We are currently failing jit-test/tests/basic/bug532823.js. It looks like NameOperation reaches for ContextStack::currentScriptedScopeChain() which is not up to date in Ion code. Not sure what the best fix is. Ideally, we'd pass our current scopeChain into CallGetName.

What does the stack for NameOperation look like? NAME calls from jitcode should go through js::GetScopeName which is passed the scope chain as a parameter and does not call NameOperation.

4983 js::GetScopeName(JSContext *cx, JSObject *obj, PropertyName *name, Value *vp) 4984 { 4985 JSObject *obj2; 4986 JSProperty *prop; 4987 if (!FindPropertyHelper(cx, name, true, false, &obj, &obj2, &prop)) 4988 return false; The problem is that FindPropertyHelper doesn't actually use |obj| as an inparam, it's just an outparam: scopeChain = cx->stack.currentScriptedScopeChain();

Oops, FindPropertyHelper should be changed to take the scope chain as an input. I guess it still needs the two outparams though, for the object on the scope chain and the actual holder (want to kill these opaque obj2 vars...).

Trunk patch to not get the scope chain from cx->stack. There are a couple exceptions where cx->currentScriptedScopeChain are still used --- XMLNAME and friends (these will run in the interp) and Object.watch, which does tests on the principals for some reason. The latter should be fixed in a followup (not involved with bug 701966).