Fix iteration of snapshot slots in closeLiveIterator (Bug 749048, r=dvander)
authorNicolas Pierron <nicolas.b.pierron@mozilla.com>
Mon, 30 Apr 2012 19:26:38 -0700
changeset 112434 5fcc03122569395f194d53f96fec95eca025e576
parent 112433 086958bf99e7d81fe86d19c968424a1be96edcf5
child 112435 ff4083f660ed00f8850c9e55e57cfbf8a2444c0f
push id1708
push userakeybl@mozilla.com
push dateMon, 19 Nov 2012 21:10:21 +0000
treeherdermozilla-beta@27b14fe50103 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs749048
milestone15.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Fix iteration of snapshot slots in closeLiveIterator (Bug 749048, r=dvander)
js/src/ion/IonFrames.cpp
--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -265,26 +265,25 @@ IonFrameIterator::machineState() const
             continue;
         machine.setRegisterLocation(reg, spillBase);
     }
 
     return machine;
 }
 
 static void
-CloseLiveIterator(JSContext *cx, const InlineFrameIterator &frame, uint32 stackSlot)
+CloseLiveIterator(JSContext *cx, const InlineFrameIterator &frame, uint32 localSlot)
 {
     SnapshotIterator si = frame.snapshotIterator();
 
-    // Skip stuff that comes before locals.
-    for (unsigned i = 0; i < CountArgSlots(frame.maybeCallee()); i++)
-        si.skip();
+    // Skip stack slots until we reach the iterator object.
+    uint32 base = CountArgSlots(frame.maybeCallee()) + frame.script()->nfixed;
+    uint32 skipSlots = base + localSlot - 1;
 
-    // Skip stack slots until we reach the iterator object.
-    for (unsigned i = 0; i < stackSlot; i++)
+    for (unsigned i = 0; i < skipSlots; i++)
         si.skip();
 
     Value v = si.read();
     JSObject *obj = &v.toObject();
 
     if (cx->isExceptionPending())
         UnwindIteratorForUncatchableException(cx, obj);
     else
@@ -299,26 +298,29 @@ CloseLiveIterators(JSContext *cx, const 
 
     if (!JSScript::isValidOffset(script->trynotesOffset))
         return;
 
     JSTryNote *tn = script->trynotes()->vector;
     JSTryNote *tnEnd = tn + script->trynotes()->length;
 
     for (; tn != tnEnd; ++tn) {
-        if (uint32(pc - script->code) - tn->start >= tn->length)
+        if (uint32(pc - script->code) < tn->start)
+            continue;
+        if (uint32(pc - script->code) >= tn->start + tn->length)
             continue;
 
         if (tn->kind != JSTRY_ITER)
             continue;
 
         JS_ASSERT(JSOp(*(script->code + tn->start + tn->length)) == JSOP_ENDITER);
         JS_ASSERT(tn->stackDepth > 0);
 
-        CloseLiveIterator(cx, frame, tn->stackDepth - 1);
+        uint32 localSlot = tn->stackDepth;
+        CloseLiveIterator(cx, frame, localSlot);
     }
 }
 
 void
 ion::HandleException(ResumeFromException *rfe)
 {
     JSContext *cx = GetIonContext()->cx;