diff --git a/js/src/jit-test/tests/basic/bug642422.js b/js/src/jit-test/tests/basic/bug642422.js new file mode 100644 index 000000000000..bb9cfea83ae5 --- /dev/null +++ b/js/src/jit-test/tests/basic/bug642422.js @@ -0,0 +1,4 @@ +gczeal(2); +var x; +var foo = "for (var z = 0; z < 2; ++z) { new Object(new String(this), x)}"; +eval(foo); diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp index 265593320436..294ade1c0eed 100644 --- a/js/src/jsobj.cpp +++ b/js/src/jsobj.cpp @@ -1284,7 +1284,6 @@ EvalKernel(JSContext *cx, uintN argc, Value *vp, EvalType evalType, JSStackFrame linearStr, staticLevel); if (!script) return false; - script->isCachedEval = true; } assertSameCompartment(cx, scopeobj, script); @@ -1300,6 +1299,7 @@ EvalKernel(JSContext *cx, uintN argc, Value *vp, EvalType evalType, JSStackFrame MUST_FLOW_LABEL(destroy); js_CallDestroyScriptHook(cx, script); + script->isCachedEval = true; script->u.nextToGC = *bucket; *bucket = script; #ifdef CHECK_SCRIPT_OWNER diff --git a/js/src/jsparse.cpp b/js/src/jsparse.cpp index de0984d4c64a..8b09666474d8 100644 --- a/js/src/jsparse.cpp +++ b/js/src/jsparse.cpp @@ -1125,8 +1125,6 @@ Compiler::compileScript(JSContext *cx, JSObject *scopeChain, JSStackFrame *calle script = JSScript::NewScriptFromCG(cx, &cg); if (script && funbox) script->savedCallerFun = true; - if (script && cg.compilingForEval()) - script->isCachedEval = true; #ifdef JS_SCOPE_DEPTH_METER if (script) {