diff --git a/js/src/jit-test/tests/basic/bug863084.js b/js/src/jit-test/tests/basic/bug863084.js new file mode 100644 index 000000000000..cdaad69cd33f --- /dev/null +++ b/js/src/jit-test/tests/basic/bug863084.js @@ -0,0 +1,17 @@ +// |jit-test| error: too much recursion +function f(code) { + try { + eval(code) + } catch (e) {} + eval(code) +} +f("\ + z=evalcx('');\ + gc();\ + z.toString=(function(){\ + v=evaluate(\"(Math.atan2(\\\"\\\",this))\",{\ + global:z,newContext:7,catchTermination:this\ + });\ + });\ + String(z)\ +") diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp index 3fa42b504c28..52017abc37d1 100644 --- a/js/src/shell/js.cpp +++ b/js/src/shell/js.cpp @@ -912,6 +912,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp) unsigned lineNumber = 1; RootedObject global(cx, NULL); bool catchTermination = false; + RootedObject callerGlobal(cx, cx->global()); global = JS_GetGlobalForObject(cx, &args.callee()); if (!global) @@ -1043,6 +1044,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp) } if (!JS_ExecuteScript(cx, global, script, vp)) { if (catchTermination && !JS_IsExceptionPending(cx)) { + JSAutoCompartment ac1(cx, callerGlobal); JSString *str = JS_NewStringCopyZ(cx, "terminated"); if (!str) return false;