Bug 1133530 - Check for Unwound_IonAccessorIC when advancing past fake exit frames. (r=jandem)
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1133530.js
@@ -0,0 +1,18 @@
+// |jit-test| error: InternalError
+x = {};
+y = x;
+if (x !== y) {}
+Object.defineProperty(this, "x", {
+ get: function() {
+ Object.defineProperty(this, "y", {
+ get: function() {
+ return Proxy(this.y)
+ }
+ });
+ }
+})
+x;
+g = newGlobal();
+g.parent = this
+g.eval("Debugger(parent).onExceptionUnwind=(function(){})")
+y;
--- a/js/src/jit/JitFrames-inl.h
+++ b/js/src/jit/JitFrames-inl.h
@@ -50,16 +50,17 @@ JitFrameIterator::prevType() const
inline bool
JitFrameIterator::isFakeExitFrame() const
{
bool res = (prevType() == JitFrame_Unwound_Rectifier ||
prevType() == JitFrame_Unwound_IonJS ||
prevType() == JitFrame_Unwound_BaselineJS ||
prevType() == JitFrame_Unwound_BaselineStub ||
+ prevType() == JitFrame_Unwound_IonAccessorIC ||
(prevType() == JitFrame_Entry && type() == JitFrame_Exit));
MOZ_ASSERT_IF(res, type() == JitFrame_Exit || type() == JitFrame_BaselineJS);
return res;
}
inline ExitFrameLayout *
JitFrameIterator::exitFrame() const
{