Some of these fixes are subtle (like the first patch) and very annoying to debug. Although the first patch looks like a hack, surprisingly, it's how the spec itself says it is! It's not even an IE quirk, but a special case in the spec.
For example, the variable name (which holds the builtin eval func) **does** matter: if it's called something other than 'eval', it gets treated differently (as if indirect), and this is verified by the tests + the spec's wording (so Microsoft's implementation follows it).
Most of the patches other than the first 2 are pretty small so they're in same MR.
--
v9: jscript: Get rid of the function instance in arguments obj.
jscript: Start from the last argument when adding them to named locals.
jscript: Store detached args into a scope's specialized buffer.
jscript: Don't use iface_to_jsdisp where it's not necessary to grab it.
jscript: Get rid of jsobj in scope_chain_t.
jscript: Fix function leak in scope_init_locals.
jscript: Fix addressing invalid memory if ref is an argument.
jscript: Correctly implement context for indirect eval calls in ES5+ modes.
https://gitlab.winehq.org/wine/wine/-/merge_requests/2942