add TDZ taint to references

[michaelficarra]

It'd be nice if a reference to a block-scope variable let you know if that reference is in the temporal dead zone or not.

[ikarienator]

@michaelficarra define temporal dead zone.

[michaelficarra]

A reference to a block-scoped variable that would be evaluated before its declaration is in the temporal dead zone.

[bakkot]

This is not a static property, so I don't think it's suitable for static analysis:

let f = () => x;
f(); // TDZ violation
let x;
f(); // not a TDZ violation

[michaelficarra]

Well the static property is "definitely", "possibly", or "definitely not". It relies on control flow analysis, which is some effort on its own.