Fix 316552, r=mrbkap.

js/src/jsdbgapi.c

@@ -365,26 +365,41 @@ js_watch_set(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
                  * stack-walking security code under the setter will correctly
                  * identify the guilty party.  So that the watcher appears to
                  * be active to obj_eval and other such code, point frame.pc
-                 * at the JSOP_STOP at the end of the function's script.
+                 * at the JSOP_STOP at the end of the script.
                  */
-                JSObject *funobj = (JSObject *) wp->closure;
-                JSFunction *fun = (JSFunction *) JS_GetPrivate(cx, funobj);
+                JSObject *closure;
+                JSClass *clasp;
+                JSFunction *fun;
+                JSScript *script;
                 jsval argv[2];
                 JSStackFrame frame;
 
-                argv[0] = OBJECT_TO_JSVAL(funobj);
+                closure = (JSObject *) wp->closure;
+                clasp = OBJ_GET_CLASS(cx, closure);
+                if (clasp == &js_FunctionClass) {
+                    fun = (JSFunction *) JS_GetPrivate(cx, closure);
+                    script = FUN_SCRIPT(fun);
+                } else if (clasp == &js_ScriptClass) {
+                    fun = NULL;
+                    script = (JSScript *) JS_GetPrivate(cx, closure);
+                } else {
+                    fun = NULL;
+                    script = NULL;
+                }
+                argv[0] = OBJECT_TO_JSVAL(closure);
                 argv[1] = JSVAL_NULL;
 
                 memset(&frame, 0, sizeof(frame));
-                frame.script = FUN_SCRIPT(fun);
-                frame.fun = fun;
-                frame.down = cx->fp;
-                if (frame.script) {
-                    JS_ASSERT(frame.script->length >= JSOP_STOP_LENGTH);
-                    frame.pc = frame.script->code + frame.script->length
+                frame.script = script;
+                if (script) {
+                    JS_ASSERT(script->length >= JSOP_STOP_LENGTH);
+                    frame.pc = script->code + script->length
                              - JSOP_STOP_LENGTH;
                 }
+                frame.fun = fun;
                 frame.argv = argv + 2;
+                frame.down = cx->fp;
+
                 cx->fp = &frame;
                 ok = !wp->setter ||
                      ((sprop->attrs & JSPROP_SETTER)
@@ -409,6 +424,7 @@ js_watch_set_wrapper(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
     jsval userid;
 
     funobj = JSVAL_TO_OBJECT(argv[-2]);
+    JS_ASSERT(OBJ_GET_CLASS(cx, funobj) == &js_FunctionClass);
     wrapper = (JSFunction *) JS_GetPrivate(cx, funobj);
     userid = ATOM_KEY(wrapper->atom);
     *rval = argv[0];
@@ -548,7 +564,6 @@ JS_SetWatchPoint(JSContext *cx, JSObject *obj, jsval id,
             JS_free(cx, wp);
             goto out;
         }
-        JS_APPEND_LINK(&wp->links, &rt->watchPointList);
         wp->object = obj;
         JS_ASSERT(sprop->setter != js_watch_set || pobj != obj);
         wp->setter = sprop->setter;
@@ -558,11 +573,16 @@ JS_SetWatchPoint(JSContext *cx, JSObject *obj, jsval id,
         sprop = js_ChangeNativePropertyAttrs(cx, obj, sprop, 0, sprop->attrs,
                                              sprop->getter, watcher);
         if (!sprop) {
+            /* Self-link wp->links so DropWatchPoint can JS_REMOVE_LINK it. */
+            JS_INIT_CLIST(&wp->links);
             DropWatchPoint(cx, wp);
             ok = JS_FALSE;
             goto out;
         }
         wp->sprop = sprop;
+
+        /* Now that wp is fully initialized, append it to rt's wp list. */
+        JS_APPEND_LINK(&wp->links, &rt->watchPointList);
     }
     wp->handler = handler;
     wp->closure = closure;

js/src/jsobj.c

@@ -1381,7 +1381,7 @@ static JSBool
 obj_watch_handler(JSContext *cx, JSObject *obj, jsval id, jsval old, jsval *nvp,
                   void *closure)
 {
-    JSObject *funobj;
+    JSObject *callable;
     JSRuntime *rt;
     JSStackFrame *caller;
     JSPrincipals *subject, *watcher;
@@ -1391,7 +1391,7 @@ obj_watch_handler(JSContext *cx, JSObject *obj, jsval id, jsval old, jsval *nvp,
     jsval argv[3];
     JSBool ok;
 
-    funobj = (JSObject *) closure;
+    callable = (JSObject *) closure;
 
     rt = cx->runtime;
     if (rt->findObjectPrincipals) {
@@ -1402,7 +1402,7 @@ obj_watch_handler(JSContext *cx, JSObject *obj, jsval id, jsval old, jsval *nvp,
              * Only call the watch handler if the watcher is allowed to watch
              * the currently executing script.
              */
-            watcher = rt->findObjectPrincipals(cx, funobj);
+            watcher = rt->findObjectPrincipals(cx, callable);
             subject = JS_StackFramePrincipals(cx, caller);
 
             if (watcher && subject && !watcher->subsume(watcher, subject)) {
@@ -1424,7 +1424,7 @@ obj_watch_handler(JSContext *cx, JSObject *obj, jsval id, jsval old, jsval *nvp,
     argv[0] = id;
     argv[1] = old;
     argv[2] = *nvp;
-    ok = js_InternalCall(cx, obj, OBJECT_TO_JSVAL(funobj), 3, argv, nvp);
+    ok = js_InternalCall(cx, obj, OBJECT_TO_JSVAL(callable), 3, argv, nvp);
     js_StopResolving(cx, &key, JSRESFLAG_WATCH, entry, generation);
     return ok;
 }