Bug 728190 - Update stack later in Arguments (r=bhackett)

js/src/jit-test/tests/basic/bug728190.js

@@ -0,0 +1,23 @@
+
+function TestCase(n, d, e, a) {}
+var lfcode = new Array();
+lfcode.push("");
+lfcode.push("\
+  var summary = 'foo';\
+  test();\
+  function test() {\
+    test(\"TEST-UNEXPECTED-FAIL | TestPerf | \" + summary);\
+  }\
+");
+lfcode.push("gczeal(2);");
+lfcode.push("\
+  new TestCase(TestFunction_3( \"P\", \"A\", \"S\", \"S\" ) +\"\");\
+  new TestCase(TestFunction_4( \"F\", \"A\", (\"length\"), \"L\" ) +\"\");\
+  function TestFunction_3( a, b, c, d, e ) {\
+    TestFunction_3(arguments);\
+  }\
+");
+while (true) {
+        var file = lfcode.shift(); if (file == undefined) { break; }
+        try { evaluate(file); } catch (lfVare) {}
+}

js/src/methodjit/StubCalls.cpp

@@ -1363,9 +1363,10 @@ stubs::FlatLambda(VMFrame &f, JSFunction *fun)
 void JS_FASTCALL
 stubs::Arguments(VMFrame &f)
 {
-    f.regs.sp++;
-    if (!js_GetArgsValue(f.cx, f.fp(), &f.regs.sp[-1]))
+    Value argsobj;
+    if (!js_GetArgsValue(f.cx, f.fp(), &argsobj))
         THROW();
+    f.regs.sp[0] = argsobj;
 }
 
 JSBool JS_FASTCALL