From 2dbeb42afff509b3b639cf34d734f0561a35d059 Mon Sep 17 00:00:00 2001
From: David Mandelin <dmandelin@mozilla.com>
Date: Wed, 26 May 2010 13:50:01 -0700
Subject: [PATCH] Fix regression from 426b1244fbf6. rval needs to be set for
 the ending primtive conversion block to work correctly.

---
 js/src/jsops.cpp | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/js/src/jsops.cpp b/js/src/jsops.cpp
index 3258d5f9ee3..aafee9d2add 100644
--- a/js/src/jsops.cpp
+++ b/js/src/jsops.cpp
@@ -1773,9 +1773,7 @@ BEGIN_CASE(JSOP_CALLPROP)
     if (!atom) {
         ASSERT_VALID_PROPERTY_CACHE_HIT(0, aobj, obj2, entry);
         if (entry->vword.isFunObj()) {
-            regs.sp[-1].setFunObj(entry->vword.toFunObj());
-            PUSH_COPY(lval);
-            goto end_callprop;
+            rval.setFunObj(entry->vword.toFunObj());
         } else if (entry->vword.isSlot()) {
             uint32 slot = entry->vword.toSlot();
             JS_ASSERT(slot < obj2->scope()->freeslot);