Bug 1003694 - Settle on first frame by skipping all allocations. r=h4writer

js/src/jit-test/tests/ion/bug1003694.js

@@ -0,0 +1,9 @@
+function f(i) {
+    if (i >= 10)
+        return;
+    var d = 3 + Math.abs();
+    f(i ? i + 1 : 1);
+    bailout();
+}
+
+f(0);

js/src/jit/IonFrames.cpp

@@ -1628,12 +1628,20 @@ SnapshotIterator::fromInstructionResult(uint32_t index) const
     return (*instructionResults_)[index];
 }
 
+void
+SnapshotIterator::settleOnFrame()
+{
+    // Check that the current instruction can still be use.
+    MOZ_ASSERT(snapshot_.numAllocationsRead() == 0);
+    while (!instruction()->isResumePoint())
+        skipInstruction();
+}
+
 void
 SnapshotIterator::nextFrame()
 {
     nextInstruction();
-    while (!instruction()->isResumePoint())
-        skipInstruction();
+    settleOnFrame();
 }
 
 IonScript *
@@ -1699,8 +1707,7 @@ InlineFrameIteratorMaybeGC<allowGC>::findNextFrame()
 
     // Settle on the outermost frame without evaluating any instructions before
     // looking for a pc.
-    if (!si_.instruction()->isResumePoint())
-        si_.nextFrame();
+    si_.settleOnFrame();
 
     pc_ = script_->offsetToPC(si_.pcOffset());
 #ifdef DEBUG

js/src/jit/JitFrameIterator.h

@@ -355,6 +355,7 @@ class SnapshotIterator
   public:
     // Handle iterating over frames of the snapshots.
     void nextFrame();
+    void settleOnFrame();
 
     inline bool moreFrames() const {
         // The last instruction is recovering the innermost frame, so as long as