Correctly hook up materialized receiver into the evaluation context chain.

R=ulan@chromium.org
BUG=chromium:491943
LOG=Y

Review URL: https://codereview.chromium.org/1157993002

Cr-Commit-Position: refs/heads/master@{#28628}

src/runtime/runtime-debug.cc

@@ -2500,18 +2500,21 @@ class EvaluationContextBuilder {
     outer_info_ = handle(function->shared());
     Handle<Context> inner_context;
 
-    // The "this" binding, if any, can't be bound via "with".  If we need to,
-    // add another node onto the outer context to bind "this".
-    if (!MaterializeReceiver(isolate, outer_context, function, frame)
-             .ToHandle(&outer_context))
-      return;
-
     bool stop = false;
     for (ScopeIterator it(isolate, frame, inlined_jsframe_index);
          !it.Failed() && !it.Done() && !stop; it.Next()) {
       ScopeIterator::ScopeType scope_type = it.Type();
 
       if (scope_type == ScopeIterator::ScopeTypeLocal) {
+        Handle<Context> parent_context =
+            it.HasContext() ? it.CurrentContext() : outer_context;
+
+        // The "this" binding, if any, can't be bound via "with".  If we need
+        // to, add another node onto the outer context to bind "this".
+        if (!MaterializeReceiver(isolate, parent_context, function, frame)
+                 .ToHandle(&parent_context))
+          return;
+
         Handle<JSObject> materialized_function =
             NewJSObjectWithNullProto(isolate);
 
@@ -2525,8 +2528,6 @@ class EvaluationContextBuilder {
                  .ToHandle(&materialized_function))
           return;
 
-        Handle<Context> parent_context =
-            it.HasContext() ? it.CurrentContext() : outer_context;
         Handle<Context> with_context = isolate->factory()->NewWithContext(
             function, parent_context, materialized_function);
 

test/mjsunit/mjsunit.status

@@ -118,6 +118,7 @@
   'regress/regress-crbug-107996': [PASS, NO_VARIANTS],
   'regress/regress-crbug-171715': [PASS, NO_VARIANTS],
   'regress/regress-crbug-222893': [PASS, NO_VARIANTS],
+  'regress/regress-crbug-491943': [PASS, NO_VARIANTS],
   'regress/regress-325676': [PASS, NO_VARIANTS],
   'debug-evaluate-closure': [PASS, NO_VARIANTS],
   'debug-evaluate-with': [PASS, NO_VARIANTS],

test/mjsunit/regress/regress-crbug-491943.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+var receiver = null;
+
+Debug.setListener(function(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  receiver = exec_state.frame(0).evaluate('this').value();
+});
+
+
+function f() {
+  var context_local = 1;
+  (function() { return context_local; })();
+  debugger;
+}
+
+var expected = {};
+f.call(expected);
+
+assertEquals(expected, receiver);