if (cx->options & JSOPTION_VAROBJFIX) {
if (!(special & JSFRAME_VAROBJBUG)) {
js_Execute(JSContext *cx, JSObject *chain, JSScript *script,           JSStackFrame *down, uintN special, jsval *result){    JSStackFrame *oldfp, frame;    JSObject *obj, *tmp;    JSBool ok;    JSInterpreterHook hook;    void *hookData;    hook = cx->runtime->executeHook;    hookData = NULL;    oldfp = cx->fp;    frame.callobj = frame.argsobj = NULL;    frame.script = script;    if (down) {        /* Propagate arg/var state for eval and the debugger API. */        frame.varobj = down->varobj;        frame.fun = down->fun;        frame.thisp = down->thisp;        frame.argc = down->argc;        frame.argv = down->argv;        frame.nvars = down->nvars;        frame.vars = down->vars;        frame.annotation = down->annotation;        frame.sharpArray = down->sharpArray;    } else {        obj = chain;        if (cx->options & JSOPTION_VAROBJFIX) {            while ((tmp = OBJ_GET_PARENT(cx, obj)) != NULL)                obj = tmp;        }        frame.varobj = obj;        frame.fun = NULL;        frame.thisp = chain;        frame.argc = frame.nvars = 0;        frame.argv = frame.vars = NULL;        frame.annotation = NULL;        frame.sharpArray = NULL;    }    frame.rval = JSVAL_VOID;    frame.down = down;    frame.scopeChain = chain;    frame.pc = NULL;    frame.sp = oldfp ? oldfp->sp : NULL;    frame.spbase = frame.sp;    frame.sharpDepth = 0;    frame.constructing = JS_FALSE;    frame.overrides = 0;    frame.special = (uint8) special;    frame.dormantNext = NULL;    /*     * Here we wrap the call to js_Interpret with code to (conditionally)     * save and restore the old stack frame chain into a chain of 'dormant'     * frame chains.  Since we are replacing cx->fp, we were running into     * the problem that if GC was called under this frame, some of the GC     * things associated with the old frame chain (available here only in     * the C variable 'oldfp') were not rooted and were being collected.     *     * So, now we preserve the links to these 'dormant' frame chains in cx     * before calling js_Interpret and cleanup afterwards.  The GC walks     * these dormant chains and marks objects in the same way that it marks     * objects in the primary cx->fp chain.     */    if (oldfp && oldfp != down) {        JS_ASSERT(!oldfp->dormantNext);        oldfp->dormantNext = cx->dormantFrameChain;        cx->dormantFrameChain = oldfp;    }    cx->fp = &frame;    if (hook)        hookData = hook(cx, &frame, JS_TRUE, 0, cx->runtime->executeHookData);    ok = js_Interpret(cx, result);    if (hook && hookData)        hook(cx, &frame, JS_FALSE, &ok, hookData);    cx->fp = oldfp;    if (oldfp && oldfp != down) {        JS_ASSERT(cx->dormantFrameChain == oldfp);        cx->dormantFrameChain = oldfp->dormantNext;        oldfp->dormantNext = NULL;    }    return ok;}