From 20da2fbc5688a8bea493f2e8211424c19bbad73c Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Mon, 8 Feb 2016 15:13:37 +0100
Subject: [PATCH] Bug 1122581 - Fix FormatFrame to not assert on Ion frames in
 some cases. r=shu

---
 js/src/jit-test/tests/basic/bug1122581.js | 10 ++++++++++
 js/src/jsfriendapi.cpp                    | 12 ++++++------
 2 files changed, 16 insertions(+), 6 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/bug1122581.js

diff --git a/js/src/jit-test/tests/basic/bug1122581.js b/js/src/jit-test/tests/basic/bug1122581.js
new file mode 100644
index 00000000000..7c999242702
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1122581.js
@@ -0,0 +1,10 @@
+function f(x, y) {
+    for (var i=0; i<50; i++) {
+	if (i % 10 === 0) {
+	    var stack = getBacktrace({args: true, locals: true, thisprops: true});
+	    assertEq(stack.includes("f(x = "), true);
+	    foo = arguments;
+	}
+    }
+}
+f(1, 2);
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index b56346ee65a..de894be5ff3 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -759,13 +759,13 @@ FormatFrame(JSContext* cx, const ScriptFrameIter& iter, char* buf, int num,
                         break;
                     }
                 }
-            } else if (script->argsObjAliasesFormals() && iter.hasArgsObj()) {
-                arg = iter.argsObj().arg(i);
-            } else {
-                if (iter.hasUsableAbstractFramePtr())
-                    arg = iter.unaliasedActual(i, DONT_CHECK_ALIASING);
+            } else if (iter.hasUsableAbstractFramePtr()) {
+                if (script->argsObjAliasesFormals() && iter.hasArgsObj())
+                    arg = iter.argsObj().arg(i);
                 else
-                    arg = MagicValue(JS_OPTIMIZED_OUT);
+                    arg = iter.unaliasedActual(i, DONT_CHECK_ALIASING);
+            } else {
+                arg = MagicValue(JS_OPTIMIZED_OUT);
             }
 
             JSAutoByteString valueBytes;