From: Brendan Eich <brendan@mozilla.org>
Date: Wed, 8 Dec 2010 14:26:30 -0800
Subject: Fix MakeUpvarForEval vs. normal upvar bookkeeping (615657, r=dmandelin, a=dveditz).

---
 js/src/jsemit.cpp |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/js/src/jsemit.cpp b/js/src/jsemit.cpp
index 197b3d2..ad4d159 100644
--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -2203,10 +2203,9 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
             JS_ASSERT(index == cg->upvarList.count - 1);
 
             uint32 *vector = cg->upvarMap.vector;
-            if (!vector) {
-                uint32 length = cg->lexdeps.count;
-
-                vector = (uint32 *) calloc(length, sizeof *vector);
+            uint32 length = cg->lexdeps.count;
+            if (!vector || cg->upvarMap.length != length) {
+                vector = (uint32 *) realloc(vector, length * sizeof *vector);
                 if (!vector) {
                     JS_ReportOutOfMemory(cx);
                     return JS_FALSE;
@@ -2225,6 +2224,7 @@ BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
                     slot += tc->fun->nargs;
             }
 
+            JS_ASSERT(index < cg->upvarMap.length);
             vector[index] = MAKE_UPVAR_COOKIE(skip, slot);
         }
 
