Status: Accepted
Owner: [email protected]
Labels: Type-Bug Priority-Critical
New issue 1650 by [email protected]: Constant function check inserted
for HApplyArguments deoptimizes into incorrect state
http://code.google.com/p/v8/issues/detail?id=1650
Test case:
function g(f) { return f.call.apply(f.bind, arguments); }
var x = new Object;
function t() { }
g(t, this);
g(t, this);
g(t, this);
%OptimizeFunctionOnNextCall(g);
var fake = { call: function () { }, bind: function () { } };
g(fake, this);
% ./shell --allow-natives-syntax --trace-deopt t.js
[bleeding_edge@9080]
**** DEOPT: g at bailout #4, address 0x0, frame size 8
[deoptimizing: begin 0x59f3924d g @4]
translating g => node=17, height=8
0xff949bd0: [top + 28] <- 0x59f38a6d ; [esp + 28]
0xff949bcc: [top + 24] <- 0x3300cd09 ; [esp + 24]
0xff949bc8: [top + 20] <- 0x50c97aa1 ; caller's pc
0xff949bc4: [top + 16] <- 0xff949be0 ; caller's fp
0xff949bc0: [top + 12] <- 0x3300d081 ; context
0xff949bbc: [top + 8] <- 0x59f3924d ; function
0xff949bb8: [top + 4] <- 0x552d60e1 <Odd Oddball> ; arguments object
0xff949bb4: [top + 0] <- 0x59f3949d ; edx
[deoptimizing: end 0x59f3924d g => node=17, pc=0x50cada42,
state=NO_REGISTERS, took 0.059 ms]
[removing optimized code for: g]
t.js:2: TypeError: Object #<Object> has no method 'apply'
function g(f) { return f.call.apply(f.bind, arguments); }
^
TypeError: Object #<Object> has no method 'apply'
at g (t.js:2:31)
at t.js:13:1
We create enviroment:
[arguments object, loaded bind function]
while nonopt code expects:
[arguments object, receiver for apply, loaded bind function]
so it uses arguments object as a receiver.
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
