1142832 - Fix ExecuteInGlobalAndReturnScope to not put random objects on a scope chain

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Kinda spun off from bug 1097987.  

ExecuteInGlobalAndReturnScope sets up a random object on the scope chain right now.  When I try to wrap it in With, I hit an assert in this code in SetNameOperation:

319     if (scope->isUnqualifiedVarObj()) {
320         MOZ_ASSERT(!scope->getOps()->setProperty);
321         ok = NativeSetProperty(cx, scope.as<NativeObject>(), scope.as<NativeObject>(), id,
322                                Unqualified, &valCopy, result);
323     } else {
324         ok = SetProperty(cx, scope, scope, id, &valCopy, result);
325     }

because ExecuteInGlobalAndReturnScope does in fact want the scope to be an unqualified var obj, but a With object has a setProperty op.

I guess the best option we have here is to add a special case for non-syntactic With to SetNameOperation or something?

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: What I have so far, hitting that assert

Comment 2

[Boris Zbarsky [:bzbarsky]]

OK, I think I'm just going to work around this for parent removal (see the modified assert in js::CloneFunctionObject that should be fixed up when this code is fixed), but this is still blocking bug 679939 comment 29 step 1 as far as I can tell.

Oh, and this is violating the invariants we want to assert in step 2 there.  :(

Comment 3

[Sylvestre Ledru [:Sylvestre]]

No assignee, updating the status.

Comment 4

[Sylvestre Ledru [:Sylvestre]]

No assignee, updating the status.

Comment 5

[Boris Zbarsky [:bzbarsky]]

ExecuteInGlobalAndReturnScope is gone, but its replacement is ExecuteInFrameScriptEnvironment and it seems to be doing similar things....

That said, we clearly fixed bug 679939 without fixing this, so maybe this is not an issue.