A simple fix of issue http://code.google.com/p/chromium/issues/detail?id=3285...

src/builtins-ia32.cc

Index: src/builtins-ia32.cc
===================================================================
--- src/builtins-ia32.cc	(revision 1658)
+++ src/builtins-ia32.cc	(working copy)
@@ -54,9 +54,16 @@
   //  -- edi: constructor function
   // -----------------------------------
 
+  Label non_function_call;
+  // Check that function is not a Smi.
+  __ test(edi, Immediate(kSmiTagMask));
+  __ j(zero, &non_function_call);
+  // Check that function is a JSFunction
+  __ CmpObjectType(edi, JS_FUNCTION_TYPE, ecx);
+  __ j(not_equal, &non_function_call);
+
   // Enter a construct frame.
   __ EnterConstructFrame();
-
   // Store a smi-tagged arguments count on the stack.
   __ shl(eax, kSmiTagSize);
   __ push(eax);
@@ -73,12 +80,6 @@
         ExternalReference::debug_step_in_fp_address();
     __ cmp(Operand::StaticVariable(debug_step_in_fp), Immediate(0));
     __ j(not_equal, &rt_call);
-    // Check that function is not a Smi.
-    __ test(edi, Immediate(kSmiTagMask));
-    __ j(zero, &rt_call);
-    // Check that function is a JSFunction
-    __ CmpObjectType(edi, JS_FUNCTION_TYPE, eax);
-    __ j(not_equal, &rt_call);
 
     // Verified that the constructor is a JSFunction.
     // Load the initial map and verify that it is in fact a map.
@@ -300,6 +301,15 @@
   __ lea(esp, Operand(esp, ebx, times_2, 1 * kPointerSize));  // 1 ~ receiver
   __ push(ecx);
   __ ret(0);
+
+  // edi: called object
+  // eax: number of arguments
+  __ bind(&non_function_call);
+
+  __ xor_(ebx, Operand(ebx));

[Mads Ager (chromium), 2009/04/28 10:50:15]

Add a comment that this is setting the arguments count to zero?

[Kevin Millikin (Chromium), 2009/04/28 11:48:43]

Setting the expected number of arguments (not changing eax).  You can also write
Set(ebx, Immediate(0)).

+  __ GetBuiltinEntry(edx, Builtins::CALL_NON_FUNCTION);
+  __ jmp(Handle<Code>(builtin(ArgumentsAdaptorTrampoline)),
+    RelocInfo::CODE_TARGET);
 }