jscript: Don't assume that ret value is cleared when it's not set explicitly.

dlls/jscript/compile.c

@@ -1479,7 +1479,7 @@ static HRESULT compile_return_statement(compiler_ctx_t *ctx, expression_statemen
     if(FAILED(hres))
         return hres;
 
-    return push_instr(ctx, OP_ret) ? S_OK : E_OUTOFMEMORY;
+    return push_instr_uint(ctx, OP_ret, !stat->expr);
 }
 
 /* ECMA-262 3rd Edition    12.10 */
@@ -1857,8 +1857,9 @@ static HRESULT compile_function(compiler_ctx_t *ctx, source_elements_t *source,
 
     resolve_labels(ctx, off);
 
-    if(!push_instr(ctx, OP_ret))
-        return E_OUTOFMEMORY;
+    hres = push_instr_uint(ctx, OP_ret, !from_eval);
+    if(FAILED(hres))
+        return hres;
 
     if(TRACE_ON(jscript_disas))
         dump_code(ctx, off);

dlls/jscript/engine.c

@@ -194,6 +194,13 @@ static inline IDispatch *stack_topn_objid(script_ctx_t *ctx, unsigned n, DISPID
     return get_object(stack_topn(ctx, n+1));
 }
 
+static inline jsval_t steal_ret(call_frame_t *frame)
+{
+    jsval_t r = frame->ret;
+    frame->ret = jsval_undefined();
+    return r;
+}
+
 static void exprval_release(exprval_t *val)
 {
     switch(val->type) {
@@ -2323,8 +2330,14 @@ static HRESULT interp_pop(script_ctx_t *ctx)
 
 static HRESULT interp_ret(script_ctx_t *ctx)
 {
+    const unsigned clear_ret = get_op_uint(ctx, 0);
+    call_frame_t *frame = ctx->call_ctx;
+
     TRACE("\n");
 
+    if(clear_ret)
+        jsval_release(steal_ret(frame));
+
     jmp_abs(ctx, -1);
     return S_OK;
 }
@@ -2457,10 +2470,8 @@ static HRESULT enter_bytecode(script_ctx_t *ctx, function_code_t *func, jsval_t
     assert(frame->scope == frame->base_scope);
     ctx->call_ctx = frame->prev_frame;
 
-    if(SUCCEEDED(hres)) {
-        *ret = frame->ret;
-        frame->ret = jsval_undefined();
-    }
+    if(SUCCEEDED(hres))
+        *ret = steal_ret(frame);
 
     release_call_frame(frame);
     return hres;