Bug 1133530 - Check for Unwound_IonAccessorIC when advancing past fake exit frames. (r=jandem)
authorShu-yu Guo <shu@rfrn.org>
Mon, 16 Feb 2015 15:06:23 -0800
changeset 229403 31b85d92b8e98f3055dfff8bf2dfcbab5d26cb97
parent 229402 5b4a18aeb5110de43ede59799ace4bd0186fe5ed
child 229404 4a21032847e085221212197cd4102ef42a857cca
push id11352
push userryanvm@gmail.com
push dateTue, 17 Feb 2015 19:29:37 +0000
treeherderfx-team@b6c56fab513d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1133530
milestone38.0a1
Bug 1133530 - Check for Unwound_IonAccessorIC when advancing past fake exit frames. (r=jandem)
js/src/jit-test/tests/ion/bug1133530.js
js/src/jit/JitFrames-inl.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1133530.js
@@ -0,0 +1,18 @@
+// |jit-test| error: InternalError
+x = {}; 
+y = x;
+if (x !== y) {}
+Object.defineProperty(this, "x", {
+    get: function() {
+    Object.defineProperty(this, "y", {
+        get: function() {
+        return Proxy(this.y)
+        }
+    });
+    }
+})
+x;
+g = newGlobal();
+g.parent = this
+g.eval("Debugger(parent).onExceptionUnwind=(function(){})")
+y; 
--- a/js/src/jit/JitFrames-inl.h
+++ b/js/src/jit/JitFrames-inl.h
@@ -50,16 +50,17 @@ JitFrameIterator::prevType() const
 
 inline bool
 JitFrameIterator::isFakeExitFrame() const
 {
     bool res = (prevType() == JitFrame_Unwound_Rectifier ||
                 prevType() == JitFrame_Unwound_IonJS ||
                 prevType() == JitFrame_Unwound_BaselineJS ||
                 prevType() == JitFrame_Unwound_BaselineStub ||
+                prevType() == JitFrame_Unwound_IonAccessorIC ||
                 (prevType() == JitFrame_Entry && type() == JitFrame_Exit));
     MOZ_ASSERT_IF(res, type() == JitFrame_Exit || type() == JitFrame_BaselineJS);
     return res;
 }
 
 inline ExitFrameLayout *
 JitFrameIterator::exitFrame() const
 {