Fixed emitTreeCall crashing on deep aborts (
bug 472508, r=gal).
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -3587,18 +3587,19 @@ js_RecordLoopEdge(JSContext* cx, TraceRe
}
}
return js_RecordTree(cx, tm, f, old, globalShape, globalSlots);
}
r->prepareTreeCall(f);
VMSideExit* innermostNestedGuard = NULL;
VMSideExit* lr = js_ExecuteTree(cx, f, inlineCallCount, &innermostNestedGuard);
- if (!lr) {
- js_AbortRecording(cx, "Couldn't call inner tree");
+ if (!lr || r->wasDeepAborted()) {
+ if (!lr)
+ js_AbortRecording(cx, "Couldn't call inner tree");
return false;
}
Fragment* old;
switch (lr->exitType) {
case LOOP_EXIT:
/* If the inner tree exited on an unknown loop exit, grow the tree around it. */
if (innermostNestedGuard) {
js_AbortRecording(cx, "Inner tree took different side exit, abort recording");