Fixing a subtle bug in receiver resolution when a thrown and caught function ...

src/heap.h

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 74 matching lines @@
   V(Map, undetectable_short_string_map)                 \
   V(Map, undetectable_medium_string_map)                \
   V(Map, undetectable_long_string_map)                  \
   V(Map, undetectable_short_ascii_string_map)           \
   V(Map, undetectable_medium_ascii_string_map)          \
   V(Map, undetectable_long_ascii_string_map)            \
   V(Map, byte_array_map)                                \
   V(Map, fixed_array_map)                               \
   V(Map, hash_table_map)                                \
   V(Map, context_map)                                   \
+  V(Map, catch_context_map)                             \
   V(Map, global_context_map)                            \
   V(Map, code_map)                                      \
   V(Map, oddball_map)                                   \
   V(Map, boilerplate_function_map)                      \
   V(Map, shared_function_info_map)                      \
   V(Map, proxy_map)                                     \
   V(Map, one_word_filler_map)                           \
   V(Map, two_word_filler_map)                           \
   V(Object, nan_value)                                  \
   V(Object, undefined_value)                            \
@@ skipping 318 matching lines @@
   // that the resulting object has hash_table_map as map.
   static Object* AllocateHashTable(int length);
 
   // Allocate a global (but otherwise uninitialized) context.
   static Object* AllocateGlobalContext();
 
   // Allocate a function context.
   static Object* AllocateFunctionContext(int length, JSFunction* closure);
 
   // Allocate a 'with' context.
-  static Object* AllocateWithContext(Context* previous, JSObject* extension);
+  static Object* AllocateWithContext(Context* previous,
+                                     JSObject* extension,
+                                     bool is_catch_context);
 
   // Allocates a new utility object in the old generation.
   static Object* AllocateStruct(InstanceType type);
 
 
   // Initializes a function with a shared part and prototype.
   // Returns the function.
   // Note: this code was factored out of AllocateFunction such that
   // other parts of the VM could use it. Specifically, a function that creates
   // instances of type JS_FUNCTION_TYPE benefit from the use of this function.
@@ skipping 839 matching lines @@
   int marked_count_;
 
   // The count from the end of the previous full GC.  Will be zero if there
   // was no previous full GC.
   int previous_marked_count_;
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_HEAP_H_