.m_scope;
+    VirtualRegister symbolTable = bytecode.m_symbolTable;
+    VirtualRegister initialValue = bytecode.m_initialValue;
+
+    ASSERT(initialValue.isConstant());
+    ASSERT(m_profiledCodeBlock->isConstantOwnedByUnlinkedCodeBlock(initialValue));
+    JSValue value = m_unlinkedCodeBlock->getConstant(initialValue);
+
+    loadGlobalObject(argumentGPR0);
+    emitGetVirtualRegisterPayload(scope, argumentGPR1);
+    emitGetVirtualRegisterPayload(symbolTable, argumentGPR2);
+    callOperationNoExceptionCheck(value == jsUndefined() ? operationCreateLexicalEnvironmentUndefined : operationCreateLexicalEnvironmentTDZ, dst, argumentGPR0, argumentGPR1, argumentGPR2);
+}
+
+void JIT::emit_op_create_direct_arguments(const JSInstruction* currentInstruction)
+{
+    auto bytecode = currentInstruction->as<OpCreateDirectArguments>();
+    VirtualRegister dst = bytecode.m_dst;
+
+    loadGlobalObject(argumentGPR0);
+    callOperationNoExceptionCheck(operationCreateDirectArgumentsBaseline, dst, argumentGPR0);
+}
+
+void JIT::emit_op_create_scoped_arguments(const JSInstruction* currentInstruction)
+{
+    auto bytecode = currentInstruction->as<OpCreateScopedArguments>();
+    VirtualRegister dst = bytecode.m_dst;
+    VirtualRegister scope = bytecode.m_scope;
+
+    loadGlobalObject(argumentGPR0);
+    emitGetVirtualRegisterPayload(scope, argumentGPR1);
+    callOperationNoExceptionCheck(operationCreateScopedArgumentsBaseline, dst, argumentGPR0, argumentGPR1);
+}
+
+void JIT::emit_op_create_cloned_arguments(const JSInstruction* currentInstruction)
+{
+    auto bytecode = currentInstruction->as<OpCreateClonedArguments>();
+    VirtualRegister dst = bytecode.m_dst;
+
+    loadGlobalObject(argumentGPR0);
+    callOperation(operationCreateClonedArgumentsBaseline, dst, argumentGPR0);
+}
+
 void JIT::emit_op_profile_type(const JSInstruction* currentInstruction)
 {
     m_isShareable = false;

Source/JavaScriptCore/jit/JITOperations.cpp

@@ -2414,6 +2414,47 @@ JSC_DEFINE_JIT_OPERATION(operationNewArrayWithSizeAndProfile, EncodedJSValue, (J
     return JSValue::encode(constructArrayWithSizeQuirk(globalObject, profile, sizeValue));
 }
 
+JSC_DEFINE_JIT_OPERATION(operationCreateLexicalEnvironmentTDZ, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* scope, SymbolTable* table))
+{
+    VM& vm = globalObject->vm();
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+    return JSValue::encode(JSLexicalEnvironment::create(vm, globalObject->activationStructure(), scope, table, jsTDZValue()));
+}
+
+JSC_DEFINE_JIT_OPERATION(operationCreateLexicalEnvironmentUndefined, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* scope, SymbolTable* table))
+{
+    VM& vm = globalObject->vm();
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+    return JSValue::encode(JSLexicalEnvironment::create(vm, globalObject->activationStructure(), scope, table, jsUndefined()));
+}
+
+JSC_DEFINE_JIT_OPERATION(operationCreateDirectArgumentsBaseline, EncodedJSValue, (JSGlobalObject* globalObject))
+{
+    VM& vm = globalObject->vm();
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+    return JSValue::encode(DirectArguments::createByCopying(globalObject, callFrame));
+}
+
+JSC_DEFINE_JIT_OPERATION(operationCreateScopedArgumentsBaseline, EncodedJSValue, (JSGlobalObject* globalObject, JSLexicalEnvironment* scope))
+{
+    VM& vm = globalObject->vm();
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+    ScopedArgumentsTable* table = scope->symbolTable()->arguments();
+    return JSValue::encode(ScopedArguments::createByCopying(globalObject, callFrame, table, scope));
+}
+
+JSC_DEFINE_JIT_OPERATION(operationCreateClonedArgumentsBaseline, EncodedJSValue, (JSGlobalObject* globalObject))
+{
+    VM& vm = globalObject->vm();
+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
+    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
+    return JSValue::encode(ClonedArguments::createWithMachineFrame(globalObject, callFrame, ArgumentsMode::Cloned));
+}
+
 template<typename FunctionType>
 static EncodedJSValue newFunctionCommon(VM& vm, JSScope* scope, JSCell* functionExecutable, bool isInvalidated)
 {

Source/JavaScriptCore/jit/JITOperations.h

@@ -45,7 +45,9 @@ class BinaryArithProfile;
 class Butterfly;
 class CallFrame;
 class CallLinkInfo;
+class ClonedArguments;
 class CodeBlock;
+class DirectArguments;
 class JSArray;
 class JSBoundFunction;
 class JSCell;
@@ -60,6 +62,7 @@ class JSValue;
 class RegExp;
 class RegExpObject;
 class Register;
+class ScopedArguments;
 class Structure;
 class StructureStubInfo;
 class Symbol;
@@ -327,6 +330,11 @@ JSC_DECLARE_JIT_OPERATION(operationCompareStringEq, size_t, (JSGlobalObject*, JS
 #endif
 JSC_DECLARE_JIT_OPERATION(operationNewArrayWithProfile, EncodedJSValue, (JSGlobalObject*, ArrayAllocationProfile*, const JSValue* values, int32_t size));
 JSC_DECLARE_JIT_OPERATION(operationNewArrayWithSizeAndProfile, EncodedJSValue, (JSGlobalObject*, ArrayAllocationProfile*, EncodedJSValue size));
+JSC_DECLARE_JIT_OPERATION(operationCreateLexicalEnvironmentTDZ, EncodedJSValue, (JSGlobalObject*, JSScope*, SymbolTable*));
+JSC_DECLARE_JIT_OPERATION(operationCreateLexicalEnvironmentUndefined, EncodedJSValue, (JSGlobalObject*, JSScope*, SymbolTable*));
+JSC_DECLARE_JIT_OPERATION(operationCreateDirectArgumentsBaseline, EncodedJSValue, (JSGlobalObject*));
+JSC_DECLARE_JIT_OPERATION(operationCreateScopedArgumentsBaseline, EncodedJSValue, (JSGlobalObject*, JSLexicalEnvironment*));
+JSC_DECLARE_JIT_OPERATION(operationCreateClonedArgumentsBaseline, EncodedJSValue, (JSGlobalObject*));
 JSC_DECLARE_JIT_OPERATION(operationNewFunction, EncodedJSValue, (VM*, JSScope*, JSCell*));
 JSC_DECLARE_JIT_OPERATION(operationNewFunctionWithInvalidatedReallocationWatchpoint, EncodedJSValue, (VM*, JSScope*, JSCell*));
 JSC_DECLARE_JIT_OPERATION(operationNewGeneratorFunction, EncodedJSValue, (VM*, JSScope*, JSCell*));

Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

@@ -661,6 +661,43 @@ LLINT_SLOW_PATH_DECL(slow_path_instanceof)
     LLINT_RETURN(jsBoolean(JSObject::defaultHasInstance(globalObject, value, proto)));
 }
 
+LLINT_SLOW_PATH_DECL(slow_path_create_lexical_environment)
+{
+    LLINT_BEGIN();
+    auto bytecode = pc->as<OpCreateLexicalEnvironment>();
+    JSScope* currentScope = callFrame->uncheckedR(bytecode.m_scope).Register::scope();
+    SymbolTable* symbolTable = jsCast<SymbolTable*>(getOperand(callFrame, bytecode.m_symbolTable));
+    JSValue initialValue = getOperand(callFrame, bytecode.m_initialValue);
+    ASSERT(initialValue == jsUndefined() || initialValue == jsTDZValue());
+    JSScope* newScope = JSLexicalEnvironment::create(vm, globalObject, currentScope, symbolTable, initialValue);
+    LLINT_RETURN(newScope);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_create_direct_arguments)
+{
+    LLINT_BEGIN();
+    auto bytecode = pc->as<OpCreateDirectArguments>();
+    LLINT_RETURN(DirectArguments::createByCopying(globalObject, callFrame));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_create_scoped_arguments)
+{
+    LLINT_BEGIN();
+    auto bytecode = pc->as<OpCreateScopedArguments>();
+    JSLexicalEnvironment* scope = jsCast<JSLexicalEnvironment*>(getOperand(callFrame, bytecode.m_scope));
+    ScopedArgumentsTable* table = scope->symbolTable()->arguments();
+    LLINT_RETURN(ScopedArguments::createByCopying(globalObject, callFrame, table, scope));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_create_cloned_arguments)
+{
+    LLINT_BEGIN();
+    auto bytecode = pc->as<OpCreateClonedArguments>();
+    auto result = ClonedArguments::createWithMachineFrame(globalObject, callFrame, ArgumentsMode::Cloned);
+    EXCEPTION_ASSERT(throwScope.exception() || result);
+    LLINT_RETURN(result);
+}
+
 LLINT_SLOW_PATH_DECL(slow_path_try_get_by_id)
 {
     LLINT_BEGIN();

Source/JavaScriptCore/llint/LLIntSlowPaths.h

@@ -67,6 +67,10 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_array);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_array_with_size);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_regexp);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_instanceof);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_create_lexical_environment);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_create_direct_arguments);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_create_scoped_arguments);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_create_cloned_arguments);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_try_get_by_id);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_by_id_direct);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_by_id);

Source/JavaScriptCore/llint/LowLevelInterpreter.asm

@@ -2090,11 +2090,7 @@ macro slowPathOp(opcodeName)
     end)
 end
 
-slowPathOp(create_cloned_arguments)
-slowPathOp(create_direct_arguments)
-slowPathOp(create_lexical_environment)
 slowPathOp(create_rest)
-slowPathOp(create_scoped_arguments)
 slowPathOp(create_this)
 slowPathOp(create_promise)
 slowPathOp(create_generator)
@@ -2140,6 +2136,10 @@ llintSlowPathOp(has_private_brand)
 llintSlowPathOp(del_by_id)
 llintSlowPathOp(del_by_val)
 llintSlowPathOp(instanceof)
+llintSlowPathOp(create_lexical_environment)
+llintSlowPathOp(create_direct_arguments)
+llintSlowPathOp(create_scoped_arguments)
+llintSlowPathOp(create_cloned_arguments)
 llintSlowPathOp(new_array)
 llintSlowPathOp(new_array_with_size)
 llintSlowPathOp(new_async_func)

Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -145,31 +145,6 @@ namespace JSC {
         codeBlock->valueProfileForOffset(bytecode.profileName).m_buckets[0] = JSValue::encode(value); \
     } while (false)
 
-JSC_DEFINE_COMMON_SLOW_PATH(slow_path_create_direct_arguments)
-{
-    BEGIN();
-    auto bytecode = pc->as<OpCreateDirectArguments>();
-    RETURN(DirectArguments::createByCopying(globalObject, callFrame));
-}
-
-JSC_DEFINE_COMMON_SLOW_PATH(slow_path_create_scoped_arguments)
-{
-    BEGIN();
-    auto bytecode = pc->as<OpCreateScopedArguments>();
-    JSLexicalEnvironment* scope = jsCast<JSLexicalEnvironment*>(GET(bytecode.m_scope).jsValue());
-    ScopedArgumentsTable* table = scope->symbolTable()->arguments();
-    RETURN(ScopedArguments::createByCopying(globalObject, callFrame, table, scope));
-}
-
-JSC_DEFINE_COMMON_SLOW_PATH(slow_path_create_cloned_arguments)
-{
-    BEGIN();
-    auto bytecode = pc->as<OpCreateClonedArguments>();
-    auto result = ClonedArguments::createWithMachineFrame(globalObject, callFrame, ArgumentsMode::Cloned);
-    EXCEPTION_ASSERT(throwScope.exception() || result);
-    RETURN(result);
-}
-
 JSC_DEFINE_COMMON_SLOW_PATH(slow_path_create_this)
 {
     BEGIN();
@@ -1077,18 +1052,6 @@ JSC_DEFINE_COMMON_SLOW_PATH(slow_path_unreachable)
     END();
 }
 
-JSC_DEFINE_COMMON_SLOW_PATH(slow_path_create_lexical_environment)
-{
-    BEGIN();
-    auto bytecode = pc->as<OpCreateLexicalEnvironment>();
-    JSScope* currentScope = callFrame->uncheckedR(bytecode.m_scope).Register::scope();
-    SymbolTable* symbolTable = jsCast<SymbolTable*>(GET_C(bytecode.m_symbolTable).jsValue());
-    JSValue initialValue = GET_C(bytecode.m_initialValue).jsValue();
-    ASSERT(initialValue == jsUndefined() || initialValue == jsTDZValue());
-    JSScope* newScope = JSLexicalEnvironment::create(vm, globalObject, currentScope, symbolTable, initialValue);
-    RETURN(newScope);
-}
-
 JSC_DEFINE_COMMON_SLOW_PATH(slow_path_push_with_scope)
 {
     BEGIN();

Source/JavaScriptCore/runtime/CommonSlowPaths.h

@@ -249,9 +249,6 @@ class CallFrame;
 #define JSC_DEFINE_COMMON_SLOW_PATH(name) \
     JSC_DEFINE_JIT_OPERATION(name, UGPRPair, (CallFrame* callFrame, const JSInstruction* pc))
 
-JSC_DECLARE_COMMON_SLOW_PATH(slow_path_create_direct_arguments);
-JSC_DECLARE_COMMON_SLOW_PATH(slow_path_create_scoped_arguments);
-JSC_DECLARE_COMMON_SLOW_PATH(slow_path_create_cloned_arguments);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_create_this);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_enter);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_to_this);
@@ -300,7 +297,6 @@ JSC_DECLARE_COMMON_SLOW_PATH(slow_path_enumerator_put_by_val);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_enumerator_has_own_property);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_profile_type_clear_log);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_unreachable);
-JSC_DECLARE_COMMON_SLOW_PATH(slow_path_create_lexical_environment);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_push_with_scope);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_resolve_scope);
 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_resolve_scope_for_hoisting_func_decl_in_eval);