Bug 555246 - Wrong answer for 'this' in function code when entry frame was produced by a call across globals. r=brendan.

js/src/jsops.cpp

@@ -2751,7 +2751,7 @@ BEGIN_CASE(JSOP_CALLGVAR)
     rval = obj->getSlotMT(cx, slot);
     PUSH_OPND(rval);
     if (op == JSOP_CALLGVAR)
-        PUSH_OPND(OBJECT_TO_JSVAL(obj));
+        PUSH_OPND(JSVAL_NULL);
 END_CASE(JSOP_GETGVAR)
 
 BEGIN_CASE(JSOP_SETGVAR)

js/src/tests/js1_8_5/regress/jstests.list

@@ -8,3 +8,5 @@ script regress-541255-3.js
 script regress-541255-4.js
 script regress-541455.js
 script regress-546615.js
+script regress-555246-0.js
+fails script regress-555246-1.js

js/src/tests/js1_8_5/regress/regress-555246-0.js

@@ -0,0 +1,11 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+var cx = evalcx("");
+evalcx("function f() { return this; }", cx);
+var f = cx.f;
+assertEq(f(), cx);
+reportCompare(0, 0, "");

js/src/tests/js1_8_5/regress/regress-555246-1.js

@@ -0,0 +1,11 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+var cx = evalcx("");
+evalcx("function f() { return this; }", cx);
+f = cx.f;
+assertEq(f(), cx);
+reportCompare(0, 0, "");