Created attachment 526979 [details]
See attachment for a shell test case.
$ ./js -n -m test.js
test.js:49: TypeError: result.join is not a function
Regression from http://hg.mozilla.org/projects/jaegermonkey/rev/3816e4abb158
The iterator.call(..) in Enumerable.map returns the call function at some point so the return value is not set.
*** This bug has been marked as a duplicate of bug 642772 ***
Oops, wrong bug.
Tricky call path corner case. The slow paths in lowered call/apply calls store their return value in the wrong place (the address of the 'this' value, not the callee) and the rejoin code in the call path has to be special cased. The corresponding part of the rejoin path emitted for calls did not do this special casing, so if we recompiled while handling a call/apply we would reload the original Function.call or Function.apply as the return value.