Bug 77581 – calling function on catch block scope containing an eval result in wrong this value being passed

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Gavin Barraclough]

If a catch block contains eval, we use a regular object for its scope, instead of a JSStaticScopeObject, such that new variables can be introduced dynamically - effectively transforming:

catch (e) {

}

to 

with ({e:<the error>}) {

}

This results in incorrect this value passing if e (or any function introduced into scope by the eval) is called, since per with behavior the object serving as the this value will be passed as this, rather than undefined.

[Gavin Barraclough]

Created attachment 125036 [details]
The patch

[WebKit Review Bot]

Attachment 125036 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1

Source/JavaScriptCore/ChangeLog:1:  ChangeLog entry has no bug number  [changelog/bugnumber] [5]
LayoutTests/ChangeLog:1:  ChangeLog entry has no bug number  [changelog/bugnumber] [5]
Total errors found: 2 in 12 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Gavin Barraclough]

Fixed in r106512.