diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp index 4ce98e96fbec..d7cbb5967051 100644 --- a/js/src/jstracer.cpp +++ b/js/src/jstracer.cpp @@ -6729,7 +6729,15 @@ TraceRecorder::getThis(LIns*& this_ins) /* * js_ComputeThisForFrame updates cx->fp->argv[-1], so sample it into 'original' first. */ - jsval original = cx->fp->callee ? cx->fp->argv[-1] : JSVAL_NULL; + jsval original = JSVAL_NULL; + if (cx->fp->callee) { + original = cx->fp->argv[-1]; + if (!JSVAL_IS_PRIMITIVE(original) && + guardClass(JSVAL_TO_OBJECT(original), get(&cx->fp->argv[-1]), &js_WithClass, snapshot(MISMATCH_EXIT))) { + ABORT_TRACE("can't trace getThis on With object"); + } + } + JSObject* thisObj = js_ComputeThisForFrame(cx, cx->fp); if (!thisObj) ABORT_TRACE_ERROR("js_ComputeThisForName failed"); @@ -6766,9 +6774,6 @@ TraceRecorder::getThis(LIns*& this_ins) } this_ins = get(&thisv); - if (guardClass(JSVAL_TO_OBJECT(thisv), this_ins, &js_WithClass, snapshot(MISMATCH_EXIT))) - ABORT_TRACE("can't trace getThis on With object"); - /* * The only unwrapped object that needs to be wrapped that we can get here is the * global object obtained throught the scope chain.