Bug 963077 - Bustage followup on a CLOSED TREE. r=jandem
authorTill Schneidereit <till@tillschneidereit.net>
Fri, 24 Jan 2014 20:18:52 +0100
changeset 181104 d319f9ddf227f214bff261fe81fd1638379ade32
parent 181103 376538c22d1f0ebec730c51bc9158533091fdcdf
child 181105 fdc82b2c5584323dfd7deaaa0601e596d6725578
push id3343
push userffxbld
push dateMon, 17 Mar 2014 21:55:32 +0000
treeherdermozilla-beta@2f7d3415f79f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs963077
milestone29.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 963077 - Bustage followup on a CLOSED TREE. r=jandem
js/src/jsfun.cpp
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1050,20 +1050,23 @@ js_fun_apply(JSContext *cx, unsigned arg
 
         if (!args.init(length))
             return false;
 
         /* Push fval, obj, and aobj's elements as args. */
         args.setCallee(fval);
         args.setThis(vp[2]);
 
+        // Make sure the function is delazified before querying its arguments.
+        if (args.callee().is<JSFunction>()) {
+            JSFunction *fun = &args.callee().as<JSFunction>();
+            if (fun->isInterpreted() && !fun->getOrCreateScript(cx))
+                return false;
+        }
         /* Steps 7-8. */
-        JSFunction *fun = &args.callee().as<JSFunction>();
-        if (fun->isInterpreted() && !fun->getOrCreateScript(cx))
-            return false;
         if (!GetElements(cx, aobj, length, args.array()))
             return false;
     }
 
     /* Step 9. */
     if (!Invoke(cx, args))
         return false;