509599 - Arguments objects are not populated when leaving a function on trace

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

function f(a) {
    x = arguments;
}
for (var i = 0; i < 9; i++)
    f(123);
assertEq(x[0], 123);

crasher.js:10: TypeError: Assertion failed: got (void 0), expected 123

In the interpreter, we call js_PutArgsObject when leaving a frame that has fp->argsobj (via JSStackFrame::putActivationObjects). On trace we need to do something like that too -- of course we know if there is an argsobj or not, so this is zero-cost in the fast case.

Comment 1

[David Mandelin [:dmandelin]]

Attachment: Patch for checker bug

I already had the right feature in there, I just made a wrong assumption about which opcodes do and don't get run on function return.

I'd like to add the test case after bug 505588, because then it's as simple as adding a new file and there are no nesting level change issues to worry about.

Comment 2

[Jason Orendorff [:jorendorff]]

Comment on attachment 393673 [details] [diff] [review]
Patch for checker bug

Looks good.

Comment 3

[Igor Bukanov]

To david:

This will badly conflict with the bug 495061. I hope that can be landed today. Could you use that bug as base?

Comment 4

[David Mandelin [:dmandelin]]

(In reply to comment #3)
> To david:
> 
> This will badly conflict with the bug 495061. I hope that can be landed today.
> Could you use that bug as base?

Yes, this fix is conceptually very easy so it should not be hard to rebase.

Comment 5

[David Mandelin [:dmandelin]]

Attachment: Rebased for igor's fix to the other bug

Comment 6

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/78d111c4ab84

Comment 7

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/a6b00f8b3a03