[JAEGER] Fixed assert-botch from
bug 586886.
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -855,16 +855,19 @@ RunTracer(VMFrame &f)
#if JS_MONOIC
if (blacklist)
DisableTraceHint(f, mic);
#endif
if ((tpa == TPA_RanStuff || tpa == TPA_Recorded) && cx->throwing)
tpa = TPA_Error;
+ /* Sync up the VMFrame's view of cx->fp. */
+ f.fp = cx->fp;
+
switch (tpa) {
case TPA_Nothing:
return NULL;
case TPA_Error:
if (!SwallowErrors(f, entryFrame))
THROWV(NULL);
JS_ASSERT(!cx->fp->imacpc);