Bug 572625 - create call object only after new frame is pushed (r=dvander)

This commit is contained in:
Luke Wagner 2010-06-16 23:14:02 -07:00
parent 9469e07029
commit d984311efe

View File

@ -2076,10 +2076,6 @@ BEGIN_CASE(JSOP_APPLY)
for (jsval *v = newfp->slots(); v != newsp; ++v)
*v = JSVAL_VOID;
/* Scope with a call object parented by callee's parent. */
if (fun->isHeavyweight() && !js_GetCallObject(cx, newfp))
goto error;
/* Switch version if currentVersion wasn't overridden. */
newfp->callerVersion = (JSVersion) cx->version;
if (JS_LIKELY(cx->version == currentVersion)) {
@ -2101,6 +2097,10 @@ BEGIN_CASE(JSOP_APPLY)
script = newscript;
atoms = script->atomMap.vector;
/* Now that the new frame is rooted, maybe create a call object. */
if (fun->isHeavyweight() && !js_GetCallObject(cx, fp))
goto error;
/* Call the debugger hook if present. */
if (JSInterpreterHook hook = cx->debugHooks->callHook) {
fp->hookData = hook(cx, fp, JS_TRUE, 0,