Fix test failures, bug 693754.

caps/src/nsScriptSecurityManager.cpp

@@ -1735,7 +1735,7 @@ nsScriptSecurityManager::CheckFunctionAccess(JSContext *aCx, void *aFunObj,
 #ifdef DEBUG
         {
             JS_ASSERT(JS_ObjectIsFunction(aCx, (JSObject *)aFunObj));
-            JSFunction *fun = (JSFunction *)JS_GetPrivate(aCx, (JSObject *)aFunObj);
+            JSFunction *fun = JS_GetObjectFunction((JSObject *)aFunObj);
             JSScript *script = JS_GetFunctionScript(aCx, fun);
 
             NS_ASSERTION(!script, "Null principal for non-native function!");
@@ -2216,7 +2216,7 @@ nsScriptSecurityManager::GetFunctionObjectPrincipal(JSContext *cx,
         return result;
     }
 
-    JSFunction *fun = (JSFunction *)JS_GetPrivate(cx, obj);
+    JSFunction *fun = JS_GetObjectFunction(obj);
     JSScript *script = JS_GetFunctionScript(cx, fun);
 
     if (!script)
@@ -2240,7 +2240,7 @@ nsScriptSecurityManager::GetFunctionObjectPrincipal(JSContext *cx,
 
         script = frameScript;
     }
-    else if (JS_GetFunctionObject(fun) != obj)
+    else if (!JS_GetScriptPrincipals(cx, script))
     {
         // Here, obj is a cloned function object.  In this case, the
         // clone's prototype may have been precompiled from brutally
@@ -2282,7 +2282,7 @@ nsScriptSecurityManager::GetFramePrincipal(JSContext *cx,
 #ifdef DEBUG
     if (NS_SUCCEEDED(*rv) && !result)
     {
-        JSFunction *fun = (JSFunction *)JS_GetPrivate(cx, obj);
+        JSFunction *fun = JS_GetObjectFunction(obj);
         JSScript *script = JS_GetFunctionScript(cx, fun);
 
         NS_ASSERTION(!script, "Null principal for non-native function!");

js/src/jsdbgapi.cpp

@@ -681,7 +681,6 @@ JS_GetFrameFunctionObject(JSContext *cx, JSStackFrame *fpArg)
         return NULL;
 
     JS_ASSERT(fp->callee().isFunction());
-    JS_ASSERT(fp->callee().getPrivate() == fp->fun());
     return &fp->callee();
 }
 

js/src/jsgcmark.cpp

@@ -238,8 +238,6 @@ MarkTypeObject(JSTracer *trc, types::TypeObject *type, const char *name)
     if (IS_GC_MARKING_TRACER(trc)) {
         if (type->singleton)
             MarkObject(trc, *type->singleton, "type_singleton");
-        if (type->interpretedFunction)
-            MarkObject(trc, *type->interpretedFunction, "type_function");
     }
 }
 
@@ -916,12 +914,15 @@ ScanTypeObject(GCMarker *gcmarker, types::TypeObject *type)
         PushMarkStack(gcmarker, type->newScript->shape);
     }
 
+    if (type->interpretedFunction)
+        PushMarkStack(gcmarker, type->interpretedFunction);
+
     /*
-     * Don't need to trace singleton or functionScript, an object with this
-     * type must have already been traced and it will also hold a reference
-     * on the script (singleton and functionScript types cannot be the newType
-     * of another object). Attempts to mark type objects directly must use
-     * MarkTypeObject, which will itself mark these extra bits.
+     * Don't need to trace singleton, an object with this type must have
+     * already been traced and it will also hold a reference on the script
+     * (singleton and functionScript types cannot be the newType of another
+     * object). Attempts to mark type objects directly must use MarkTypeObject,
+     * which will itself mark these extra bits.
      */
 }
 

js/src/jsobj.cpp

@@ -3774,8 +3774,8 @@ struct JSObject::TradeGutsReserved {
     JSContext *cx;
     Vector<Value> avals;
     Vector<Value> bvals;
-    uint32 newafixed;
-    uint32 newbfixed;
+    int newafixed;
+    int newbfixed;
     Value *newaslots;
     Value *newbslots;
 
@@ -3845,6 +3845,9 @@ JSObject::ReserveForTradeGuts(JSContext *cx, JSObject *a, JSObject *b,
         reserved.newafixed--;
     }
 
+    JS_ASSERT(reserved.newafixed >= 0);
+    JS_ASSERT(reserved.newbfixed >= 0);
+
     /*
      * The newaslots/newbslots arrays hold any dynamic slots for the objects
      * if they do not have enough fixed slots to accomodate the slots in the

js/src/xpconnect/src/xpcquickstubs.cpp

@@ -548,7 +548,7 @@ GetMethodInfo(JSContext *cx, jsval *vp, const char **ifaceNamep, jsid *memberIdp
     JSObject *funobj = JSVAL_TO_OBJECT(JS_CALLEE(cx, vp));
     NS_ASSERTION(JS_ObjectIsFunction(cx, funobj),
                  "JSNative callee should be Function object");
-    JSString *str = JS_GetFunctionId((JSFunction *) JS_GetPrivate(cx, funobj));
+    JSString *str = JS_GetFunctionId(JS_GetObjectFunction(funobj));
     jsid methodId = str ? INTERNED_STRING_TO_JSID(cx, str) : JSID_VOID;
     GetMemberInfo(JSVAL_TO_OBJECT(vp[1]), methodId, ifaceNamep);
     *memberIdp = methodId;