Set DELEGATE for parents of other objects, bug 700300.

js/src/jit-test/tests/basic/bug700300.js

@@ -0,0 +1,4 @@
+for (let j = 0; j < (20); ++(__lookupSetter__)) {
+  function g() { j; }
+  j++;
+}

js/src/jsfun.cpp

@@ -718,7 +718,8 @@ NewDeclEnvObject(JSContext *cx, StackFrame *fp)
     envobj->initialize(emptyDeclEnvShape, type, NULL);
     envobj->setPrivate(fp);
 
-    envobj->setScopeChain(&fp->scopeChain());
+    if (!envobj->setScopeChain(cx, &fp->scopeChain()))
+        return NULL;
 
     return envobj;
 }

js/src/jsinterp.cpp

@@ -357,10 +357,12 @@ GetScopeChainFull(JSContext *cx, StackFrame *fp, JSObject *blockChain)
         if (!clone)
             return NULL;
 
-        newChild->setScopeChain(clone);
+        if (!newChild->setScopeChain(cx, clone))
+            return NULL;
         newChild = clone;
     }
-    newChild->setScopeChain(&fp->scopeChain());
+    if (!newChild->setScopeChain(cx, &fp->scopeChain()))
+        return NULL;
 
 
     /*

js/src/jsobj.cpp

@@ -3604,7 +3604,8 @@ js_NewWithObject(JSContext *cx, JSObject *proto, JSObject *parent, jsint depth)
     obj->initialize(emptyWithShape, type, NULL);
     OBJ_SET_BLOCK_DEPTH(cx, obj, depth);
 
-    obj->setScopeChain(parent);
+    if (!obj->setScopeChain(cx, parent))
+        return NULL;
     obj->setPrivate(priv);
 
     AutoObjectRooter tvr(cx, obj);
@@ -4236,7 +4237,7 @@ js_XDRBlockObject(JSXDRState *xdr, JSObject **objp)
          */
         if (parentId != NO_PARENT_INDEX) {
             parent = xdr->script->getObject(parentId);
-            obj->setScopeChain(parent);
+            obj->setStaticBlockScopeChain(parent);
         }
     }
 

js/src/jsobj.h

@@ -854,7 +854,7 @@ struct JSObject : js::gc::Cell
      */
     inline bool isScope() const;
     inline JSObject *scopeChain() const;
-    inline void setScopeChain(JSObject *obj);
+    inline bool setScopeChain(JSContext *cx, JSObject *obj);
 
     static inline size_t offsetOfScopeChain();
 

js/src/jsobjinlines.h

@@ -328,11 +328,14 @@ JSObject::getParentMaybeScope() const
     return lastProperty()->getObjectParent();
 }
 
-inline void
-JSObject::setScopeChain(JSObject *obj)
+inline bool
+JSObject::setScopeChain(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(isScope());
+    if (!obj->setDelegate(cx))
+        return false;
     setFixedSlot(0, JS::ObjectValue(*obj));
+    return true;
 }
 
 /*static*/ inline size_t

js/src/jsscope.cpp

@@ -1141,6 +1141,9 @@ JSObject::clearParent(JSContext *cx)
 bool
 JSObject::setParent(JSContext *cx, JSObject *parent)
 {
+    if (parent && !parent->setDelegate(cx))
+        return false;
+
     if (inDictionaryMode()) {
         lastProperty()->base()->setParent(parent);
         return true;

js/src/vm/CallObject.cpp

@@ -96,7 +96,8 @@ CallObject::create(JSContext *cx, JSScript *script, JSObject &scopeChain, JSObje
     JS_ASSERT(obj->isCall());
     JS_ASSERT(!obj->inDictionaryMode());
 
-    obj->setScopeChain(&scopeChain);
+    if (!obj->setScopeChain(cx, &scopeChain))
+        return NULL;
 
     /*
      * If |bindings| is for a function that has extensible parents, that means