Bug 908915 - Fix compartment mismatch in shell decompileThis and disassemble functions. r=efaust

--HG--
extra : rebase_source : e405a3b4ea30eba48dd7919eccdc71226d53dfe6

js/src/jit-test/tests/basic/bug908915.js

@@ -0,0 +1,24 @@
+// |jit-test| error: 42
+function f(y) {}
+for each(let e in newGlobal()) {
+    if (e.name === "quit" || e.name == "readline" || e.name == "terminate")
+	continue;
+    try {
+        e();
+    } catch (r) {}
+}
+(function() {
+    arguments.__proto__.__proto__ = newGlobal()
+    function f(y) {
+        y()
+    }
+    for each(b in []) {
+	if (b.name === "quit" || b.name == "readline" || b.name == "terminate")
+	    continue;
+        try {
+            f(b)
+        } catch (e) {}
+    }
+})();
+
+throw 42;

js/src/shell/js.cpp

@@ -1985,6 +1985,7 @@ DisassembleToSprinter(JSContext *cx, unsigned argc, jsval *vp, Sprinter *sprinte
         /* Without arguments, disassemble the current script. */
         RootedScript script(cx, GetTopScript(cx));
         if (script) {
+            JSAutoCompartment ac(cx, script);
             if (!js_Disassemble(cx, script, p.lines, sprinter))
                 return false;
             SrcNotes(cx, script, sprinter);
@@ -3767,11 +3768,16 @@ DecompileThisScript(JSContext *cx, unsigned argc, Value *vp)
         args.rval().setString(cx->runtime()->emptyString);
         return true;
     }
-    JSString *result = JS_DecompileScript(cx, script, "test", 0);
-    if (!result)
-        return false;
-    args.rval().setString(result);
-    return true;
+
+    {
+        JSAutoCompartment ac(cx, script);
+        JSString *result = JS_DecompileScript(cx, script, "test", 0);
+        if (!result)
+            return false;
+        args.rval().setString(result);
+    }
+
+    return JS_WrapValue(cx, vp);
 }
 
 static bool