Deep abort is not detected in JSOP_IN (500108, r=dvander).
authorAndreas Gal <gal@mozilla.com>
Fri, 26 Jun 2009 16:29:38 -0700
changeset 26058 6b3d980f794a7b61345ee145056e042d1d41d97c
parent 26057 f223409207c069b8da64aacf03c646889befaf68
child 26059 4c0647472a578150b9f5264810cd20bcacef1fd7
push id1766
push userrsayre@mozilla.com
push dateTue, 14 Jul 2009 16:58:08 +0000
reviewersdvander
bugs500108
milestone1.9.1.1pre
Deep abort is not detected in JSOP_IN (500108, r=dvander).
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -9731,16 +9731,18 @@ TraceRecorder::record_JSOP_IN()
 
     JSObject* obj2;
     JSProperty* prop;
     if (!OBJ_LOOKUP_PROPERTY(cx, obj, id, &obj2, &prop))
         ABORT_TRACE_ERROR("OBJ_LOOKUP_PROPERTY failed in JSOP_IN");
     bool cond = prop != NULL;
     if (prop)
         OBJ_DROP_PROPERTY(cx, obj2, prop);
+    if (wasDeepAborted())
+        ABORT_TRACE("deep abort from property lookup");
 
     /* The interpreter fuses comparisons and the following branch,
        so we have to do that here as well. */
     fuseIf(cx->fp->regs->pc + 1, cond, x);
 
     /* We update the stack after the guard. This is safe since
        the guard bails out at the comparison and the interpreter
        will therefore re-execute the comparison. This way the