From 1fcc32bd91d1992eb5cc23a922931a8d7a6516a3 Mon Sep 17 00:00:00 2001
From: Blake Kaplan <mrbkap@gmail.com>
Date: Wed, 21 Oct 2009 11:46:07 -0700
Subject: [PATCH] Bug 520511 - Add some tvrs. r=brendan

---
 js/src/jsobj.cpp | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 0004959d2de9..55f01a34badd 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1253,6 +1253,7 @@ obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 #if JS_HAS_EVAL_THIS_SCOPE
     JSObject *callerScopeChain = NULL, *callerVarObj = NULL;
     JSBool setCallerScopeChain = JS_FALSE, setCallerVarObj = JS_FALSE;
+    JSTempValueRooter scopetvr, varobjtvr;
 #endif
 
     fp = js_GetTopStackFrame(cx);
@@ -1357,12 +1358,14 @@ obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 
             /* Remember scopeobj so we can null its private when done. */
             setCallerScopeChain = JS_TRUE;
+            JS_PUSH_TEMP_ROOT_OBJECT(cx, callerScopeChain, &scopetvr);
 
             callerVarObj = caller->varobj;
             if (obj != callerVarObj) {
                 /* Set fp->varobj too, for the compiler. */
                 caller->varobj = fp->varobj = obj;
                 setCallerVarObj = JS_TRUE;
+                JS_PUSH_TEMP_ROOT_OBJECT(cx, callerVarObj, &varobjtvr);
             }
         }
 #endif
@@ -1516,10 +1519,14 @@ obj_eval(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 out:
 #if JS_HAS_EVAL_THIS_SCOPE
     /* Restore OBJ_GET_PARENT(scopeobj) not callerScopeChain in case of Call. */
-    if (setCallerScopeChain)
-        caller->scopeChain = callerScopeChain;
-    if (setCallerVarObj)
+    if (setCallerVarObj) {
         caller->varobj = callerVarObj;
+        JS_POP_TEMP_ROOT(cx, &varobjtvr);
+    }
+    if (setCallerScopeChain) {
+        caller->scopeChain = callerScopeChain;
+        JS_POP_TEMP_ROOT(cx, &scopetvr);
+    }
 #endif
     return ok;
 }