LibJS: Evaluate CallExpression arguments before pushing a CallFrame

Libraries/LibJS/AST.cpp

@@ -101,16 +101,20 @@ Value CallExpression::execute(Interpreter& interpreter) const
 
     auto& function = static_cast<Function&>(callee.as_object());
 
-    auto& call_frame = interpreter.push_call_frame();
+    Vector<Value> arguments;
+    arguments.ensure_capacity(m_arguments.size());
     for (size_t i = 0; i < m_arguments.size(); ++i) {
         auto value = m_arguments[i].execute(interpreter);
         if (interpreter.exception())
             return {};
-        call_frame.arguments.append(value);
+        arguments.append(value);
         if (interpreter.exception())
             return {};
     }
 
+    auto& call_frame = interpreter.push_call_frame();
+    call_frame.arguments = move(arguments);
+
     Object* new_object = nullptr;
     Value result;
     if (is_new_expression()) {

Libraries/LibJS/Tests/function-this-in-arguments.js

@@ -0,0 +1,17 @@
+function assert(x) { if (!x) throw 1; }
+
+try {
+  assert(typeof this === "object");
+  assert(this === global);
+
+  function Foo() {
+    this.x = 5;
+    assert(typeof this === "object");
+    assert(this.x === 5);
+  }
+
+  new Foo();
+  console.log("PASS");
+} catch (err) {
+  console.log("FAIL: " + err);
+}