From 0c504c31ce9662b0bba91efe8aecd3171324bef3 Mon Sep 17 00:00:00 2001
From: Jason Orendorff <jorendorff@mozilla.com>
Date: Thu, 1 Sep 2011 11:31:09 -0500
Subject: [PATCH] Bug 676343 - Lexical scoping bug involving UPVAR_LEVEL_LIMIT.
 r=brendan.

---
 js/src/jsemit.cpp                              |  2 +-
 js/src/jsinterp.cpp                            |  1 -
 js/src/tests/js1_8_5/regress/jstests.list      |  1 +
 js/src/tests/js1_8_5/regress/regress-672893.js | 18 ++++++++++++++++++
 4 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 js/src/tests/js1_8_5/regress/regress-672893.js

diff --git a/js/src/jsemit.cpp b/js/src/jsemit.cpp
index 07586e9a6bb0..765746429d27 100644
--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -2358,7 +2358,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          */
         if (op != JSOP_NAME)
             return JS_TRUE;
-        if (level >= UpvarCookie::UPVAR_LEVEL_LIMIT)
+        if (skip >= UpvarCookie::UPVAR_LEVEL_LIMIT)
             return JS_TRUE;
         if (cg->flags & TCF_FUN_HEAVYWEIGHT)
             return JS_TRUE;
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index b3fd3701ea4a..1a8e04a1b5bf 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1436,7 +1436,6 @@ js::GetUpvar(JSContext *cx, uintN closureLevel, UpvarCookie cookie)
 {
     JS_ASSERT(closureLevel >= cookie.level() && cookie.level() > 0);
     const uintN targetLevel = closureLevel - cookie.level();
-    JS_ASSERT(targetLevel < UpvarCookie::UPVAR_LEVEL_LIMIT);
 
     StackFrame *fp = FindUpvarFrame(cx, targetLevel);
     uintN slot = cookie.slot();
diff --git a/js/src/tests/js1_8_5/regress/jstests.list b/js/src/tests/js1_8_5/regress/jstests.list
index 001dd9cdad5a..c5f6576319f7 100644
--- a/js/src/tests/js1_8_5/regress/jstests.list
+++ b/js/src/tests/js1_8_5/regress/jstests.list
@@ -111,6 +111,7 @@ script regress-665355.js
 script regress-666599.js
 script regress-667047.js
 script regress-672892.js
+script regress-672893.js
 script regress-673070-1.js
 script regress-673070-2.js
 script regress-673070-3.js
diff --git a/js/src/tests/js1_8_5/regress/regress-672893.js b/js/src/tests/js1_8_5/regress/regress-672893.js
new file mode 100644
index 000000000000..497b6132f02f
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/regress-672893.js
@@ -0,0 +1,18 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+function f() {
+    return function () { return function () { return function () {
+    return function () { return function () { return function () {
+    return function () { return function () { return function () {
+    return function () { return function () { return function () {
+    return function () { return function () { return function (a) {
+        var v = a;
+	assertEq(v, 42);
+	return function() { return v; };
+    }; }; }; }; }; }; }; }; }; }; }; }; }; }; };
+};
+
+assertEq(f()()()()()()()()()()()()()()()(42)(), 42);
+
+reportCompare(0, 0, 'ok');