diff options
Diffstat (limited to 'js/src/jit/BaselineBailouts.cpp')
| -rw-r--r-- | js/src/jit/BaselineBailouts.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp index c82a05d0ea..c13bddf97b 100644 --- a/js/src/jit/BaselineBailouts.cpp +++ b/js/src/jit/BaselineBailouts.cpp @@ -125,6 +125,8 @@ class MOZ_STACK_CLASS BaselineStackBuilder { BailoutKind bailoutKind_; + bool canUseTrialInlinedICScripts_ = true; + // The baseline frames we will reconstruct on the heap are not // rooted, so GC must be suppressed. gc::AutoSuppressGC suppress_; @@ -486,7 +488,8 @@ void BaselineStackBuilder::setNextCallee( JSFunction* nextCallee, TrialInliningState trialInliningState) { nextCallee_ = nextCallee; - if (trialInliningState == TrialInliningState::Inlined) { + if (trialInliningState == TrialInliningState::Inlined && + canUseTrialInlinedICScripts_) { // Update icScript_ to point to the icScript of nextCallee const uint32_t pcOff = script_->pcToOffset(pc_); icScript_ = icScript_->findInlinedChild(pcOff); @@ -496,6 +499,9 @@ void BaselineStackBuilder::setNextCallee( // inlined ICScript available, but we also could not if we transitioned // to TrialInliningState::Failure after being monomorphic inlined. icScript_ = nextCallee->nonLazyScript()->jitScript()->icScript(); + if (trialInliningState != TrialInliningState::MonomorphicInlined) { + canUseTrialInlinedICScripts_ = false; + } } } |