X-Git-Url: http://git.webkit.org/?p=WebKit-https.git;a=blobdiff_plain;f=JavaScriptCore%2Finterpreter%2FInterpreter.cpp;h=e93cd3fa41a1ed44f38ca09189fe03b4fce95f80;hp=5caffc38a54b342221d7c365f04d60de80b65e24;hb=d019ec96d99e5a42fe71235eee0e6de837028bee;hpb=811f75fbff10077ae6ef301ab31052d3e657ea5d

diff --git a/JavaScriptCore/interpreter/Interpreter.cpp b/JavaScriptCore/interpreter/Interpreter.cpp
index 5caffc3..e93cd3f 100644
--- a/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/JavaScriptCore/interpreter/Interpreter.cpp
@@ -3639,13 +3639,15 @@ JSValue* Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerF
         /* push_scope scope(r)
 
            Converts register scope to object, and pushes it onto the top
-           of the current scope chain.
+           of the current scope chain.  The contents of the register scope
+           are replaced by the result of toObject conversion of the scope.
         */
         int scope = (++vPC)->u.operand;
         JSValue* v = callFrame[scope].jsValue(callFrame);
         JSObject* o = v->toObject(callFrame);
         CHECK_FOR_EXCEPTION();
 
+        callFrame[scope] = o;
         callFrame->setScopeChain(callFrame->scopeChain()->push(o));
 
         ++vPC;
@@ -5738,13 +5740,14 @@ JSValue* Interpreter::cti_op_next_pname(STUB_ARGS)
     return temp;
 }
 
-void Interpreter::cti_op_push_scope(STUB_ARGS)
+JSObject* Interpreter::cti_op_push_scope(STUB_ARGS)
 {
     BEGIN_STUB_FUNCTION();
 
     JSObject* o = ARG_src1->toObject(ARG_callFrame);
-    CHECK_FOR_EXCEPTION_VOID();
+    CHECK_FOR_EXCEPTION();
     ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->push(o));
+    return o;
 }
 
 void Interpreter::cti_op_pop_scope(STUB_ARGS)