scope analyzer: B.3.3 function declarations do not contribute appropriate references

[bakkot]

In a script like

function f() {
  {
    function g() {}
  }
}

the function g(){} declares two variables named g: one scoped to the block, and one scoped to the function. That we get right. But the declaration also has semantics when control reaches it: it reads from the block-scoped declaration and writes to the function-scoped declaration. These references are not captured.

Getting this right is going to be hard: currently the scope analysis assumes that we know all the references to variables within a scope once we have finished analyzing it, but here we don't know if these two references (one of which is to a variable in the block) exist until we finish analyzing the function (because they would not exist if the block were followed by ; let g;).