Bug 1247832 - Adjust framePushed value in unboxed array baseline IC failure path, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Fri, 04 Mar 2016 16:09:44 -0700
changeset 325078 c8261cc6c396e27feba3efcb50bac20dc684c232
parent 325077 b6c044f6319540c2b939af5d986583c2ec14f8fd
child 325079 deadb414ee23f17f25b5adb90e0caa497263b7bd
push id1128
push userjlund@mozilla.com
push dateWed, 01 Jun 2016 01:31:59 +0000
treeherdermozilla-release@fe0d30de989d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1247832
milestone47.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1247832 - Adjust framePushed value in unboxed array baseline IC failure path, r=jandem.
js/src/jit/BaselineIC.cpp
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -3098,16 +3098,18 @@ ICSetElemDenseOrUnboxedArrayAddCompiler:
                      scratchReg);
         masm.branchTestObjShape(Assembler::NotEqual, obj, scratchReg, &failure);
     }
 
     // Stow both R0 and R1 (object and key)
     // But R0 and R1 still hold their values.
     EmitStowICValues(masm, 2);
 
+    uint32_t framePushedAfterStow = masm.framePushed();
+
     // We may need to free up some registers.
     regs = availableGeneralRegs(0);
     regs.take(R0);
     regs.take(scratchReg);
 
     // Shape guard objects on the proto chain.
     Register protoReg = regs.takeAny();
     for (size_t i = 0; i < protoChainDepth_; i++) {
@@ -3259,16 +3261,17 @@ ICSetElemDenseOrUnboxedArrayAddCompiler:
         // Failure case: restore the value of R0
         masm.bind(&failurePopR0);
         masm.popValue(R0);
         masm.jump(&failure);
     }
 
     // Failure case - fail but first unstow R0 and R1
     masm.bind(&failureUnstow);
+    masm.setFramePushed(framePushedAfterStow);
     EmitUnstowICValues(masm, 2);
 
     // Failure case - jump to next stub
     masm.bind(&failure);
     EmitStubGuardFailure(masm);
     return true;
 }