Block-scoped functions in evals are now only conditionally hoisted out.

test/mjsunit/es6/block-sloppy-function.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Test Annex B 3.3 semantics for functions declared in blocks in sloppy mode.
 // http://www.ecma-international.org/ecma-262/6.0/#sec-block-level-function-declarations-web-legacy-compatibility-semantics
 
 (function overridingLocalFunction() {
   var x = [];
   assertEquals('function', typeof f);
@@ skipping 520 matching lines @@
     }
     assertEquals(1, evalInFunctionHoisted());
   `);
 }();
 
 let dontHoistGlobal;
 { function dontHoistGlobal() {} }
 assertEquals(undefined, dontHoistGlobal);
 
 let dontHoistEval;
-// BUG(v8:) This shouldn't hoist and shouldn't throw
 var throws = false;
 try {
   eval("{ function dontHoistEval() {} }");
 } catch (e) {
   throws = true;
 }
-assertTrue(throws);
+assertFalse(throws);
 
 // When the global object is frozen, silently don't hoist
-// Currently this actually throws BUG(v8:4452)
 Object.freeze(this);
 throws = false;
 try {
   eval('{ function hoistWhenFrozen() {} }');
 } catch (e) {
   throws = true;
 }
 assertFalse(this.hasOwnProperty("hoistWhenFrozen"));
 assertThrows(() => hoistWhenFrozen, ReferenceError);
-// Should be assertFalse BUG(v8:4452)
-assertTrue(throws);
+assertFalse(throws);

[Dan Ehrenberg, 2016/07/01 01:36:20]

This one's funny. Because the global object is already frozen, the change in the
previous test from true to false means that it's changed down here too. Because
we're in sloppy mode, the write on line 551 doesn't take. You didn't fix this
particular bug :)