Bug 541255 - "Assertion failure: obj->isDenseArray(), at ../jsarray.cpp". r=brendan.

js/src/jsinterp.cpp

@@ -1588,7 +1588,7 @@ js_GetUpvar(JSContext *cx, uintN level, uintN cookie)
     uintN slot = UPVAR_FRAME_SLOT(cookie);
     jsval *vp;
 
-    if (!fp->fun) {
+    if (!fp->fun || (fp->flags & JSFRAME_EVAL)) {
         vp = fp->slots + fp->script->nfixed;
     } else if (slot < fp->fun->nargs) {
         vp = fp->argv;

js/src/jstracer.cpp

@@ -12213,7 +12213,7 @@ TraceRecorder::upvar(JSScript* script, JSUpvarArray* uva, uintN index, jsval& v)
     JSStackFrame* fp = cx->display[level];
     const CallInfo* ci;
     int32 slot;
-    if (!fp->fun) {
+    if (!fp->fun || (fp->flags & JSFRAME_EVAL)) {
         ci = &GetUpvarStackOnTrace_ci;
         slot = cookieSlot;
     } else if (cookieSlot < fp->fun->nargs) {

js/src/tests/js1_8_5/regress/jstests.list

@@ -1,4 +1,9 @@
 url-prefix ../../jsreftest.html?test=js1_8_5/regress/
 fails script regress-533876.js
+script regress-541255-0.js
+script regress-541255-1.js
+script regress-541255-2.js
+script regress-541255-3.js
+script regress-541255-4.js
 script regress-541455.js
 script regress-546615.js

js/src/tests/js1_8_5/regress/regress-541255-0.js

@@ -0,0 +1,14 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Gary Kwong
+ */
+(function(e) {
+  eval("\
+    [(function() {\
+      x.k = function(){}\
+    })() \
+    for (x in [0])]\
+  ")
+})();
+print(" PASSED!");

js/src/tests/js1_8_5/regress/regress-541255-1.js

@@ -0,0 +1,23 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Gary Kwong
+ */
+
+function f(e) {
+  eval("\
+    [((function g(o, bbbbbb) {\
+      if (aaaaaa = bbbbbb) {\
+        return window.r = []\
+      }\
+      g(aaaaaa, bbbbbb + 1);\
+      #3={}\
+    })([], 0)) \
+    for (window in this) \
+    for each(x in [0, 0])\
+    ]\
+  ")
+}
+t = 1;
+f();
+print(" PASSED!");

js/src/tests/js1_8_5/regress/regress-541255-2.js

@@ -0,0 +1,11 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributors: Gary Kwong and Jason Orendorff
+ */
+
+function f(e) {
+    eval("[function () { w.r = 0 }() for (w in [0])]")
+}
+f(0);
+print(" PASSED!");

js/src/tests/js1_8_5/regress/regress-541255-3.js

@@ -0,0 +1,13 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributors: Gary Kwong and Jason Orendorff
+ */
+
+function f(y) {
+    eval("let (z=2, w=y) { (function () { w.p = 7; })(); }");
+}
+var x = {};
+f(x);
+assertEq(x.p, 7);
+print(" PASSED!");

js/src/tests/js1_8_5/regress/regress-541255-4.js

@@ -0,0 +1,11 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributors: Gary Kwong and Jason Orendorff
+ */
+
+function f(e) {
+    eval("[function () { w.r = 0 }() for (w in [0,1,2,3,4,5,6,7,8,9])]")
+}
+f(0);
+print(" PASSED!");