Bug 1510684 - Advance iterator in maybeIonFrameRecovery, r=nbp.
authorBrian Hackett <bhackett1024@gmail.com>
Wed, 28 Nov 2018 10:02:07 -1000
changeset 505105 39441d1aaa1691da9a2356571f7421c0d2e7e94d
parent 505104 d321a6c5e0718dc0f8e26c567555ed296c751d9e
child 505106 4b16437f699949761edf056ff97c967bae28340e
push id10290
push userffxbld-merge
push dateMon, 03 Dec 2018 16:23:23 +0000
treeherdermozilla-beta@700bed2445e6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs1510684
milestone65.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1510684 - Advance iterator in maybeIonFrameRecovery, r=nbp.
js/src/jit-test/tests/ion/bug1510684.js
js/src/vm/Stack.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1510684.js
@@ -0,0 +1,38 @@
+var verified = false;
+function f(a) {
+    if (a < 10000)
+        return 5;
+    assertEq(g_fwd.caller.arguments.length, 0);
+    assertEq(h_fwd.caller.arguments.length, 0);
+    verified = true;
+    return 6;
+}
+
+function g_fwd(x) {
+    with({}) {};
+    return f(x);
+}
+function g(a) {
+    var x = a;
+    function inline() {
+        return g_fwd(x);
+    }
+    return inline();
+}
+
+function h_fwd(x) {
+    with({}) {};
+    return g(x);
+}
+function h(a) {
+    var x = a;
+    function inline() {
+        return h_fwd(x);
+    }
+    return inline();
+}
+
+var i = 0;
+while (!verified) {
+    h(i++);
+}
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -1830,17 +1830,17 @@ jit::JitActivation::registerIonFrameReco
     }
 
     return true;
 }
 
 jit::RInstructionResults*
 jit::JitActivation::maybeIonFrameRecovery(JitFrameLayout* fp)
 {
-    for (RInstructionResults* it = ionRecovery_.begin(); it != ionRecovery_.end(); ) {
+    for (RInstructionResults* it = ionRecovery_.begin(); it != ionRecovery_.end(); it++) {
         if (it->frame() == fp) {
             return it;
         }
     }
 
     return nullptr;
 }