Bug 1118911 - GetPcScript should care about bailout frames. r=jandem, a=sledru
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Thu, 15 Jan 2015 16:28:15 +0100
changeset 242892 66f61f3f9664
parent 242891 bc2de4c07f1b
child 242893 0f43b4df53bb
push id4330
push userryanvm@gmail.com
push date2015-01-16 15:19 +0000
treeherdermozilla-beta@0b7d9ce1cdc7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, sledru
bugs1118911
milestone36.0
Bug 1118911 - GetPcScript should care about bailout frames. r=jandem, a=sledru
js/src/jit-test/tests/ion/recover-lambdas-bug1118911.js
js/src/jit/JitFrames.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/recover-lambdas-bug1118911.js
@@ -0,0 +1,9 @@
+
+function test() {
+  function f()
+    k.apply(this, arguments);
+  if (undefined >> undefined !== 0) {}
+  for (var [ v , c ]  = 0 in this.tracemonkey) {  }
+}
+try { test(); } catch(exc1) {}
+try { test(); } catch(exc1) {}
--- a/js/src/jit/JitFrames.cpp
+++ b/js/src/jit/JitFrames.cpp
@@ -1552,20 +1552,21 @@ GetPcScript(JSContext *cx, JSScript **sc
             rt->ionPcScriptCache->clear(rt->gc.gcNumber());
     }
 
     // Attempt to lookup address in cache.
     if (rt->ionPcScriptCache && rt->ionPcScriptCache->get(rt, hash, retAddr, scriptRes, pcRes))
         return;
 
     // Lookup failed: undertake expensive process to recover the innermost inlined frame.
-    ++it; // Skip exit frame.
+    if (!it.isBailoutJS())
+        ++it; // Skip exit frame.
     jsbytecode *pc = nullptr;
 
-    if (it.isIonJS()) {
+    if (it.isIonJS() || it.isBailoutJS()) {
         InlineFrameIterator ifi(cx, &it);
         *scriptRes = ifi.script();
         pc = ifi.pc();
     } else {
         MOZ_ASSERT(it.isBaselineJS());
         it.baselineScriptAndPc(scriptRes, &pc);
     }