860277 - IonMonkey: Bail on "eval" if eval's input contains "eval"

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Kannan Vijayan [:djvj]]

IonMonkey compiles frames containing eval, but bails if the eval is reached and its input string contains "arguments" (checked via strstr), since ion doesn't support arguments objects.

However, that can happen indirectly via:

eval("eval('arg'+'uments')");

which wont trigger the strstr.  So the strstr should also check for "eval" within the eval input, and bail if it's found.  That should cover all cases.