Bug 1013056. r=shu, a=1.3+
authorDouglas Crosher <dtc-moz@scieneer.com>
Wed, 09 Jul 2014 10:57:20 +1000
changeset 171597 9365d44d678ead2b84c822fae5ac392f880ae8f7
parent 171596 601d27e413a936d32633cba67112287351a6fce2
child 171598 c072b84f2280a0e16530eb7261e1d54e98f8f5f1
push id579
push userryanvm@gmail.com
push dateWed, 09 Jul 2014 14:49:28 +0000
reviewersshu, 1
bugs1013056
milestone28.0
Bug 1013056. r=shu, a=1.3+
js/src/jit/IonCaches.cpp
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -383,23 +383,25 @@ void
 IonCache::attachStub(MacroAssembler &masm, StubAttacher &attacher, Handle<IonCode *> code)
 {
     JS_ASSERT(canAttachStub());
     incrementStubCount();
 
     // Update the success path to continue after the IC initial jump.
     attacher.patchRejoinJump(masm, code);
 
-    // Update the failure path.
-    attacher.patchNextStubJump(masm, code);
-
     // Replace the STUB_ADDR constant by the address of the generated stub, such
     // as it can be kept alive even if the cache is flushed (see
     // MarkIonExitFrame).
     attacher.patchStubCodePointer(masm, code);
+
+    // Update the failure path. Note it is this patch that makes the stub
+    // accessible for parallel ICs so it should not be moved unless you really
+    // know what is going on.
+    attacher.patchNextStubJump(masm, code);
 }
 
 bool
 IonCache::linkAndAttachStub(JSContext *cx, MacroAssembler &masm, StubAttacher &attacher,
                             IonScript *ion, const char *attachKind)
 {
     Rooted<IonCode *> code(cx);
     LinkStatus status = linkCode(cx, masm, ion, code.address());