614915 - [undefined].sort() returns sort function

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Consider this:
---
js> [undefined].sort()
function sort() {[native code]}
---
IIRC, this happens when a function does not set its return value.

Comment 1

[Jan de Mooij [:jandem]]

Seems to be caused by this:
---
if (newlen == 0)
    return true; /* The array has only holes and undefs. */
---
This happens for all arrays with only holes and undefined.

Comment 2

[David Mandelin [:dmandelin]]

Attachment: Patch

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

Comment on attachment 493855 [details] [diff] [review]
Patch

(In reply to comment #0)
> IIRC, this happens when a function does not set its return value.

Yes, because the callee is placed in vp[0] on invocation, which is also where the return value is placed. (Somewhat surprisingly, if you do JS_SET_RVAL in a fast native you can no longer rely on the return value of JS_CALLEE, so you can't think of JS_[SET_]RVAL as a general storage mechanism.)

Comment 4

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/tracemonkey/rev/67dd268276f3

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/67dd268276f3