(Bug no. 1):
[10.5 Declaration Binding Instantiation] uses the EnvironmentRecord of the context's VariableEnvironment and assigns it to `env` in step 1. Later in step 7a, this EnvironmentRecord `env` is passed to the abstract operation CreateArgumentsObject. CreateArgumentsObject [10.6] actually expects its `env` parameter to be of type LexicalEnvironment.
(Bug no. 2):
CreateArgumentsObject calls in step 11c[ii-2/3] MakeArgGetter/MakeArgSetter passing the parameter `env` (which is expected to be a LexicalEnvironment, but actually is a EnvironmentRecord). The introductory text for MakeArgGetter/MakeArgSetter even describes MakeArgGetter/MakeArgSetter's `env` parameter to be of type EnvironmentRecord. Then in step 2 (resp. 3) this `env` parameter is passed to the [13.2 Creating Function Objects] operation as the `Scope` parameter, but `Scope` must be of type LexicalEnvironment!
Suggestions to fix (Bug no. 1):
Change [10.5 Declaration Binding Instantiation] as follows:
---
1. Let env be the running execution context‘s VariableEnvironment.
2. Let envRec be env‘s environment record.
(Change every occurrence of `env` to `envRec` in the following algorithm steps expect for 7a which calls CreateArgumentsObject)
---
Suggestions to fix (Bug no. 2):
Change the introductory text for MakeArgGetter/MakeArgSetter to describe the `env` parameter to be a lexical/variable environment.
This also needs to be changed in the ES6-draft.
This seems fixed in ES2015 (probably due to extensive refactorings in this area).