Parents: #465, #493, #496 Related: #615
Problem
Compiler.compilePlainFunctionInner first calls functionHasShadowableLexical; on the common no-shadow path it then calls functionHasTdzHazard. Both helpers independently allocate a spelling map, insert the same parameters and declarations, and walk the complete statement tree through shadowScanStmt before TDZ reference analysis begins. A detected lexical shadow correctly short-circuits the second helper today and must remain a neutral control.
The common-path cost is bounded but duplicated for every no-shadow bytecode-admitted plain function. Functions with no lexical bindings also perform a complete TDZ reference walk whose answer is provably false. Attacker-sized declaration and statement surfaces therefore pay duplicate hashing, allocation, and AST traversal before lowering. #615 removed the more severe per-pending-name reference scans; this child owns the remaining duplicate inventory and empty-lexical work without changing TDZ policy.
Scope
- Add exact parse-plus-plain-function-compile witnesses at 1K/2K/4K declaration widths.
- Include unique lexical growth, var-only, repeated/shadowed lexical, parameter-shadow, destructuring, nested-control, and real TDZ-hazard controls.
- Produce one immutable binding inventory that supplies shadowing, lexical-presence, and pending-lexical membership for TDZ analysis.
- Skip TDZ reference analysis only when that exhaustive inventory proves the function owns no lexical binding.
- Preserve distinct-slot lexical lowering, conservative spelling-based shadow handling, exhaustive AST coverage, and allocation failure propagation.
- Measure structural checksum/admission/opcode policy, allocations/bytes, instructions/cycles, and wall diagnostics through the exact-parent pipeline.
No-workaround rules
- No weakening TDZ checks, merging distinct bindings, skipping declaration forms, caching mutable AST identity globally, or broadening checked opcodes to avoid exact classification.
Acceptance
- The benchmark contract proves exact admission, chunk shape/checksum, local/lexical slot inventory, and checked-opcode policy for every control.
- Binding inventory and shadow classification traverse the function declaration surface once.
- Exact-parent growth evidence demonstrates the removed traversal/allocation cost without semantic or checksum drift.
- Focused compiler/frontend and forced tree-walker↔required-bytecode differentials pass.
- Relevant Test262 function/lexical/destructuring/control-flow subtrees have nonzero, exact before→after accounting with zero regressions.
- Full units and applicable sanitizer gates pass.