jbarnette-johnson 1.0.0.20090326161333 → 1.0.0.20090402144841

data/vendor/spidermonkey/jsobj.c

@@ -299,8 +299,13 @@ js_SetProtoOrParent(JSContext *cx, JSObject *obj, uint32 slot, JSObject *pobj)
     JS_LOCK_GC(rt);
     ssr.next = rt->setSlotRequests;
     rt->setSlotRequests = &ssr;
-    js_GC(cx, GC_SET_SLOT_REQUEST);
-    JS_UNLOCK_GC(rt);
+    for (;;) {
+        js_GC(cx, GC_SET_SLOT_REQUEST);
+        JS_UNLOCK_GC(rt);
+        if (!rt->setSlotRequests)
+            break;
+        JS_LOCK_GC(rt);
+    }
 
     if (ssr.errnum != JSMSG_NOT_AN_ERROR) {
         if (ssr.errnum == JSMSG_OUT_OF_MEMORY) {
@@ -1140,8 +1145,10 @@ js_ComputeFilename(JSContext *cx, JSStackFrame *caller,
 {
     uint32 flags;
 
+    JS_ASSERT(principals || !cx->runtime->findObjectPrincipals);
     flags = JS_GetScriptFilenameFlags(caller->script);
     if ((flags & JSFILENAME_PROTECTED) &&
+        principals &&
         strcmp(principals->codebase, "[System Principal]")) {
         *linenop = 0;
         return principals->codebase;
@@ -1214,13 +1221,16 @@ obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
         return JS_FALSE;
 
     /*
-     * Script.prototype.compile/exec and Object.prototype.eval all take an
-     * optional trailing argument that overrides the scope object.
+     * Script.prototype.compile/exec and Object.prototype.eval no longer take
+     * an optional trailing argument.
      */
     if (argc >= 2) {
-        if (!js_ValueToObject(cx, argv[1], &scopeobj))
+        if (!JS_ReportErrorFlagsAndNumber(cx,
+                                          JSREPORT_WARNING | JSREPORT_STRICT,
+                                          js_GetErrorMessage, NULL,
+                                          JSMSG_EVAL_ARITY)) {
             return JS_FALSE;
-        argv[1] = OBJECT_TO_JSVAL(scopeobj);
+        }
     }
 
     /* From here on, control must exit through label out with ok set. */
@@ -1242,7 +1252,7 @@ obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
             }
             if (obj != callerScopeChain) {
                 ok = js_CheckPrincipalsAccess(cx, obj,
-                                              caller->script->principals,
+                                              JS_StackFramePrincipals(cx, caller),
                                               cx->runtime->atomState.evalAtom);
                 if (!ok)
                     goto out;
@@ -1432,6 +1442,9 @@ obj_watch(JSContext *cx, uintN argc, jsval *vp)
     if (attrs & JSPROP_READONLY)
         return JS_TRUE;
     *vp = JSVAL_VOID;
+
+    if (OBJ_IS_DENSE_ARRAY(cx, obj) && !js_MakeArraySlow(cx, obj))
+        return JS_FALSE;
     return JS_SetWatchPoint(cx, obj, userid, obj_watch_handler, callable);
 }
 
@@ -3341,7 +3354,8 @@ js_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, jsid id, uintN flags,
                         /* Resolved: juggle locks and lookup id again. */
                         if (obj2 != obj) {
                             JS_UNLOCK_OBJ(cx, obj);
-                            JS_LOCK_OBJ(cx, obj2);
+                            if (OBJ_IS_NATIVE(obj2))
+                                JS_LOCK_OBJ(cx, obj2);
                         }
                         protoIndex = 0;
                         for (proto = start; proto && proto != obj2;
@@ -3352,7 +3366,6 @@ js_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, jsid id, uintN flags,
                         if (!MAP_IS_NATIVE(&scope->map)) {
                             /* Whoops, newresolve handed back a foreign obj2. */
                             JS_ASSERT(obj2 != obj);
-                            JS_UNLOCK_OBJ(cx, obj2);
                             ok = OBJ_LOOKUP_PROPERTY(cx, obj2, id, objp, propp);
                             if (!ok || *propp)
                                 goto cleanup;
@@ -3373,7 +3386,8 @@ js_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, jsid id, uintN flags,
                             JS_ASSERT(obj2 == scope->object);
                             obj = obj2;
                         } else if (obj2 != obj) {
-                            JS_UNLOCK_OBJ(cx, obj2);
+                            if (OBJ_IS_NATIVE(obj2))
+                                JS_UNLOCK_OBJ(cx, obj2);
                             JS_LOCK_OBJ(cx, obj);
                         }
                     }
@@ -4359,8 +4373,10 @@ js_CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
 
             /* Avoid diverging for non-natives that reuse js_CheckAccess. */
             if (pobj->map->ops->checkAccess == js_CheckAccess) {
-                if (!writing)
+                if (!writing) {
                     *vp = JSVAL_VOID;
+                    *attrsp = 0;
+                }
                 break;
             }
             return OBJ_CHECK_ACCESS(cx, pobj, id, mode, vp, attrsp);

data/vendor/spidermonkey/jsopcode.c

@@ -4824,7 +4824,7 @@ js_DecompileValueGenerator(JSContext *cx, intN spindex, jsval v,
 
     for (fp = cx->fp; fp && !fp->script; fp = fp->down)
         continue;
-    if (!fp || !fp->regs)
+    if (!fp || !fp->regs || !fp->regs->sp)
         goto do_fallback;
 
     script = fp->script;

data/vendor/spidermonkey/jsparse.c

@@ -2029,6 +2029,16 @@ CheckDestructuring(JSContext *cx, BindData *data,
         return JS_FALSE;
     }
 
+#if JS_HAS_DESTRUCTURING_SHORTHAND
+    if (right &&
+        right->pn_arity == PN_LIST && 
+        (right->pn_extra & PNX_SHORTHAND)) {
+        js_ReportCompileErrorNumber(cx, TS(tc->parseContext), right,
+                                    JSREPORT_ERROR, JSMSG_BAD_OBJECT_INIT);
+        return JS_FALSE;
+    }
+#endif
+
     fpvd.table.ops = NULL;
     lhs = left->pn_head;
     if (lhs && lhs->pn_type == TOK_DEFSHARP) {
@@ -4555,18 +4565,32 @@ MemberExpr(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc,
             pn2->pn_pos.begin = pn->pn_pos.begin;
             pn2->pn_pos.end = CURRENT_TOKEN(ts).pos.end;
 
-            /* Optimize o['p'] to o.p by rewriting pn2. */
-            if (pn3->pn_type == TOK_STRING) {
-                pn2->pn_type = TOK_DOT;
-                pn2->pn_op = JSOP_GETPROP;
-                pn2->pn_arity = PN_NAME;
-                pn2->pn_expr = pn;
-                pn2->pn_atom = pn3->pn_atom;
-            } else {
+            /*
+             * Optimize o['p'] to o.p by rewriting pn2, but avoid rewriting
+             * o['0'] to use JSOP_GETPROP, to keep fast indexing disjoint in
+             * the interpreter from fast property access. However, if the
+             * bracketed string is a uint32, we rewrite pn3 to be a number
+             * instead of a string.
+             */
+            do {
+                if (pn3->pn_type == TOK_STRING) {
+                    jsuint index;
+
+                    if (!js_IdIsIndex(ATOM_TO_JSID(pn3->pn_atom), &index)) {
+                        pn2->pn_type = TOK_DOT;
+                        pn2->pn_op = JSOP_GETPROP;
+                        pn2->pn_arity = PN_NAME;
+                        pn2->pn_expr = pn;
+                        pn2->pn_atom = pn3->pn_atom;
+                        break;
+                    }
+                    pn3->pn_type = TOK_NUMBER;
+                    pn3->pn_dval = index;
+                }
                 pn2->pn_op = JSOP_GETELEM;
                 pn2->pn_left = pn;
                 pn2->pn_right = pn3;
-            }
+            } while (0);
         } else if (allowCallSyntax && tt == TOK_LP) {
             pn2 = NewParseNode(cx, ts, PN_LIST, tc);
             if (!pn2)

data/vendor/spidermonkey/jsregexp.c

@@ -3622,12 +3622,17 @@ regexp_getProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
 
     if (!JSVAL_IS_INT(id))
         return JS_TRUE;
+    while (OBJ_GET_CLASS(cx, obj) != &js_RegExpClass) {
+        obj = OBJ_GET_PROTO(cx, obj);
+        if (!obj)
+            return JS_TRUE;
+    }
     slot = JSVAL_TO_INT(id);
     if (slot == REGEXP_LAST_INDEX)
         return JS_GetReservedSlot(cx, obj, 0, vp);
 
     JS_LOCK_OBJ(cx, obj);
-    re = (JSRegExp *) JS_GetInstancePrivate(cx, obj, &js_RegExpClass, NULL);
+    re = (JSRegExp *) JS_GetPrivate(cx, obj);
     if (re) {
         switch (slot) {
           case REGEXP_SOURCE:
@@ -3661,6 +3666,11 @@ regexp_setProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     ok = JS_TRUE;
     if (!JSVAL_IS_INT(id))
         return ok;
+    while (OBJ_GET_CLASS(cx, obj) != &js_RegExpClass) {
+        obj = OBJ_GET_PROTO(cx, obj);
+        if (!obj)
+            return JS_TRUE;
+    }
     slot = JSVAL_TO_INT(id);
     if (slot == REGEXP_LAST_INDEX) {
         if (!JS_ValueToNumber(cx, *vp, &lastIndex))
@@ -4298,10 +4308,12 @@ js_NewRegExpObject(JSContext *cx, JSTokenStream *ts,
     str = js_NewStringCopyN(cx, chars, length);
     if (!str)
         return NULL;
+    JS_PUSH_TEMP_ROOT_STRING(cx, str, &tvr);
     re = js_NewRegExp(cx, ts,  str, flags, JS_FALSE);
-    if (!re)
+    if (!re) {
+        JS_POP_TEMP_ROOT(cx, &tvr);
         return NULL;
-    JS_PUSH_TEMP_ROOT_STRING(cx, str, &tvr);
+    }
     obj = js_NewObject(cx, &js_RegExpClass, NULL, NULL, 0);
     if (!obj || !JS_SetPrivate(cx, obj, re)) {
         js_DestroyRegExp(cx, re);

data/vendor/spidermonkey/jsscan.c

@@ -298,150 +298,144 @@ GetChar(JSTokenStream *ts)
     if (ts->ungetpos != 0) {
         c = ts->ungetbuf[--ts->ungetpos];
     } else {
-        do {
-            if (ts->linebuf.ptr == ts->linebuf.limit) {
-                len = PTRDIFF(ts->userbuf.limit, ts->userbuf.ptr, jschar);
+        if (ts->linebuf.ptr == ts->linebuf.limit) {
+            len = PTRDIFF(ts->userbuf.limit, ts->userbuf.ptr, jschar);
+            if (len <= 0) {
+                if (!ts->file) {
+                    ts->flags |= TSF_EOF;
+                    return EOF;
+                }
+        
+                /* Fill ts->userbuf so that \r and \r\n convert to \n. */
+                crflag = (ts->flags & TSF_CRFLAG) != 0;
+                len = js_fgets(cbuf, JS_LINE_LIMIT - crflag, ts->file);
                 if (len <= 0) {
-                    if (!ts->file) {
-                        ts->flags |= TSF_EOF;
-                        return EOF;
-                    }
-            
-                    /* Fill ts->userbuf so that \r and \r\n convert to \n. */
-                    crflag = (ts->flags & TSF_CRFLAG) != 0;
-                    len = js_fgets(cbuf, JS_LINE_LIMIT - crflag, ts->file);
-                    if (len <= 0) {
-                        ts->flags |= TSF_EOF;
-                        return EOF;
-                    }
-                    olen = len;
-                    ubuf = ts->userbuf.base;
-                    i = 0;
-                    if (crflag) {
-                        ts->flags &= ~TSF_CRFLAG;
-                        if (cbuf[0] != '\n') {
-                            ubuf[i++] = '\n';
-                            len++;
-                            ts->linepos--;
-                        }
-                    }
-                    for (j = 0; i < len; i++, j++)
-                        ubuf[i] = (jschar) (unsigned char) cbuf[j];
-                    ts->userbuf.limit = ubuf + len;
-                    ts->userbuf.ptr = ubuf;
+                    ts->flags |= TSF_EOF;
+                    return EOF;
                 }
-                if (ts->listener) {
-                    ts->listener(ts->filename, ts->lineno, ts->userbuf.ptr, len,
-                                 &ts->listenerTSData, ts->listenerData);
+                olen = len;
+                ubuf = ts->userbuf.base;
+                i = 0;
+                if (crflag) {
+                    ts->flags &= ~TSF_CRFLAG;
+                    if (cbuf[0] != '\n') {
+                        ubuf[i++] = '\n';
+                        len++;
+                        ts->linepos--;
+                    }
                 }
-            
-                nl = ts->saveEOL;
-                if (!nl) {
+                for (j = 0; i < len; i++, j++)
+                    ubuf[i] = (jschar) (unsigned char) cbuf[j];
+                ts->userbuf.limit = ubuf + len;
+                ts->userbuf.ptr = ubuf;
+            }
+            if (ts->listener) {
+                ts->listener(ts->filename, ts->lineno, ts->userbuf.ptr, len,
+                             &ts->listenerTSData, ts->listenerData);
+            }
+        
+            nl = ts->saveEOL;
+            if (!nl) {
+                /*
+                 * Any one of \n, \r, or \r\n ends a line (the longest
+                 * match wins).  Also allow the Unicode line and paragraph
+                 * separators.
+                 */
+                for (nl = ts->userbuf.ptr; nl < ts->userbuf.limit; nl++) {
                     /*
-                     * Any one of \n, \r, or \r\n ends a line (the longest
-                     * match wins).  Also allow the Unicode line and paragraph
-                     * separators.
+                     * Try to prevent value-testing on most characters by
+                     * filtering out characters that aren't 000x or 202x.
                      */
-                    for (nl = ts->userbuf.ptr; nl < ts->userbuf.limit; nl++) {
-                        /*
-                         * Try to prevent value-testing on most characters by
-                         * filtering out characters that aren't 000x or 202x.
-                         */
-                        if ((*nl & 0xDFD0) == 0) {
-                            if (*nl == '\n')
-                                break;
-                            if (*nl == '\r') {
-                                if (nl + 1 < ts->userbuf.limit && nl[1] == '\n')
-                                    nl++;
-                                break;
-                            }
-                            if (*nl == LINE_SEPARATOR || *nl == PARA_SEPARATOR)
-                                break;
+                    if ((*nl & 0xDFD0) == 0) {
+                        if (*nl == '\n')
+                            break;
+                        if (*nl == '\r') {
+                            if (nl + 1 < ts->userbuf.limit && nl[1] == '\n')
+                                nl++;
+                            break;
                         }
+                        if (*nl == LINE_SEPARATOR || *nl == PARA_SEPARATOR)
+                            break;
                     }
                 }
-            
-                /*
-                 * If there was a line terminator, copy thru it into linebuf.
-                 * Else copy JS_LINE_LIMIT-1 bytes into linebuf.
-                 */
-                if (nl < ts->userbuf.limit)
-                    len = PTRDIFF(nl, ts->userbuf.ptr, jschar) + 1;
-                if (len >= JS_LINE_LIMIT) {
-                    len = JS_LINE_LIMIT - 1;
-                    ts->saveEOL = nl;
-                } else {
-                    ts->saveEOL = NULL;
-                }
-                js_strncpy(ts->linebuf.base, ts->userbuf.ptr, len);
-                ts->userbuf.ptr += len;
-                olen = len;
-            
-                /*
-                 * Make sure linebuf contains \n for EOL (don't do this in
-                 * userbuf because the user's string might be readonly).
-                 */
-                if (nl < ts->userbuf.limit) {
-                    if (*nl == '\r') {
-                        if (ts->linebuf.base[len-1] == '\r') {
-                            /*
-                             * Does the line segment end in \r?  We must check
-                             * for a \n at the front of the next segment before
-                             * storing a \n into linebuf.  This case matters
-                             * only when we're reading from a file.
-                             */
-                            if (nl + 1 == ts->userbuf.limit && ts->file) {
-                                len--;
-                                ts->flags |= TSF_CRFLAG; /* clear NLFLAG? */
-                                if (len == 0) {
-                                    /*
-                                     * This can happen when a segment ends in
-                                     * \r\r.  Start over.  ptr == limit in this
-                                     * case, so we'll fall into buffer-filling
-                                     * code.
-                                     */
-                                    return GetChar(ts);
-                                }
-                            } else {
-                                ts->linebuf.base[len-1] = '\n';
-                            }
-                        }
-                    } else if (*nl == '\n') {
-                        if (nl > ts->userbuf.base &&
-                            nl[-1] == '\r' &&
-                            ts->linebuf.base[len-2] == '\r') {
+            }
+        
+            /*
+             * If there was a line terminator, copy thru it into linebuf.
+             * Else copy JS_LINE_LIMIT-1 bytes into linebuf.
+             */
+            if (nl < ts->userbuf.limit)
+                len = PTRDIFF(nl, ts->userbuf.ptr, jschar) + 1;
+            if (len >= JS_LINE_LIMIT) {
+                len = JS_LINE_LIMIT - 1;
+                ts->saveEOL = nl;
+            } else {
+                ts->saveEOL = NULL;
+            }
+            js_strncpy(ts->linebuf.base, ts->userbuf.ptr, len);
+            ts->userbuf.ptr += len;
+            olen = len;
+        
+            /*
+             * Make sure linebuf contains \n for EOL (don't do this in
+             * userbuf because the user's string might be readonly).
+             */
+            if (nl < ts->userbuf.limit) {
+                if (*nl == '\r') {
+                    if (ts->linebuf.base[len-1] == '\r') {
+                        /*
+                         * Does the line segment end in \r?  We must check
+                         * for a \n at the front of the next segment before
+                         * storing a \n into linebuf.  This case matters
+                         * only when we're reading from a file.
+                         */
+                        if (nl + 1 == ts->userbuf.limit && ts->file) {
                             len--;
-                            JS_ASSERT(ts->linebuf.base[len] == '\n');
+                            ts->flags |= TSF_CRFLAG; /* clear NLFLAG? */
+                            if (len == 0) {
+                                /*
+                                 * This can happen when a segment ends in
+                                 * \r\r.  Start over.  ptr == limit in this
+                                 * case, so we'll fall into buffer-filling
+                                 * code.
+                                 */
+                                return GetChar(ts);
+                            }
+                        } else {
                             ts->linebuf.base[len-1] = '\n';
                         }
-                    } else if (*nl == LINE_SEPARATOR || *nl == PARA_SEPARATOR) {
+                    }
+                } else if (*nl == '\n') {
+                    if (nl > ts->userbuf.base &&
+                        nl[-1] == '\r' &&
+                        ts->linebuf.base[len-2] == '\r') {
+                        len--;
+                        JS_ASSERT(ts->linebuf.base[len] == '\n');
                         ts->linebuf.base[len-1] = '\n';
                     }
+                } else if (*nl == LINE_SEPARATOR || *nl == PARA_SEPARATOR) {
+                    ts->linebuf.base[len-1] = '\n';
                 }
-            
-                /* Reset linebuf based on adjusted segment length. */
-                ts->linebuf.limit = ts->linebuf.base + len;
-                ts->linebuf.ptr = ts->linebuf.base;
-            
-                /* Update position of linebuf within physical userbuf line. */
-                if (!(ts->flags & TSF_NLFLAG))
-                    ts->linepos += ts->linelen;
-                else
-                    ts->linepos = 0;
-                if (ts->linebuf.limit[-1] == '\n')
-                    ts->flags |= TSF_NLFLAG;
-                else
-                    ts->flags &= ~TSF_NLFLAG;
-            
-                /* Update linelen from original segment length. */
-                ts->linelen = olen;
             }
-            c = *ts->linebuf.ptr++;
-        /*
-         * In the hopes of being liberal in what we accept, we toss out little-
-         * and big-endian byte order markers here, see bug 368516.
-         */
-        } while (c == 0xfffe || c == 0xfeff);
+        
+            /* Reset linebuf based on adjusted segment length. */
+            ts->linebuf.limit = ts->linebuf.base + len;
+            ts->linebuf.ptr = ts->linebuf.base;
+        
+            /* Update position of linebuf within physical userbuf line. */
+            if (!(ts->flags & TSF_NLFLAG))
+                ts->linepos += ts->linelen;
+            else
+                ts->linepos = 0;
+            if (ts->linebuf.limit[-1] == '\n')
+                ts->flags |= TSF_NLFLAG;
+            else
+                ts->flags &= ~TSF_NLFLAG;
+        
+            /* Update linelen from original segment length. */
+            ts->linelen = olen;
+        }
+        c = *ts->linebuf.ptr++;
     }
     if (c == '\n')
         ts->lineno++;
@@ -819,6 +813,8 @@ GetXMLEntity(JSContext *cx, JSTokenStream *ts)
     /* Put the entity, including the '&' already scanned, in ts->tokenbuf. */
     offset = PTRDIFF(ts->tokenbuf.ptr, ts->tokenbuf.base, jschar);
     FastAppendChar(&ts->tokenbuf, '&');
+    if (!STRING_BUFFER_OK(&ts->tokenbuf))
+        return JS_FALSE;
     while ((c = GetChar(ts)) != ';') {
         if (c == EOF || c == '\n') {
             js_ReportCompileErrorNumber(cx, ts, NULL, JSREPORT_ERROR,
@@ -826,6 +822,8 @@ GetXMLEntity(JSContext *cx, JSTokenStream *ts)
             return JS_FALSE;
         }
         FastAppendChar(&ts->tokenbuf, (jschar) c);
+        if (!STRING_BUFFER_OK(&ts->tokenbuf))
+            return JS_FALSE;
     }
 
     /* Let length be the number of jschars after the '&', including the ';'. */
@@ -911,6 +909,8 @@ badncr:
     msg = JSMSG_BAD_XML_NCR;
 bad:
     /* No match: throw a TypeError per ECMA-357 10.3.2.1 step 8(a). */
+    JS_ASSERT(STRING_BUFFER_OK(&ts->tokenbuf));
+    JS_ASSERT(PTRDIFF(ts->tokenbuf.ptr, bp, jschar) >= 1);
     bytes = js_DeflateString(cx, bp + 1,
                              PTRDIFF(ts->tokenbuf.ptr, bp, jschar) - 1);
     if (bytes) {
@@ -990,6 +990,15 @@ NewToken(JSTokenStream *ts, ptrdiff_t adjust)
     return tp;
 }
 
+static JS_INLINE JSBool
+ScanAsSpace(jschar c)
+{
+    /* Treat little- and big-endian BOMs as whitespace for compatibility. */
+    if (JS_ISSPACE(c) || c == 0xfffe || c == 0xfeff)
+        return JS_TRUE;
+    return JS_FALSE;
+}
+
 JSTokenType
 js_GetToken(JSContext *cx, JSTokenStream *ts)
 {
@@ -1200,7 +1209,7 @@ retry:
             if (ts->flags & TSF_NEWLINES)
                 break;
         }
-    } while (JS_ISSPACE(c));
+    } while (ScanAsSpace(c));
 
     tp = NewToken(ts, -1);
     if (c == EOF) {
@@ -1722,7 +1731,7 @@ retry:
                     cp[3] == 'n' &&
                     cp[4] == 'e') {
                     SkipChars(ts, 5);
-                    while ((c = GetChar(ts)) != '\n' && JS_ISSPACE(c))
+                    while ((c = GetChar(ts)) != '\n' && ScanAsSpace(c))
                         continue;
                     if (JS7_ISDEC(c)) {
                         line = JS7_UNDEC(c);
@@ -1734,7 +1743,7 @@ retry:
                             }
                             line = temp;
                         }
-                        while (c != '\n' && JS_ISSPACE(c))
+                        while (c != '\n' && ScanAsSpace(c))
                             c = GetChar(ts);
                         i = 0;
                         if (c == '"') {
@@ -1749,7 +1758,7 @@ retry:
                             }
                             if (c == '"') {
                                 while ((c = GetChar(ts)) != '\n' &&
-                                       JS_ISSPACE(c)) {
+                                       ScanAsSpace(c)) {
                                     continue;
                                 }
                             }

data/vendor/spidermonkey/jsscope.c

@@ -809,6 +809,7 @@ GetPropertyTreeChild(JSContext *cx, JSScopeProperty *parent,
     JSScopeProperty *sprop;
     PropTreeKidsChunk *chunk;
     uintN i, n;
+    uint32 shape;
 
     rt = cx->runtime;
     if (!parent) {
@@ -895,6 +896,12 @@ GetPropertyTreeChild(JSContext *cx, JSScopeProperty *parent,
     }
 
 locked_not_found:
+    /*
+     * Call js_GenerateShape before the allocation to prevent collecting the
+     * new property when the shape generation triggers the GC.
+     */
+    shape = js_GenerateShape(cx, JS_TRUE, NULL);
+
     sprop = NewScopeProperty(rt);
     if (!sprop)
         goto out_of_memory;
@@ -907,7 +914,7 @@ locked_not_found:
     sprop->flags = child->flags;
     sprop->shortid = child->shortid;
     sprop->parent = sprop->kids = NULL;
-    sprop->shape = js_GenerateShape(cx, JS_TRUE);
+    sprop->shape = shape;
 
     if (!parent) {
         entry->child = sprop;
@@ -1256,9 +1263,11 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
          */
         if (!JS_CLIST_IS_EMPTY(&cx->runtime->watchPointList) &&
             js_FindWatchPoint(cx->runtime, scope, id)) {
-            JS_PUSH_TEMP_ROOT_SPROP(cx, overwriting, &tvr);
+            if (overwriting)
+                JS_PUSH_TEMP_ROOT_SPROP(cx, overwriting, &tvr);
             setter = js_WrapWatchedSetter(cx, id, attrs, setter);
-            JS_POP_TEMP_ROOT(cx, &tvr);
+            if (overwriting)
+                JS_POP_TEMP_ROOT(cx, &tvr);
             if (!setter)
                 goto fail_overwrite;
         }

data/vendor/spidermonkey/jsscope.h

@@ -220,7 +220,7 @@ JS_STATIC_ASSERT(offsetof(JSScope, title) == sizeof(JSObjectMap));
 #define OBJ_SCOPE(obj)                  ((JSScope *)(obj)->map)
 
 #define SCOPE_MAKE_UNIQUE_SHAPE(cx,scope)                                     \
-    ((scope)->shape = js_GenerateShape((cx), JS_FALSE))
+    ((scope)->shape = js_GenerateShape((cx), JS_FALSE, NULL))
 
 #define SCOPE_EXTEND_SHAPE(cx,scope,sprop)                                    \
     JS_BEGIN_MACRO                                                            \
@@ -228,7 +228,7 @@ JS_STATIC_ASSERT(offsetof(JSScope, title) == sizeof(JSObjectMap));
             (scope)->shape == (scope)->lastProp->shape) {                     \
             (scope)->shape = (sprop)->shape;                                  \
         } else {                                                              \
-            (scope)->shape = js_GenerateShape((cx), JS_FALSE);                \
+            (scope)->shape = js_GenerateShape((cx), JS_FALSE, sprop);         \
         }                                                                     \
     JS_END_MACRO
 

data/vendor/spidermonkey/jsstr.c

@@ -1216,9 +1216,7 @@ match_or_replace(JSContext *cx,
 
             /* Assume a full array result is required, then prove otherwise. */
             test = JS_FALSE;
-            if (fp) {
-                JS_ASSERT(*fp->regs->pc == JSOP_CALL ||
-                          *fp->regs->pc == JSOP_NEW);
+            if (fp && (*fp->regs->pc == JSOP_CALL || *fp->regs->pc == JSOP_NEW)) {
                 JS_ASSERT(js_CodeSpec[*fp->regs->pc].length == 3);
                 switch (fp->regs->pc[3]) {
                   case JSOP_POP:
@@ -1949,6 +1947,9 @@ str_concat(JSContext *cx, uintN argc, jsval *vp)
 
     NORMALIZE_THIS(cx, vp, str);
 
+    /* Set vp (aka rval) early to handle the argc == 0 case. */
+    *vp = STRING_TO_JSVAL(str);
+
     for (i = 0, argv = vp + 2; i < argc; i++) {
         str2 = js_ValueToString(cx, argv[i]);
         if (!str2)
@@ -1958,9 +1959,9 @@ str_concat(JSContext *cx, uintN argc, jsval *vp)
         str = js_ConcatStrings(cx, str, str2);
         if (!str)
             return JS_FALSE;
+        *vp = STRING_TO_JSVAL(str);
     }
 
-    *vp = STRING_TO_JSVAL(str);
     return JS_TRUE;
 }