In Source/JavaScriptCore/parser/Parser.h we hit the assertion: ASSERT_WITH_MESSAGE(!m_declaredVariables.size(), "...");

This is triggered by a simple case where a class function is declared inside of a static scope:

class A {
  static {
    var B;
    function C() {}
  }
}

What's interesting is that I would assume the variables inside that block would be scoped to that class statically, IE the variable B would be accessible through A.B, but that simply is not the case.
It's not a pressing concern, but it seems like a possible regression of https://bugs.webkit.org/show_bug.cgi?id=168844