Bug 676343 - Lexical scoping bug involving UPVAR_LEVEL_LIMIT. r=brendan.

js/src/jsemit.cpp

@@ -2358,7 +2358,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
          */
         if (op != JSOP_NAME)
             return JS_TRUE;
-        if (level >= UpvarCookie::UPVAR_LEVEL_LIMIT)
+        if (skip >= UpvarCookie::UPVAR_LEVEL_LIMIT)
             return JS_TRUE;
         if (cg->flags & TCF_FUN_HEAVYWEIGHT)
             return JS_TRUE;

js/src/jsinterp.cpp

@@ -1436,7 +1436,6 @@ js::GetUpvar(JSContext *cx, uintN closureLevel, UpvarCookie cookie)
 {
     JS_ASSERT(closureLevel >= cookie.level() && cookie.level() > 0);
     const uintN targetLevel = closureLevel - cookie.level();
-    JS_ASSERT(targetLevel < UpvarCookie::UPVAR_LEVEL_LIMIT);
 
     StackFrame *fp = FindUpvarFrame(cx, targetLevel);
     uintN slot = cookie.slot();

js/src/tests/js1_8_5/regress/jstests.list

@@ -111,6 +111,7 @@ script regress-665355.js
 script regress-666599.js
 script regress-667047.js
 script regress-672892.js
+script regress-672893.js
 script regress-673070-1.js
 script regress-673070-2.js
 script regress-673070-3.js

js/src/tests/js1_8_5/regress/regress-672893.js

@@ -0,0 +1,18 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+function f() {
+    return function () { return function () { return function () {
+    return function () { return function () { return function () {
+    return function () { return function () { return function () {
+    return function () { return function () { return function () {
+    return function () { return function () { return function (a) {
+        var v = a;
+	assertEq(v, 42);
+	return function() { return v; };
+    }; }; }; }; }; }; }; }; }; }; }; }; }; }; };
+};
+
+assertEq(f()()()()()()()()()()()()()()()(42)(), 42);
+
+reportCompare(0, 0, 'ok');