827153 - IonMonkey: the restored |this| in an inlined call could be wrong

Status: RESOLVED DUPLICATE of bug 835178

(Core :: JavaScript Engine, defect)

Description

[Hannes Verschore [:h4writer]]

The resumepoint taken before doing the inlined call has the old |this| value. The real |this| value only gets created after the resumepoint. For use in bailout this is correct, but to get the arguments in an inlined funapply function, we will get the wrong value, because there we want the new |this| value.

Because the arguments vector doesn't return the |this| value we are actually lucky. There is no way to get the wrong value. But

1) we should add an assert, that it doesn't get abused later on
2) we could also use the old way to retrieve all normal arguments and the resumepoint to get the overflown arguments. Because |this| is always set, this will always be correct.

For reference: "the new way" has been introduced in bug 813784, IonFrameIterator-inl.h

Comment 1

[Hannes Verschore [:h4writer]]

Will get resolved in bug 835178 in the way described here. This is needed to allow inlining of JSOP_SETARG