1618357 - Function#arguments gets a spurious array from rest parameter

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[Claude Pache]

function f(x, ...y) {
     console.log(f.arguments[0]); // 'a'
     console.log(f.arguments[1]); // [ 'b', 'c' ]  WAT?
     console.log(f.arguments[2]); // 'c'
}

f('a', 'b', 'c')

Note that the bug plagues f.arguments but not arguments.

Comment 1

[Tooru Fujisawa [:arai]]

setting to P1 given bug 1615704 is also P1

Comment 2

[André Bargull [:anba]]

This seems to happen because CopyScriptFrameIterArgs is using JSFunction::nargs() to compute the number of formal parameters, but doesn't account for the rest parameter which is part of JSFunction::nargs().

Taking because I'm currently working on other arguments related bugs.

Comment 3

[André Bargull [:anba]]

I've misjudged the cause of this issue and resolving the actual underlying issue requires more effort than estimated, therefore I'm unassigning myself from this bug for now.

dis(function(x, ...y){}) clearly shows why f.arguments[1] contains the rest-parameter:

flags: LAMBDA CONSTRUCTOR
loc     op
-----   --
main:
00000:  Rest                            # REST
00001:  SetArg 1                        # REST
00004:  Pop                             # 
00005:  RetRval                         #

SetArg 1 clobbers the second parameter with the rest-parameter array.