diff --git a/js/src/jit-test/tests/basic/bug728190.js b/js/src/jit-test/tests/basic/bug728190.js new file mode 100644 index 00000000000..6ce7bbb0d5f --- /dev/null +++ b/js/src/jit-test/tests/basic/bug728190.js @@ -0,0 +1,23 @@ + +function TestCase(n, d, e, a) {} +var lfcode = new Array(); +lfcode.push(""); +lfcode.push("\ + var summary = 'foo';\ + test();\ + function test() {\ + test(\"TEST-UNEXPECTED-FAIL | TestPerf | \" + summary);\ + }\ +"); +lfcode.push("gczeal(2);"); +lfcode.push("\ + new TestCase(TestFunction_3( \"P\", \"A\", \"S\", \"S\" ) +\"\");\ + new TestCase(TestFunction_4( \"F\", \"A\", (\"length\"), \"L\" ) +\"\");\ + function TestFunction_3( a, b, c, d, e ) {\ + TestFunction_3(arguments);\ + }\ +"); +while (true) { + var file = lfcode.shift(); if (file == undefined) { break; } + try { evaluate(file); } catch (lfVare) {} +} diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp index 3645a642dca..7f5ed1c483c 100644 --- a/js/src/methodjit/StubCalls.cpp +++ b/js/src/methodjit/StubCalls.cpp @@ -1363,9 +1363,10 @@ stubs::FlatLambda(VMFrame &f, JSFunction *fun) void JS_FASTCALL stubs::Arguments(VMFrame &f) { - f.regs.sp++; - if (!js_GetArgsValue(f.cx, f.fp(), &f.regs.sp[-1])) + Value argsobj; + if (!js_GetArgsValue(f.cx, f.fp(), &argsobj)) THROW(); + f.regs.sp[0] = argsobj; } JSBool JS_FASTCALL