660173 - TI: correctness bug with "return (x = arguments)"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
(function() {}).apply(null, (function() {
    var x;
    return (x = arguments);  
})());
--
This throws with -a -n:
typein:1: TypeError: second argument to Function.prototype.apply must be an array

Revision e62ab4bbe727, 32-bit OS X.

Comment 1

[Jan de Mooij [:jandem]]

A bit simpler maybe:
--
(function() {
    var x;
    var y = (x = arguments);
    assertEq(typeof y, "object");
})();
--
This asserts with -a -n:
Assertion failure: v.isBoolean(), at jsinterp.cpp:1251

Comment 2

[Brian Hackett [Laid off!]]

In the arguments escape analysis at SETLOCAL we would only follow uses of the variable being assigned to, not uses of the value pushed by the SETLOCAL.

http://hg.mozilla.org/projects/jaegermonkey/rev/e9b44ad197a5