Bug 848679 - Skip past NOP/LOOPHEAD/LOOPENTRY when bailing from Ion to Baseline. r=nbp

This commit is contained in:
Kannan Vijayan 2013-03-07 15:01:03 -05:00
parent 9b590425b5
commit 9c7df49500

View File

@ -600,20 +600,25 @@ InitFromBailout(JSContext *cx, HandleFunction fun, HandleScript script, Snapshot
// Get the PC
jsbytecode *pc = script->code + iter.pcOffset();
JSOp op = JSOp(*pc);
bool resumeAfter = iter.resumeAfter();
// If we are resuming at a LOOPENTRY op, resume at the next op to avoid
// a bailout -> enter Ion -> bailout loop with --ion-eager. See also
// ThunkToInterpreter.
if (!resumeAfter) {
while (JSOp(*pc) == JSOP_GOTO)
pc += GET_JUMP_OFFSET(pc);
if (JSOp(*pc) == JSOP_LOOPENTRY)
pc = GetNextPc(pc);
while (true) {
op = JSOp(*pc);
if (op == JSOP_GOTO)
pc += GET_JUMP_OFFSET(pc);
else if (op == JSOP_LOOPENTRY || op == JSOP_NOP || op == JSOP_LOOPHEAD)
pc = GetNextPc(pc);
else
break;
}
}
uint32_t pcOff = pc - script->code;
JSOp op = JSOp(*pc);
bool isCall = js_CodeSpec[op].format & JOF_INVOKE;
BaselineScript *baselineScript = script->baselineScript();