Bug 611276 - JSOP_CALLEE should push undefined, not null, for this. r=jimb

js/src/jsemit.cpp

@@ -2797,7 +2797,7 @@ EmitNameOp(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
     if (op == JSOP_ARGUMENTS || op == JSOP_CALLEE) {
         if (js_Emit1(cx, cg, op) < 0)
             return JS_FALSE;
-        if (callContext && js_Emit1(cx, cg, JSOP_NULL) < 0)
+        if (callContext && js_Emit1(cx, cg, JSOP_PUSH) < 0)
             return JS_FALSE;
     } else {
         if (!pn->pn_cookie.isFree()) {

js/src/tests/ecma_5/strict/jstests.list

@@ -36,3 +36,4 @@ script primitive-this-no-writeback.js
 script regress-532254.js
 script regress-532041.js
 script unbrand-this.js
+script this-for-function-expression-recursion.js

js/src/tests/ecma_5/strict/this-for-function-expression-recursion.js

@@ -0,0 +1,44 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var gTestfile = 'this-for-function-expression-recursion.js';
+var BUGNUMBER = 611276;
+var summary = "JSOP_CALLEE should push undefined, not null, for this";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+// Calling a named function expression (not function statement) uses the
+// JSOP_CALLEE opcode.  This opcode pushes its own |this|, distinct from the
+// normal call path; verify that that |this| value is properly |undefined|.
+
+var calleeThisFun =
+  function calleeThisFun(recurring)
+  {
+    if (recurring)
+      return this;
+    return calleeThisFun(true);
+  };
+assertEq(calleeThisFun(false), this);
+
+var calleeThisStrictFun =
+  function calleeThisStrictFun(recurring)
+  {
+    "use strict";
+    if (recurring)
+      return this;
+    return calleeThisStrictFun(true);
+  };
+assertEq(calleeThisStrictFun(false), undefined);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("All tests passed!");