Closed Bug 614915 Opened 9 years ago Closed 9 years ago

[undefined].sort() returns sort function

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- final+

People

(Reporter: jandem, Assigned: dmandelin)

References

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

Consider this:
---
js> [undefined].sort()
function sort() {[native code]}
---
IIRC, this happens when a function does not set its return value.
blocking2.0: --- → ?
Seems to be caused by this:
---
if (newlen == 0)
    return true; /* The array has only holes and undefs. */
---
This happens for all arrays with only holes and undefined.
blocking2.0: ? → final+
Assignee: general → dmandelin
Attached patch PatchSplinter Review
Attachment #493855 - Flags: review?(cdleary)
Comment on attachment 493855 [details] [diff] [review]
Patch

(In reply to comment #0)
> IIRC, this happens when a function does not set its return value.

Yes, because the callee is placed in vp[0] on invocation, which is also where the return value is placed. (Somewhat surprisingly, if you do JS_SET_RVAL in a fast native you can no longer rely on the return value of JS_CALLEE, so you can't think of JS_[SET_]RVAL as a general storage mechanism.)
Attachment #493855 - Flags: review?(cdleary) → review+
http://hg.mozilla.org/tracemonkey/rev/67dd268276f3
Status: NEW → ASSIGNED
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/67dd268276f3
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Duplicate of this bug: 619766
You need to log in before you can comment on or make changes to this bug.