Bug 469621 - Protect the new scope object from garbage collection. r=crowder
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1306,16 +1306,17 @@ obj_eval(JSContext *cx, JSObject *obj, u
goto out;
scopeobj = js_NewWithObject(cx, scopeobj,
JS_GetGlobalForObject(cx, scopeobj), -1);
if (!scopeobj) {
ok = JS_FALSE;
goto out;
}
+ argv[1] = OBJECT_TO_JSVAL(scopeobj);
}
/* Ensure we compile this eval with the right object in the scope chain. */
scopeobj = js_CheckScopeChainValidity(cx, scopeobj, js_eval_str);
if (!scopeobj) {
ok = JS_FALSE;
goto out;
}