722669 - IonMonkey: function.caller is not always correct

Status: RESOLVED DUPLICATE of bug 732853

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Reduced from tests/jaeger/getter-hook-2.js:
--
function foo() {
    for (var i = 0; i < 100; i++) { }
    return foo.caller;
}
assertEq(foo(), null);
--
$ ./js --ion -n test.js
test.js:6: Error: Assertion failed: got function foo() {for (var i = 0; i < 100; i++) {}return foo.caller;}, expected null

The GETPROP (foo.caller) runs in the interpreter. At this point there are two frames for foo on the stack, so js_GetScriptedCaller returns |foo| itself instead of its caller.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

This bug brings up a larger issue that JS_GetScriptedCaller and JS_FrameIterator are utterly incompatible with IonMonkey. We'll have to remove those API calls.