Bug 769987 - don't forget to ExpandInlineFrames before discarding jit code (r=bhackett)
authorLuke Wagner <luke@mozilla.com>
Wed, 04 Jul 2012 10:39:48 -0700
changeset 98332 07b1a599943049c581f6bb058af482201f96a38d
parent 98331 28d73863a62ef4e79de84cef766c6bd5a650bf56
child 98333 de7ab39f550dc28ff2613452244a28208ed7d135
push id23043
push userryanvm@gmail.com
push dateWed, 04 Jul 2012 23:22:35 +0000
treeherdermozilla-central@555989fb3764 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs769987
milestone16.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 769987 - don't forget to ExpandInlineFrames before discarding jit code (r=bhackett)
js/src/jit-test/tests/basic/testBug769987.js
js/src/jsscript.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug769987.js
@@ -0,0 +1,13 @@
+function h(code) {
+  f = Function(code);
+  g()
+}
+function g() {
+  f()
+}
+h()
+h()
+h("\
+  arguments[\"0\"];\
+  gc();\
+")
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -2188,16 +2188,17 @@ JSScript::argumentsOptimizationFailed(JS
             /* Note: 'arguments' may have already been overwritten. */
             if (fp->unaliasedLocal(var).isMagic(JS_OPTIMIZED_ARGUMENTS))
                 fp->unaliasedLocal(var) = ObjectValue(*argsobj);
         }
     }
 
 #ifdef JS_METHODJIT
     if (script->hasJITInfo()) {
+        mjit::ExpandInlineFrames(cx->compartment);
         mjit::Recompiler::clearStackReferences(cx->runtime->defaultFreeOp(), script);
         mjit::ReleaseScriptCode(cx->runtime->defaultFreeOp(), script);
     }
 #endif
 
     if (script->hasAnalysis() && script->analysis()->ranInference()) {
         types::AutoEnterTypeInference enter(cx);
         types::TypeScript::MonitorUnknown(cx, script, script->argumentsBytecode());