From 4deff4dab56c283f2b2d2b7094a8c34fb6cc0771 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Wed, 19 Oct 2011 08:12:44 -0700
Subject: [PATCH] Fix test failures.

---
 js/src/jsfun.cpp         |  4 ++--
 js/src/jsfuninlines.h    | 12 ++++++++++++
 js/src/jsobj.cpp         |  9 ++++-----
 js/src/jsparse.cpp       |  1 +
 js/src/jsregexpinlines.h |  2 +-
 js/src/jsscope.cpp       |  9 +++++++++
 js/src/jsscopeinlines.h  |  2 +-
 7 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 8ee16db4b51..ebcefc3960b 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -2335,7 +2335,7 @@ js_NewFunction(JSContext *cx, JSObject *funobj, Native native, uintN nargs,
         JS_ASSERT(funobj->isFunction());
         JS_ASSERT(funobj->getParent() == parent);
     } else {
-        funobj = NewFunction(cx, parent ? parent->getGlobal() : NULL);
+        funobj = NewFunction(cx, SkipScopeParent(parent));
         if (!funobj)
             return NULL;
         if (native && !funobj->setSingletonType(cx))
@@ -2381,7 +2381,7 @@ js_CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
     JS_ASSERT(parent);
     JS_ASSERT(proto);
 
-    JSFunction *clone = NewFunction(cx, parent->getGlobal());
+    JSFunction *clone = NewFunction(cx, SkipScopeParent(parent));
     if (!clone)
         return NULL;
 
diff --git a/js/src/jsfuninlines.h b/js/src/jsfuninlines.h
index dfdc3e62c0b..ecefb612856 100644
--- a/js/src/jsfuninlines.h
+++ b/js/src/jsfuninlines.h
@@ -237,6 +237,16 @@ IsBuiltinFunctionConstructor(JSFunction *fun);
 const Shape *
 LookupInterpretedFunctionPrototype(JSContext *cx, JSObject *funobj);
 
+static inline JSObject *
+SkipScopeParent(JSObject *parent)
+{
+    if (!parent)
+        return NULL;
+    while (parent->isScope())
+        parent = parent->getParentMaybeScope();
+    return parent;
+}
+
 inline JSFunction *
 CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
                     bool ignoreSingletonClone = false)
@@ -255,6 +265,8 @@ CloneFunctionObject(JSContext *cx, JSFunction *fun, JSObject *parent,
      */
     if (ignoreSingletonClone && fun->hasSingletonType()) {
         JS_ASSERT(fun->getProto() == proto);
+        if (!fun->setParent(cx, SkipScopeParent(parent)))
+            return NULL;
         fun->setCallScope(parent);
         return fun;
     }
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 43173d7ab2c..11816c4112b 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -4067,7 +4067,7 @@ js_XDRBlockObject(JSXDRState *xdr, JSObject **objp)
 
     if (xdr->mode == JSXDR_ENCODE) {
         obj = *objp;
-        parent = obj->scopeChain();
+        parent = obj->getStaticBlockScopeChain();
         parentId = JSScript::isValidOffset(xdr->script->objectsOffset)
                    ? FindObjectIndex(xdr->script->objects(), parent)
                    : NO_PARENT_INDEX;
@@ -4094,11 +4094,10 @@ js_XDRBlockObject(JSXDRState *xdr, JSObject **objp)
          * object array. We know that we XDR block object in outer-to-inner
          * order, which means that getting the parent now will work.
          */
-        if (parentId == NO_PARENT_INDEX)
-            parent = NULL;
-        else
+        if (parentId != NO_PARENT_INDEX) {
             parent = xdr->script->getObject(parentId);
-        obj->setScopeChain(parent);
+            obj->setScopeChain(parent);
+        }
     }
 
     AutoObjectRooter tvr(cx, obj);
diff --git a/js/src/jsparse.cpp b/js/src/jsparse.cpp
index 2800bf2f1fc..9b0d63a6f25 100644
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -1950,6 +1950,7 @@ Parser::newFunction(JSTreeContext *tc, JSAtom *atom, FunctionSyntaxKind kind)
             return NULL;
         if (!fun->clearType(context))
             return NULL;
+        fun->setCallScope(NULL);
     }
     return fun;
 }
diff --git a/js/src/jsregexpinlines.h b/js/src/jsregexpinlines.h
index f81cfa858b8..dab3be306ad 100644
--- a/js/src/jsregexpinlines.h
+++ b/js/src/jsregexpinlines.h
@@ -741,7 +741,7 @@ inline bool
 JSObject::initRegExp(JSContext *cx, js::RegExp *re)
 {
     JS_ASSERT(isRegExp());
-    JS_ASSERT(getAllocKind() == js::gc::FINALIZE_OBJECT8);
+    JS_ASSERT(js::gc::GetGCKindSlots(getAllocKind()) == 8);
 
     /*
      * It's currently possible to swap RegExp guts. In that case this object
diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index 832711790a5..b0d202dd44d 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -1150,6 +1150,9 @@ JSObject::setParent(JSContext *cx, JSObject *parent)
 /* static */ bool
 Shape::setObjectParent(JSContext *cx, JSObject *parent, Shape **listp)
 {
+    if ((*listp)->getObjectParent() == parent)
+        return true;
+
     BaseShape base(*(*listp)->base()->unowned());
     base.setParent(parent);
     BaseShape *nbase = BaseShape::lookup(cx, base);
@@ -1190,6 +1193,9 @@ JSObject::setFlag(JSContext *cx, /*BaseShape::Flag*/ uint32 flag_, GenerateShape
 {
     BaseShape::Flag flag = (BaseShape::Flag) flag_;
 
+    if (lastProperty()->getObjectFlags() & flag)
+        return true;
+
     if (inDictionaryMode()) {
         if (generateShape == GENERATE_SHAPE && !generateOwnShape(cx))
             return false;
@@ -1203,6 +1209,9 @@ JSObject::setFlag(JSContext *cx, /*BaseShape::Flag*/ uint32 flag_, GenerateShape
 /* static */ bool
 Shape::setObjectFlag(JSContext *cx, BaseShape::Flag flag, Shape **listp)
 {
+    if ((*listp)->getObjectFlags() & flag)
+        return true;
+
     BaseShape base(*(*listp)->base()->unowned());
     base.flags |= flag;
     BaseShape *nbase = BaseShape::lookup(cx, base);
diff --git a/js/src/jsscopeinlines.h b/js/src/jsscopeinlines.h
index e63c1be963f..2d02a8b8d00 100644
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -132,7 +132,7 @@ inline bool
 StringObject::init(JSContext *cx, JSString *str)
 {
     JS_ASSERT(nativeEmpty());
-    JS_ASSERT(getAllocKind() == gc::FINALIZE_OBJECT2);
+    JS_ASSERT(gc::GetGCKindSlots(getAllocKind()) == 2);
 
     if (isDelegate()) {
         if (!assignInitialShape(cx))