Bug 432275: Regression - Java applets crashing browser [@ obj_eval], patch by mrbkap, r=crowder, a=beltzner

js/src/liveconnect/nsCLiveconnect.cpp

@@ -107,6 +107,7 @@ private:
     nsCOMPtr<nsIJSContextStack> mContextStack;
     JSContext*                  mContext;
     JSStackFrame                mFrame;
+    JSFrameRegs                 mRegs;
     nsresult                    mPushResult;
 };
 
@@ -185,11 +186,16 @@ AutoPushJSContext::AutoPushJSContext(nsISupports* aSecuritySupports,
 
             if (fun)
             {
+                JSScript *script = JS_GetFunctionScript(cx, fun);
                 mFrame.fun = fun;
-                mFrame.script = JS_GetFunctionScript(cx, fun);
+                mFrame.script = script;
                 mFrame.callee = JS_GetFunctionObject(fun);
                 mFrame.scopeChain = JS_GetParent(cx, mFrame.callee);
                 mFrame.down = cx->fp;
+                mRegs.pc = script->code + script->length
+                           - JSOP_STOP_LENGTH;
+                mRegs.sp = NULL;
+                mFrame.regs = &mRegs;
                 cx->fp = &mFrame;
             }
             else