Pass VM instead of JSGlobalObject to MathObject constructor.
Created attachment 213030 [details] Patch
Comment on attachment 213030 [details] Patch r=me
Comment on attachment 213030 [details] Patch Clearing flags on attachment: 213030 Committed r156679: <http://trac.webkit.org/changeset/156679>
All reviewed patches have been landed. Closing bug.