Bug 1182373 - Don't constant-fold in the tag component of a tagged-template, because constant-folding evaluates the tag too early (and moght convert a value into a property reference, causing the wrong |this| to be passed). r=jorendorff

--HG--
extra : rebase_source : 84d79ac36b630fb3b328ecdf321728ef1dcf7efb

js/src/frontend/FoldConstants.cpp

@@ -653,7 +653,7 @@ Fold(ExclusiveContext* cx, ParseNode** pnp,
 
         // Don't fold a parenthesized call expression. See bug 537673.
         ParseNode** listp = &pn->pn_head;
-        if ((pn->isKind(PNK_CALL) || pn->isKind(PNK_NEW)) && (*listp)->isInParens())
+        if ((pn->isKind(PNK_CALL) || pn->isKind(PNK_TAGGED_TEMPLATE)) && (*listp)->isInParens())
             listp = &(*listp)->pn_next;
 
         for (; *listp; listp = &(*listp)->pn_next) {

js/src/tests/ecma_6/Expressions/tagged-template-constant-folding.js

@@ -0,0 +1,28 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 1182373;
+var summary =
+  "Don't let constant-folding in the MemberExpression part of a tagged " +
+  "template cause an incorrect |this| be passed to the callee";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var prop = "global";
+
+var obj = { prop: "obj", f: function() { return this.prop; } };
+
+assertEq(obj.f``, "obj");
+assertEq((true ? obj.f : null)``, "global");
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");