Bug 520511 - Add some tvrs. r=brendan

js/src/jsobj.cpp

@@ -1253,6 +1253,7 @@ obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 #if JS_HAS_EVAL_THIS_SCOPE
     JSObject *callerScopeChain = NULL, *callerVarObj = NULL;
     JSBool setCallerScopeChain = JS_FALSE, setCallerVarObj = JS_FALSE;
+    JSTempValueRooter scopetvr, varobjtvr;
 #endif
 
     fp = js_GetTopStackFrame(cx);
@@ -1357,12 +1358,14 @@ obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 
             /* Remember scopeobj so we can null its private when done. */
             setCallerScopeChain = JS_TRUE;
+            JS_PUSH_TEMP_ROOT_OBJECT(cx, callerScopeChain, &scopetvr);
 
             callerVarObj = caller->varobj;
             if (obj != callerVarObj) {
                 /* Set fp->varobj too, for the compiler. */
                 caller->varobj = fp->varobj = obj;
                 setCallerVarObj = JS_TRUE;
+                JS_PUSH_TEMP_ROOT_OBJECT(cx, callerVarObj, &varobjtvr);
             }
         }
 #endif
@@ -1516,10 +1519,14 @@ obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 out:
 #if JS_HAS_EVAL_THIS_SCOPE
     /* Restore OBJ_GET_PARENT(scopeobj) not callerScopeChain in case of Call. */
-    if (setCallerScopeChain)
-        caller->scopeChain = callerScopeChain;
-    if (setCallerVarObj)
+    if (setCallerVarObj) {
         caller->varobj = callerVarObj;
+        JS_POP_TEMP_ROOT(cx, &varobjtvr);
+    }
+    if (setCallerScopeChain) {
+        caller->scopeChain = callerScopeChain;
+        JS_POP_TEMP_ROOT(cx, &scopetvr);
+    }
 #endif
     return ok;
 }