654536 - TI+JM: incorrect result with function.call

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    var x = Object.prototype.hasOwnProperty.call(1);
    assertEq(x, false);
    isNaN(2);
}
f();
--
$ ./js -n -m -a test.js
test.js:3: Error: Assertion failed: got function call() {[native code]}, expected false

Revision 3147f81224c8, 32-bit OS X.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

The hasOwnProperty.call(1) triggers recompilation of f (initialization of Number). We need to use the special rejoin path also for ic::NativeCall to load the return value correctly in case of lowered call/apply and a native function.

Comment 2

[Brian Hackett [Laid off!]]

Comment on attachment 530373 [details] [diff] [review]
Patch

I think that NativeCall/New need to have the same ABI as Call/New: return the code pointer to jump to or NULL (in this case, always NULL), so after the rejoin we don't interpret the maybe random value of eax as the return code pointer.  r+ with that fixed.

Comment 3

[Brian Hackett [Laid off!]]

Comment on attachment 530373 [details] [diff] [review]
Patch

I think that NativeCall/New need to have the same ABI as Call/New: return the code pointer to jump to or NULL (in this case, always NULL), so after the rejoin we don't interpret the maybe random value of eax as the return code pointer.  r+ with that fixed.

Comment 4

[Brian Hackett [Laid off!]]

Comment on attachment 530373 [details] [diff] [review]
Patch

I think that NativeCall/New need to have the same ABI as Call/New: return the code pointer to jump to or NULL (in this case, always NULL), so after the rejoin we don't interpret the maybe random value of eax as the return code pointer.  r+ with that fixed.

Comment 5

[Brian Hackett [Laid off!]]

Comment on attachment 530373 [details] [diff] [review]
Patch

I think that NativeCall/New need to have the same ABI as Call/New: return the code pointer to jump to or NULL (in this case, always NULL), so after the rejoin we don't interpret the maybe random value of eax as the return code pointer.  r+ with that fixed.

Comment 6

[Brian Hackett [Laid off!]]

Hilarious.

Comment 7

[Jan de Mooij [:jandem]]

Oops that was embarrassing, shouldn't submit patches when I'm in a hurry.

http://hg.mozilla.org/projects/jaegermonkey/rev/8436c7bca2e9