Bug 821788 - Prevent elimination of phis and resume point operands for operands of inline calls, r=jandem.

js/src/ion/IonBuilder.cpp

@@ -3098,9 +3098,12 @@ IonBuilder::jsop_call_inline(HandleFunction callee, uint32_t argc, bool construc
 {
     AssertCanGC();
 
+    int calleePos = -((int) argc + 2);
+    current->peek(calleePos)->setFoldedUnchecked();
+
     // Rewrite the stack position containing the function with the constant
     // function definition, before we take the inlineResumePoint
-    current->rewriteAtDepth(-((int) argc + 2), constFun);
+    current->rewriteAtDepth(calleePos, constFun);
 
     // This resume point collects outer variables only.  It is used to recover
     // the stack state before the current bytecode.
@@ -3506,6 +3509,7 @@ IonBuilder::inlineScriptedCall(AutoObjectVector &targets, uint32_t argc, bool co
         MPassArg *passArg = top->peek(argSlotDepth)->toPassArg();
         MBasicBlock *block = passArg->block();
         MDefinition *wrapped = passArg->getArgument();
+        wrapped->setFoldedUnchecked();
         passArg->replaceAllUsesWith(wrapped);
         top->rewriteAtDepth(argSlotDepth, wrapped);
         block->discard(passArg);

js/src/jit-test/tests/ion/bug821788.js

@@ -0,0 +1,13 @@
+
+var appendToActual = function(s) {
+    actual += s + ',';
+}
+gczeal(2,(3));
+actual = '';
+function loop(f) {}
+function f(j, k) {
+  var g = function(a, b, c) {}
+  for (k = 0; k < 5; ++k)
+    appendToActual(loop(g));
+}
+f(1);

js/src/jit-test/tests/ion/bug821794.js

@@ -0,0 +1,10 @@
+
+gczeal(2);
+function bitsinbyte() {
+    var [ summary  ]  = true;
+}
+function TimeFunc(func) {
+    for(var y=0; y<11000; y++)
+        func();
+}
+TimeFunc(bitsinbyte);