[Webkit-unassigned] [Bug 77581] New: calling function on catch block scope containing an eval result in wrong this value being passed

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=77581

           Summary: calling function on catch block scope containing an
                    eval result in wrong this value being passed
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
               URL: javascript:function F(){ return 'F' in this; }; try {
                    throw F; } catch (e) { eval(""); alert(e()); }
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: barraclough at apple.com


If a catch block contains eval, we use a regular object for its scope, instead of a JSStaticScopeObject, such that new variables can be introduced dynamically - effectively transforming:

catch (e) {

}

to 

with ({e:<the error>}) {

}

This results in incorrect this value passing if e (or any function introduced into scope by the eval) is called, since per with behavior the object serving as the this value will be passed as this, rather than undefined.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.