[JAEGER] Fixed assert-botch from bug 586886.
authorDavid Anderson <danderson@mozilla.com>
Fri, 13 Aug 2010 17:43:50 -0700
changeset 53425 1adc07855872c54c586a2389993f9f0e5bb20c9a
parent 53424 2f0c145d6e5f9bdaf210c633f0b5730200cf74dd
child 53426 6502af9885d5dcfcf2389ef68aad724facbc553c
push idunknown
push userunknown
push dateunknown
bugs586886
milestone2.0b4pre
[JAEGER] Fixed assert-botch from bug 586886.
js/src/methodjit/InvokeHelpers.cpp
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -855,16 +855,19 @@ RunTracer(VMFrame &f)
 #if JS_MONOIC
     if (blacklist)
         DisableTraceHint(f, mic);
 #endif
 
     if ((tpa == TPA_RanStuff || tpa == TPA_Recorded) && cx->throwing)
         tpa = TPA_Error;
 
+	/* Sync up the VMFrame's view of cx->fp. */
+	f.fp = cx->fp;
+
     switch (tpa) {
       case TPA_Nothing:
         return NULL;
 
       case TPA_Error:
         if (!SwallowErrors(f, entryFrame))
             THROWV(NULL);
         JS_ASSERT(!cx->fp->imacpc);