Bug 963077 - Bustage followup on a CLOSED TREE. r=jandem
authorTill Schneidereit <till@tillschneidereit.net>
Fri, 24 Jan 2014 20:18:52 +0100
changeset 165094 d319f9ddf227f214bff261fe81fd1638379ade32
parent 165093 376538c22d1f0ebec730c51bc9158533091fdcdf
child 165095 fdc82b2c5584323dfd7deaaa0601e596d6725578
push id26074
push userryanvm@gmail.com
push dateFri, 24 Jan 2014 21:51:09 +0000
treeherdermozilla-central@fdc82b2c5584 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs963077
milestone29.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 963077 - Bustage followup on a CLOSED TREE. r=jandem
js/src/jsfun.cpp
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1050,20 +1050,23 @@ js_fun_apply(JSContext *cx, unsigned arg
 
         if (!args.init(length))
             return false;
 
         /* Push fval, obj, and aobj's elements as args. */
         args.setCallee(fval);
         args.setThis(vp[2]);
 
+        // Make sure the function is delazified before querying its arguments.
+        if (args.callee().is<JSFunction>()) {
+            JSFunction *fun = &args.callee().as<JSFunction>();
+            if (fun->isInterpreted() && !fun->getOrCreateScript(cx))
+                return false;
+        }
         /* Steps 7-8. */
-        JSFunction *fun = &args.callee().as<JSFunction>();
-        if (fun->isInterpreted() && !fun->getOrCreateScript(cx))
-            return false;
         if (!GetElements(cx, aobj, length, args.array()))
             return false;
     }
 
     /* Step 9. */
     if (!Invoke(cx, args))
         return false;