ScriptState used by EventListener::handleEvent() is wrong

Source/bindings/core/v8/V8ErrorHandler.h

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 27 matching lines @@
 namespace blink {
 
 class ErrorEvent;
 
 class V8ErrorHandler final : public V8EventListener {
 public:
     static PassRefPtr<V8ErrorHandler> create(v8::Local<v8::Object> listener, bool isInline, ScriptState* scriptState)
     {
         return adoptRef(new V8ErrorHandler(listener, isInline, scriptState));
     }
-
     static void storeExceptionOnErrorEventWrapper(v8::Isolate*, ErrorEvent*, v8::Handle<v8::Value>, v8::Handle<v8::Object> creationContext);
 
 private:
     V8ErrorHandler(v8::Local<v8::Object> listener, bool isInline, ScriptState*);
-
-    virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*) override;
+    virtual v8::Local<v8::Value> callListenerFunction(ScriptState*, v8::Handle<v8::Value>, Event*) override;
     virtual bool shouldPreventDefault(v8::Local<v8::Value> returnValue) override;
 };
 
 } // namespace blink
 
 #endif // V8ErrorHandler_h