<script>function A(){    eval("var a=1");    window.eval("var b=1");}

A();

alert(typeof a);    //undefinedalert(typeof b);    //number</script>

<script>function A(){var p = window.eval;

    alert(p === window.eval);    //true    alert(p === eval);           //true

    eval("var a=1");    p("var b=1");}

A();

alert(typeof a);    //undefinedalert(typeof b);    //number</script>

<script>function A(){var p = window.eval;var q = eval;

    p("var a=1");    q("var b=1");}

A();

alert(typeof a);    //numberalert(typeof b);    //number</script>

<script>function A(){var q = eval;

    q("var b=1");    eval("var a=1");}

A();

alert(typeof a);    //undefinedalert(typeof b);    //number</script>

boolEvalKernel(JSContext *cx, uintN argc, Value *vp, EvalType evalType, JSStackFrame *caller,           JSObject *scopeobj){    ...

/*     * Per ES5, indirect eval runs in the global scope. (eval is specified this     * way so that the compiler can make assumptions about what bindings may or     * may not exist in the current frame if it doesn't see 'eval'.)*/    uintN staticLevel;if (evalType == DIRECT_EVAL) {        staticLevel = caller->script()->staticLevel + 1;

    } else {/* Pretend that we're top level. */        staticLevel = 0;

        JS_ASSERT(scopeobj == scopeobj->getGlobal());        JS_ASSERT(scopeobj->isGlobal());    }

    ...}

boolDirectEval(JSContext *cx, JSFunction *evalfun, uint32 argc, Value *vp){    ...

    JSObject *scopeChain =        GetScopeChainFast(cx, caller, JSOP_EVAL, JSOP_EVAL_LENGTH + JSOP_LINENO_LENGTH);

if (!scopeChain || !EvalKernel(cx, argc, vp, DIRECT_EVAL, caller, scopeChain))return false;

    cx->regs->sp = vp + 1;return true;}

}END_CASE(JSOP_NEW)

BEGIN_CASE(JSOP_EVAL){    argc = GET_ARGC(regs.pc);    vp = regs.sp - (argc + 2);

if (!IsFunctionObject(*vp, &callee))goto call_using_invoke;

    newfun = callee->getFunctionPrivate();if (!IsBuiltinEvalFunction(newfun))goto call_using_invoke;

if (!DirectEval(cx, newfun, argc, vp))goto error;}END_CASE(JSOP_EVAL)

BEGIN_CASE(JSOP_CALL)BEGIN_CASE(JSOP_FUNAPPLY)BEGIN_CASE(JSOP_FUNCALL){

<script>function A(){var eval = window.eval;

    eval("var a=1");    eval("var b=1");}

A();

alert(typeof a);    //undefinedalert(typeof b);    //undefined</script>

<script>eval = alert;

function A(){    eval("var a=1");    　　　　//var a=1    window.eval("var b=1");    //var b=1}

A();</script>