Bug 566549 - Crash [@ js_AllocSlot] or "Assertion failure: obj->map->ops->defineProperty == js_DefineProperty" with evalcx. r=brendan.

js/src/jsinterp.cpp

@@ -808,6 +808,8 @@ js_Execute(JSContext *cx, JSObject *const chain, JSScript *script,
                         ? chain->getGlobal()
                         : chain;
     }
+    JS_ASSERT(initialVarObj->map->ops->defineProperty == js_DefineProperty);
+
     fp->script = script;
     fp->imacpc = NULL;
     fp->rval = JSVAL_VOID;

js/src/shell/js.cpp

@@ -72,6 +72,7 @@
 #include "jsscope.h"
 #include "jsscript.h"
 #include "jstracer.h"
+#include "jsxml.h"
 
 #include "prmjtime.h"
 
@@ -2992,6 +2993,13 @@ EvalInContext(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
             ok = JS_FALSE;
             goto out;
         }
+        if (sobj->isArray() || sobj->isXML() || !sobj->isNative()) {
+            JS_TransferRequest(scx, cx);
+            JS_ReportError(cx, "Invalid scope argument to evalcx");
+            DestroyContext(scx, false);
+            return JS_FALSE;
+        }
+
         ok = JS_EvaluateUCScript(scx, sobj, src, srclen,
                                  fp->script->filename,
                                  JS_PCToLineNumber(cx, fp->script,

js/src/tests/js1_8_5/regress/jstests.list

@@ -19,3 +19,4 @@ script regress-560998-1.js
 script regress-560998-2.js
 script regress-563210.js
 script regress-563221.js
+script regress-566549.js

js/src/tests/js1_8_5/regress/regress-566549.js

@@ -0,0 +1,24 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+// Contributors: Jesse Ruderman <jruderman@gmail.com>,
+//               Gary Kwong <gary@rumblingedge.com>,
+//               Jason Orendorff <jorendorff@mozilla.com>
+
+try {
+    evalcx('var p;', []);
+} catch (exc) {}
+
+try {
+    evalcx('');
+    Function("evalcx(\"var p\",[])")();
+} catch (exc) {}
+
+try {
+    evalcx('var p;', <x/>);
+} catch (exc) {}
+
+try {
+    evalcx('var p;', <x><p/></x>);
+} catch (exc) {}
+
+reportCompare(0, 0, "ok");