From 86a069ea40f1686d29caf2f928f279beededaa49 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Wed, 18 Dec 2013 22:36:17 +0100
Subject: [PATCH] Bug 939614: IonMonkey: Fix trying to enter at wrong pc,
 r=jandem

---
 js/src/jit/BaselineIC.cpp | 1 +
 js/src/jit/Ion.cpp        | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index e4804c73f9c..9f1e1a960d9 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -801,6 +801,7 @@ EnsureCanEnterIon(JSContext *cx, ICUseCount_Fallback *stub, BaselineFrame *frame
     if (isLoopEntry) {
         IonScript *ion = script->ionScript();
         JS_ASSERT(cx->runtime()->spsProfiler.enabled() == ion->hasSPSInstrumentation());
+        JS_ASSERT(ion->osrPc() == pc);
 
         // If the baseline frame's SPS handling doesn't match up with the Ion code's SPS
         // handling, don't OSR.
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index a11cd20db12..c9cd179f69c 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -1967,7 +1967,12 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
     }
 
     // Compilation succeeded or we invalidated right away or an inlining/alloc abort
-    return HasIonScript(script, executionMode) ? Method_Compiled : Method_Skipped;
+    if (HasIonScript(script, executionMode)) {
+        if (osrPc && script->ionScript()->osrPc() != osrPc)
+            return Method_Skipped;
+        return Method_Compiled;
+    }
+    return Method_Skipped;
 }
 
 } // namespace jit