Source code
Revision control
Copy as Markdown
Other Tools
// |jit-test| error: TypeError
// Bailout from a stack with multiple ion frames of different flavors.
function f(obj,b,c) {
return obj(); // Throw error.
}
function g(f,obj) {
return f(obj); // Call f() with insufficient arguments, generating a RectifierFrame.
}
function h(f, g, obj) {
return g(f, obj); // EntryFrame. Generate a JSFrame.
}
f(); // Prime f().
g(); // Prime g().
var obj = new Object();
h(f,g,obj);