Last Comment Bug 651119 - TI: Mochitest-2 prototype test failures
: TI: Mochitest-2 prototype test failures
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: 619433
  Show dependency treegraph
Reported: 2011-04-19 07:04 PDT by Jan de Mooij [:jandem]
Modified: 2011-04-19 23:01 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Testcase (1.34 KB, application/x-javascript)
2011-04-19 07:04 PDT, Jan de Mooij [:jandem]
no flags Details

Description User image Jan de Mooij [:jandem] 2011-04-19 07:04:47 PDT
Created attachment 526979 [details]

See attachment for a shell test case.
$ ./js -n -m test.js
test.js:49: TypeError: result[0].join is not a function
Regression from

The in returns the call function at some point so the return value is not set.
Comment 1 User image Brian Hackett (:bhackett) 2011-04-19 11:42:16 PDT

*** This bug has been marked as a duplicate of bug 642772 ***
Comment 2 User image Brian Hackett (:bhackett) 2011-04-19 11:42:43 PDT
Oops, wrong bug.
Comment 3 User image Brian Hackett (:bhackett) 2011-04-19 23:01:04 PDT
Tricky call path corner case.  The slow paths in lowered call/apply calls store their return value in the wrong place (the address of the 'this' value, not the callee) and the rejoin code in the call path has to be special cased.  The corresponding part of the rejoin path emitted for calls did not do this special casing, so if we recompiled while handling a call/apply we would reload the original or Function.apply as the return value.

Note You need to log in before you can comment on or make changes to this bug.