If a catch block contains eval, we use a regular object for its scope, instead of a JSStaticScopeObject, such that new variables can be introduced dynamically - effectively transforming: catch (e) { } to with ({e:<the error>}) { } This results in incorrect this value passing if e (or any function introduced into scope by the eval) is called, since per with behavior the object serving as the this value will be passed as this, rather than undefined.
Created attachment 125036 [details] The patch
Attachment 125036 [details] did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1 Source/JavaScriptCore/ChangeLog:1: ChangeLog entry has no bug number [changelog/bugnumber] [5] LayoutTests/ChangeLog:1: ChangeLog entry has no bug number [changelog/bugnumber] [5] Total errors found: 2 in 12 files If any of these errors are false positives, please file a bug against check-webkit-style.
Fixed in r106512.