This is causing M1, M2, Moth failures. JSOP_THIS pushes this value: -- object 0x21631048 class 0x2269880 Proxy flags: delegate proto <XPC_WN_ModsAllowed_NoCall_Proto_JSClass object at 0x1c6781c0> parent <Window object at 0x1fd051f8> not native -- And the expected type is object Global. Only happens with JM enabled.
Created attachment 531124 [details] [diff] [review] Patch jsop_this would push the outer window if |this| is undefined or null, but script->getGlobalType() referred to the inner window. The fix, as discussed on IRC, is to mark the resulting type as unknown in this case. Correct me if I'm wrong.