Bug 1118911 - GetPcScript should care about bailout frames. r=jandem, a=sledru
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Thu, 15 Jan 2015 16:28:15 +0100
changeset 249239 bcf64fae59bd6526505a926e8813b6a43768d6b2
parent 249238 374a9adf2786a4fa8480767f88442761be859d82
child 249240 55a3f5fc46e1759d7c494a639831ea74a28b4dbf
push id4489
push userraliiev@mozilla.com
push dateMon, 23 Feb 2015 15:17:55 +0000
treeherdermozilla-beta@fd7c3dc24146 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, sledru
bugs1118911
milestone37.0a2
Bug 1118911 - GetPcScript should care about bailout frames. r=jandem, a=sledru
js/src/jit-test/tests/ion/recover-lambdas-bug1118911.js
js/src/jit/JitFrames.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/recover-lambdas-bug1118911.js
@@ -0,0 +1,9 @@
+
+function test() {
+  function f()
+    k.apply(this, arguments);
+  if (undefined >> undefined !== 0) {}
+  for (var [ v , c ]  = 0 in this.tracemonkey) {  }
+}
+try { test(); } catch(exc1) {}
+try { test(); } catch(exc1) {}
--- a/js/src/jit/JitFrames.cpp
+++ b/js/src/jit/JitFrames.cpp
@@ -1490,20 +1490,21 @@ GetPcScript(JSContext *cx, JSScript **sc
             rt->ionPcScriptCache->clear(rt->gc.gcNumber());
     }
 
     // Attempt to lookup address in cache.
     if (rt->ionPcScriptCache && rt->ionPcScriptCache->get(rt, hash, retAddr, scriptRes, pcRes))
         return;
 
     // Lookup failed: undertake expensive process to recover the innermost inlined frame.
-    ++it; // Skip exit frame.
+    if (!it.isBailoutJS())
+        ++it; // Skip exit frame.
     jsbytecode *pc = nullptr;
 
-    if (it.isIonJS()) {
+    if (it.isIonJS() || it.isBailoutJS()) {
         InlineFrameIterator ifi(cx, &it);
         *scriptRes = ifi.script();
         pc = ifi.pc();
     } else {
         MOZ_ASSERT(it.isBaselineJS());
         it.baselineScriptAndPc(scriptRes, &pc);
     }