Backout bug 420426 due to regressions

js/src/jsinterp.c

@@ -4202,13 +4202,10 @@ interrupt:
                     : !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
                     goto error;
                 }
-
-                /* Assert that we can avoid calling ComputeThis. */
-                JS_ASSERT(OBJ_GET_CLASS(cx, obj) != &js_CallClass);
-                JS_ASSERT(!obj->map->ops->thisObject);
-
                 STORE_OPND(-1, OBJECT_TO_JSVAL(obj));
                 STORE_OPND(-2, rval);
+                if (!ComputeThis(cx, JS_FALSE, sp))
+                    goto error;
             } else {
                 JS_ASSERT(obj->map->ops->getProperty == js_GetProperty);
                 if (!js_GetPropertyHelper(cx, obj, id, &rval, &entry))
@@ -4891,8 +4888,12 @@ interrupt:
 
           do_push_rval:
             PUSH_OPND(rval);
-            if (op == JSOP_CALLNAME)
+            if (op == JSOP_CALLNAME) {
                 PUSH_OPND(OBJECT_TO_JSVAL(obj));
+                SAVE_SP(fp);
+                if (!ComputeThis(cx, JS_FALSE, sp))
+                    goto error;
+            }
           }
           END_CASE(JSOP_NAME)
 
@@ -5088,12 +5089,6 @@ interrupt:
                 if (!obj)
                     goto error;
                 fp->thisp = obj;
-            } else {
-                /* |this| must be an outer object by definition. */
-                OBJ_TO_OUTER_OBJECT(cx, obj);
-                if (!obj)
-                    goto error;
-                fp->thisp = obj;
             }
             PUSH_OPND(OBJECT_TO_JSVAL(obj));
           END_CASE(JSOP_THIS)
@@ -6321,8 +6316,10 @@ interrupt:
                 goto error;
             STORE_OPND(-1, rval);
             if (op == JSOP_CALLXMLNAME) {
-                JS_ASSERT(OBJECT_IS_XML(cx, obj));
                 PUSH_OPND(OBJECT_TO_JSVAL(obj));
+                SAVE_SP(fp);
+                if (!ComputeThis(cx, JS_FALSE, sp))
+                    goto error;
             }
           END_CASE(JSOP_XMLNAME)