wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1147907. Relax our realParent asserts in CloneFunction a bit, pending a proper fix for bug 1143794. r=luke

Browse Source
This commit is contained in:
Boris Zbarsky 2015-03-26 23:03:20 -04:00
parent 0a186b970b
commit db964dff03
2 changed files with 26 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
js/src/jit-test/tests/auto-regress/bug1147907.js Normal file
View File

@ -0,0 +1,13 @@
var evalInFrame = (function (global) {
var dbgGlobal = newGlobal();
var dbg = new dbgGlobal.Debugger();
return function evalInFrame(upCount, code) {
dbg.addDebuggee(global);
var frame = dbg.getNewestFrame().older;
var completion = frame.eval(code);
};
})(this);
var x = 5;
let (x = eval("x++")) {
evalInFrame(0, ("for (var x = 0; x < 3; ++x) { (function(){})() } "))
}

17
js/src/jsfun.cpp
View File

@ -2050,7 +2050,14 @@ js::NewFunctionWithProto(ExclusiveContext *cx, Native native,
newKind = SingletonObject;
#ifdef DEBUG
RootedObject nonScopeParent(cx, SkipScopeParent(enclosingDynamicScope));
MOZ_ASSERT(!nonScopeParent || nonScopeParent == cx->global());
// We'd like to assert that nonScopeParent is null-or-global, but
// js::ExecuteInGlobalAndReturnScope and debugger eval bits mess that up.
// Assert that it's one of those or a debug scope proxy or the unqualified
// var obj, since it should still be ok to parent to the global in that
// case.
MOZ_ASSERT(!nonScopeParent || nonScopeParent == cx->global() ||
nonScopeParent->is<DebugScopeObject>() ||
nonScopeParent->isUnqualifiedVarObj());
#endif
funobj = NewObjectWithClassProto(cx, &JSFunction::class_, proto, allocKind,
newKind);
@ -2141,10 +2148,12 @@ js::CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
#ifdef DEBUG
RootedObject realParent(cx, SkipScopeParent(parent));
// We'd like to assert that realParent is null-or-global, but
// js::ExecuteInGlobalAndReturnScope messes that up. Assert that it's one
// of those or the unqualified var obj, since it should still be ok to
// parent to the global in that case.
// js::ExecuteInGlobalAndReturnScope and debugger eval bits mess that up.
// Assert that it's one of those or a debug scope proxy or the unqualified
// var obj, since it should still be ok to parent to the global in that
// case.
MOZ_ASSERT(!realParent || realParent == cx->global() ||
realParent->is<DebugScopeObject>() ||
realParent->isUnqualifiedVarObj());
#endif
JSObject *cloneobj = NewObjectWithClassProto(cx, &JSFunction::class_, cloneProto,