The default bug view has changed. See this FAQ.

TI+JM: incorrect result with function.call

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
--
function f() {
    var x = Object.prototype.hasOwnProperty.call(1);
    assertEq(x, false);
    isNaN(2);
}
f();
--
$ ./js -n -m -a test.js
test.js:3: Error: Assertion failed: got function call() {[native code]}, expected false

Revision 3147f81224c8, 32-bit OS X.
(Assignee)

Comment 1

6 years ago
Created attachment 530373 [details] [diff] [review]
Patch

The hasOwnProperty.call(1) triggers recompilation of f (initialization of Number). We need to use the special rejoin path also for ic::NativeCall to load the return value correctly in case of lowered call/apply and a native function.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #530373 - Flags: review?(bhackett1024)
Comment on attachment 530373 [details] [diff] [review]
Patch

I think that NativeCall/New need to have the same ABI as Call/New: return the code pointer to jump to or NULL (in this case, always NULL), so after the rejoin we don't interpret the maybe random value of eax as the return code pointer.  r+ with that fixed.
Attachment #530373 - Flags: review?(bhackett1024) → review+
Comment on attachment 530373 [details] [diff] [review]
Patch

I think that NativeCall/New need to have the same ABI as Call/New: return the code pointer to jump to or NULL (in this case, always NULL), so after the rejoin we don't interpret the maybe random value of eax as the return code pointer.  r+ with that fixed.
Comment on attachment 530373 [details] [diff] [review]
Patch

I think that NativeCall/New need to have the same ABI as Call/New: return the code pointer to jump to or NULL (in this case, always NULL), so after the rejoin we don't interpret the maybe random value of eax as the return code pointer.  r+ with that fixed.
Comment on attachment 530373 [details] [diff] [review]
Patch

I think that NativeCall/New need to have the same ABI as Call/New: return the code pointer to jump to or NULL (in this case, always NULL), so after the rejoin we don't interpret the maybe random value of eax as the return code pointer.  r+ with that fixed.
Hilarious.
(Assignee)

Comment 7

6 years ago
Oops that was embarrassing, shouldn't submit patches when I'm in a hurry.

http://hg.mozilla.org/projects/jaegermonkey/rev/8436c7bca2e9
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.