Adding upstream version 110.0.1.upstream/110.0.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 2058 insertions, 0 deletions

diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
new file mode 100644
index 0000000000..795476c4ac
--- /dev/null
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -0,0 +1,2058 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/Assertions.h"
+#include "mozilla/ScopeExit.h"
+
+#include "builtin/ModuleObject.h"
+#include "debugger/DebugAPI.h"
+#include "gc/GC.h"
+#include "jit/arm/Simulator-arm.h"
+#include "jit/Bailouts.h"
+#include "jit/BaselineFrame.h"
+#include "jit/BaselineIC.h"
+#include "jit/BaselineJIT.h"
+#include "jit/CalleeToken.h"
+#include "jit/Invalidation.h"
+#include "jit/Ion.h"
+#include "jit/IonScript.h"
+#include "jit/JitFrames.h"
+#include "jit/JitRuntime.h"
+#include "jit/JitSpewer.h"
+#include "jit/loong64/Simulator-loong64.h"
+#include "jit/mips32/Simulator-mips32.h"
+#include "jit/mips64/Simulator-mips64.h"
+#include "jit/RematerializedFrame.h"
+#include "jit/SharedICRegisters.h"
+#include "js/friend/StackLimits.h"  // js::AutoCheckRecursionLimit, js::ReportOverRecursed
+#include "js/Utility.h"
+#include "util/Memory.h"
+#include "vm/ArgumentsObject.h"
+#include "vm/BytecodeUtil.h"
+#include "vm/JitActivation.h"
+
+#include "jit/JitFrames-inl.h"
+#include "vm/JSContext-inl.h"
+#include "vm/JSScript-inl.h"
+
+using namespace js;
+using namespace js::jit;
+
+using mozilla::DebugOnly;
+using mozilla::Maybe;
+
+// BaselineStackBuilder may reallocate its buffer if the current one is too
+// small. To avoid dangling pointers, BufferPointer represents a pointer into
+// this buffer as a pointer to the header and a fixed offset.
+template <typename T>
+class BufferPointer {
+  const UniquePtr<BaselineBailoutInfo>& header_;
+  size_t offset_;
+  bool heap_;
+
+ public:
+  BufferPointer(const UniquePtr<BaselineBailoutInfo>& header, size_t offset,
+                bool heap)
+      : header_(header), offset_(offset), heap_(heap) {}
+
+  T* get() const {
+    BaselineBailoutInfo* header = header_.get();
+    if (!heap_) {
+      return (T*)(header->incomingStack + offset_);
+    }
+
+    uint8_t* p = header->copyStackTop - offset_;
+    MOZ_ASSERT(p >= header->copyStackBottom && p < header->copyStackTop);
+    return (T*)p;
+  }
+
+  void set(const T& value) { *get() = value; }
+
+  // Note: we return a copy instead of a reference, to avoid potential memory
+  // safety hazards when the underlying buffer gets resized.
+  const T operator*() const { return *get(); }
+  T* operator->() const { return get(); }
+};
+
+/**
+ * BaselineStackBuilder helps abstract the process of rebuilding the C stack on
+ * the heap. It takes a bailout iterator and keeps track of the point on the C
+ * stack from which the reconstructed frames will be written.
+ *
+ * It exposes methods to write data into the heap memory storing the
+ * reconstructed stack.  It also exposes method to easily calculate addresses.
+ * This includes both the virtual address that a particular value will be at
+ * when it's eventually copied onto the stack, as well as the current actual
+ * address of that value (whether on the heap allocated portion being
+ * constructed or the existing stack).
+ *
+ * The abstraction handles transparent re-allocation of the heap memory when it
+ * needs to be enlarged to accommodate new data.  Similarly to the C stack, the
+ * data that's written to the reconstructed stack grows from high to low in
+ * memory.
+ *
+ * The lowest region of the allocated memory contains a BaselineBailoutInfo
+ * structure that points to the start and end of the written data.
+ */
+class MOZ_STACK_CLASS BaselineStackBuilder {
+  JSContext* cx_;
+  JitFrameLayout* frame_ = nullptr;
+  SnapshotIterator& iter_;
+  RootedValueVector outermostFrameFormals_;
+
+  size_t bufferTotal_ = 1024;
+  size_t bufferAvail_ = 0;
+  size_t bufferUsed_ = 0;
+  size_t framePushed_ = 0;
+
+  UniquePtr<BaselineBailoutInfo> header_;
+
+  JSScript* script_;
+  JSFunction* fun_;
+  const ExceptionBailoutInfo* excInfo_;
+  ICScript* icScript_;
+
+  jsbytecode* pc_ = nullptr;
+  JSOp op_ = JSOp::Nop;
+  mozilla::Maybe<ResumeMode> resumeMode_;
+  uint32_t exprStackSlots_ = 0;
+  void* prevFramePtr_ = nullptr;
+  Maybe<BufferPointer<BaselineFrame>> blFrame_;
+
+  size_t frameNo_ = 0;
+  JSFunction* nextCallee_ = nullptr;
+
+  BailoutKind bailoutKind_;
+
+  // The baseline frames we will reconstruct on the heap are not
+  // rooted, so GC must be suppressed.
+  gc::AutoSuppressGC suppress_;
+
+ public:
+  BaselineStackBuilder(JSContext* cx, const JSJitFrameIter& frameIter,
+                       SnapshotIterator& iter,
+                       const ExceptionBailoutInfo* excInfo,
+                       BailoutReason reason);
+
+  [[nodiscard]] bool init() {
+    MOZ_ASSERT(!header_);
+    MOZ_ASSERT(bufferUsed_ == 0);
+
+    uint8_t* bufferRaw = cx_->pod_calloc<uint8_t>(bufferTotal_);
+    if (!bufferRaw) {
+      return false;
+    }
+    bufferAvail_ = bufferTotal_ - sizeof(BaselineBailoutInfo);
+
+    header_.reset(new (bufferRaw) BaselineBailoutInfo());
+    header_->incomingStack = reinterpret_cast<uint8_t*>(frame_);
+    header_->copyStackTop = bufferRaw + bufferTotal_;
+    header_->copyStackBottom = header_->copyStackTop;
+    return true;
+  }
+
+  [[nodiscard]] bool buildOneFrame();
+  bool done();
+  void nextFrame();
+
+  JSScript* script() const { return script_; }
+  size_t frameNo() const { return frameNo_; }
+  bool isOutermostFrame() const { return frameNo_ == 0; }
+  MutableHandleValueVector outermostFrameFormals() {
+    return &outermostFrameFormals_;
+  }
+  BailoutKind bailoutKind() const { return bailoutKind_; }
+
+  inline JitFrameLayout* startFrame() { return frame_; }
+
+  BaselineBailoutInfo* info() {
+    MOZ_ASSERT(header_);
+    return header_.get();
+  }
+
+  BaselineBailoutInfo* takeBuffer() {
+    MOZ_ASSERT(header_);
+    return header_.release();
+  }
+
+ private:
+  [[nodiscard]] bool initFrame();
+  [[nodiscard]] bool buildBaselineFrame();
+  [[nodiscard]] bool buildArguments();
+  [[nodiscard]] bool buildFixedSlots();
+  [[nodiscard]] bool fixUpCallerArgs(MutableHandleValueVector savedCallerArgs,
+                                     bool* fixedUp);
+  [[nodiscard]] bool buildFinallyException();
+  [[nodiscard]] bool buildExpressionStack();
+  [[nodiscard]] bool finishLastFrame();
+
+  [[nodiscard]] bool prepareForNextFrame(HandleValueVector savedCallerArgs);
+  [[nodiscard]] bool finishOuterFrame();
+  [[nodiscard]] bool buildStubFrame(uint32_t frameSize,
+                                    HandleValueVector savedCallerArgs);
+  [[nodiscard]] bool buildRectifierFrame(uint32_t actualArgc,
+                                         size_t endOfBaselineStubArgs);
+
+#ifdef DEBUG
+  [[nodiscard]] bool validateFrame();
+#endif
+
+#ifdef DEBUG
+  bool envChainSlotCanBeOptimized();
+#endif
+
+  bool isPrologueBailout();
+  jsbytecode* getResumePC();
+  void* getStubReturnAddress();
+
+  uint32_t exprStackSlots() const { return exprStackSlots_; }
+
+  // Returns true if we're bailing out to a catch or finally block in this frame
+  bool catchingException() const {
+    return excInfo_ && excInfo_->catchingException() &&
+           excInfo_->frameNo() == frameNo_;
+  }
+
+  // Returns true if we're bailing out to a finally block in this frame.
+  bool resumingInFinallyBlock() const {
+    return catchingException() && excInfo_->isFinally();
+  }
+
+  bool forcedReturn() const { return excInfo_ && excInfo_->forcedReturn(); }
+
+  // Returns true if we're bailing out in place for debug mode
+  bool propagatingIonExceptionForDebugMode() const {
+    return excInfo_ && excInfo_->propagatingIonExceptionForDebugMode();
+  }
+
+  void* prevFramePtr() const {
+    MOZ_ASSERT(prevFramePtr_);
+    return prevFramePtr_;
+  }
+  BufferPointer<BaselineFrame>& blFrame() { return blFrame_.ref(); }
+
+  void setNextCallee(JSFunction* nextCallee);
+  JSFunction* nextCallee() const { return nextCallee_; }
+
+  jsbytecode* pc() const { return pc_; }
+  bool resumeAfter() const {
+    return !catchingException() && iter_.resumeAfter();
+  }
+
+  ResumeMode resumeMode() const { return *resumeMode_; }
+
+  bool needToSaveCallerArgs() const {
+    return resumeMode() == ResumeMode::InlinedAccessor;
+  }
+
+  [[nodiscard]] bool enlarge() {
+    MOZ_ASSERT(header_ != nullptr);
+    if (bufferTotal_ & mozilla::tl::MulOverflowMask<2>::value) {
+      ReportOutOfMemory(cx_);
+      return false;
+    }
+
+    size_t newSize = bufferTotal_ * 2;
+    uint8_t* newBufferRaw = cx_->pod_calloc<uint8_t>(newSize);
+    if (!newBufferRaw) {
+      return false;
+    }
+
+    // Initialize the new buffer.
+    //
+    //   Before:
+    //
+    //     [ Header | .. | Payload ]
+    //
+    //   After:
+    //
+    //     [ Header | ............... | Payload ]
+    //
+    // Size of Payload is |bufferUsed_|.
+    //
+    // We need to copy from the old buffer and header to the new buffer before
+    // we set header_ (this deletes the old buffer).
+    //
+    // We also need to update |copyStackBottom| and |copyStackTop| because these
+    // fields point to the Payload's start and end, respectively.
+    using BailoutInfoPtr = UniquePtr<BaselineBailoutInfo>;
+    BailoutInfoPtr newHeader(new (newBufferRaw) BaselineBailoutInfo(*header_));
+    newHeader->copyStackTop = newBufferRaw + newSize;
+    newHeader->copyStackBottom = newHeader->copyStackTop - bufferUsed_;
+    memcpy(newHeader->copyStackBottom, header_->copyStackBottom, bufferUsed_);
+    bufferTotal_ = newSize;
+    bufferAvail_ = newSize - (sizeof(BaselineBailoutInfo) + bufferUsed_);
+    header_ = std::move(newHeader);
+    return true;
+  }
+
+  void resetFramePushed() { framePushed_ = 0; }
+
+  size_t framePushed() const { return framePushed_; }
+
+  [[nodiscard]] bool subtract(size_t size, const char* info = nullptr) {
+    // enlarge the buffer if need be.
+    while (size > bufferAvail_) {
+      if (!enlarge()) {
+        return false;
+      }
+    }
+
+    // write out element.
+    header_->copyStackBottom -= size;
+    bufferAvail_ -= size;
+    bufferUsed_ += size;
+    framePushed_ += size;
+    if (info) {
+      JitSpew(JitSpew_BaselineBailouts, "      SUB_%03d   %p/%p %-15s",
+              (int)size, header_->copyStackBottom,
+              virtualPointerAtStackOffset(0), info);
+    }
+    return true;
+  }
+
+  template <typename T>
+  [[nodiscard]] bool write(const T& t) {
+    MOZ_ASSERT(!(uintptr_t(&t) >= uintptr_t(header_->copyStackBottom) &&
+                 uintptr_t(&t) < uintptr_t(header_->copyStackTop)),
+               "Should not reference memory that can be freed");
+    if (!subtract(sizeof(T))) {
+      return false;
+    }
+    memcpy(header_->copyStackBottom, &t, sizeof(T));
+    return true;
+  }
+
+  template <typename T>
+  [[nodiscard]] bool writePtr(T* t, const char* info) {
+    if (!write<T*>(t)) {
+      return false;
+    }
+    if (info) {
+      JitSpew(JitSpew_BaselineBailouts, "      WRITE_PTR %p/%p %-15s %p",
+              header_->copyStackBottom, virtualPointerAtStackOffset(0), info,
+              t);
+    }
+    return true;
+  }
+
+  [[nodiscard]] bool writeWord(size_t w, const char* info) {
+    if (!write<size_t>(w)) {
+      return false;
+    }
+    if (info) {
+      if (sizeof(size_t) == 4) {
+        JitSpew(JitSpew_BaselineBailouts, "      WRITE_WRD %p/%p %-15s %08zx",
+                header_->copyStackBottom, virtualPointerAtStackOffset(0), info,
+                w);
+      } else {
+        JitSpew(JitSpew_BaselineBailouts, "      WRITE_WRD %p/%p %-15s %016zx",
+                header_->copyStackBottom, virtualPointerAtStackOffset(0), info,
+                w);
+      }
+    }
+    return true;
+  }
+
+  [[nodiscard]] bool writeValue(const Value& val, const char* info) {
+    if (!write<Value>(val)) {
+      return false;
+    }
+    if (info) {
+      JitSpew(JitSpew_BaselineBailouts,
+              "      WRITE_VAL %p/%p %-15s %016" PRIx64,
+              header_->copyStackBottom, virtualPointerAtStackOffset(0), info,
+              *((uint64_t*)&val));
+    }
+    return true;
+  }
+
+  [[nodiscard]] bool maybeWritePadding(size_t alignment, size_t after,
+                                       const char* info) {
+    MOZ_ASSERT(framePushed_ % sizeof(Value) == 0);
+    MOZ_ASSERT(after % sizeof(Value) == 0);
+    size_t offset = ComputeByteAlignment(after, alignment);
+    while (framePushed_ % alignment != offset) {
+      if (!writeValue(MagicValue(JS_ARG_POISON), info)) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  void setResumeFramePtr(void* resumeFramePtr) {
+    header_->resumeFramePtr = resumeFramePtr;
+  }
+
+  void setResumeAddr(void* resumeAddr) { header_->resumeAddr = resumeAddr; }
+
+  template <typename T>
+  BufferPointer<T> pointerAtStackOffset(size_t offset) {
+    if (offset < bufferUsed_) {
+      // Calculate offset from copyStackTop.
+      offset = header_->copyStackTop - (header_->copyStackBottom + offset);
+      return BufferPointer<T>(header_, offset, /* heap = */ true);
+    }
+
+    return BufferPointer<T>(header_, offset - bufferUsed_, /* heap = */ false);
+  }
+
+  BufferPointer<Value> valuePointerAtStackOffset(size_t offset) {
+    return pointerAtStackOffset<Value>(offset);
+  }
+
+  inline uint8_t* virtualPointerAtStackOffset(size_t offset) {
+    if (offset < bufferUsed_) {
+      return reinterpret_cast<uint8_t*>(frame_) - (bufferUsed_ - offset);
+    }
+    return reinterpret_cast<uint8_t*>(frame_) + (offset - bufferUsed_);
+  }
+};
+
+BaselineStackBuilder::BaselineStackBuilder(JSContext* cx,
+                                           const JSJitFrameIter& frameIter,
+                                           SnapshotIterator& iter,
+                                           const ExceptionBailoutInfo* excInfo,
+                                           BailoutReason reason)
+    : cx_(cx),
+      frame_(static_cast<JitFrameLayout*>(frameIter.current())),
+      iter_(iter),
+      outermostFrameFormals_(cx),
+      script_(frameIter.script()),
+      fun_(frameIter.maybeCallee()),
+      excInfo_(excInfo),
+      icScript_(script_->jitScript()->icScript()),
+      bailoutKind_(iter.bailoutKind()),
+      suppress_(cx) {
+  MOZ_ASSERT(bufferTotal_ >= sizeof(BaselineBailoutInfo));
+  if (reason == BailoutReason::Invalidate) {
+    bailoutKind_ = BailoutKind::OnStackInvalidation;
+  }
+}
+
+bool BaselineStackBuilder::initFrame() {
+  // Get the pc and ResumeMode. If we are handling an exception, resume at the
+  // pc of the catch or finally block.
+  if (catchingException()) {
+    pc_ = excInfo_->resumePC();
+    resumeMode_ = mozilla::Some(ResumeMode::ResumeAt);
+  } else {
+    pc_ = script_->offsetToPC(iter_.pcOffset());
+    resumeMode_ = mozilla::Some(iter_.resumeMode());
+  }
+  op_ = JSOp(*pc_);
+
+  // If we are catching an exception, we are bailing out to a catch or
+  // finally block and this is the frame where we will resume. Usually the
+  // expression stack should be empty in this case but there can be
+  // iterators on the stack.
+  if (catchingException()) {
+    exprStackSlots_ = excInfo_->numExprSlots();
+  } else {
+    uint32_t totalFrameSlots = iter_.numAllocations();
+    uint32_t fixedSlots = script_->nfixed();
+    uint32_t argSlots = CountArgSlots(script_, fun_);
+    uint32_t intermediates = NumIntermediateValues(resumeMode());
+    exprStackSlots_ = totalFrameSlots - fixedSlots - argSlots - intermediates;
+
+    // Verify that there was no underflow.
+    MOZ_ASSERT(exprStackSlots_ <= totalFrameSlots);
+  }
+
+  JitSpew(JitSpew_BaselineBailouts, "      Unpacking %s:%u:%u",
+          script_->filename(), script_->lineno(), script_->column());
+  JitSpew(JitSpew_BaselineBailouts, "      [BASELINE-JS FRAME]");
+
+  // Write the previous frame pointer value. For the outermost frame we reuse
+  // the value in the JitFrameLayout already on the stack. Record the virtual
+  // stack offset at this location. Later on, if we end up writing out a
+  // BaselineStub frame for the next callee, we'll need to save the address.
+  if (!isOutermostFrame()) {
+    if (!writePtr(prevFramePtr(), "PrevFramePtr")) {
+      return false;
+    }
+  }
+  prevFramePtr_ = virtualPointerAtStackOffset(0);
+
+  resetFramePushed();
+
+  return true;
+}
+
+void BaselineStackBuilder::setNextCallee(JSFunction* nextCallee) {
+  nextCallee_ = nextCallee;
+
+  // Update icScript_ to point to the icScript of nextCallee
+  const uint32_t pcOff = script_->pcToOffset(pc_);
+  icScript_ = icScript_->findInlinedChild(pcOff);
+}
+
+bool BaselineStackBuilder::done() {
+  if (!iter_.moreFrames()) {
+    MOZ_ASSERT(!nextCallee_);
+    return true;
+  }
+  return catchingException();
+}
+
+void BaselineStackBuilder::nextFrame() {
+  MOZ_ASSERT(nextCallee_);
+  fun_ = nextCallee_;
+  script_ = fun_->nonLazyScript();
+  nextCallee_ = nullptr;
+
+  // Scripts with an IonScript must also have a BaselineScript.
+  MOZ_ASSERT(script_->hasBaselineScript());
+
+  frameNo_++;
+  iter_.nextInstruction();
+}
+
+// Build the BaselineFrame struct
+bool BaselineStackBuilder::buildBaselineFrame() {
+  if (!subtract(BaselineFrame::Size(), "BaselineFrame")) {
+    return false;
+  }
+  blFrame_.reset();
+  blFrame_.emplace(pointerAtStackOffset<BaselineFrame>(0));
+
+  uint32_t flags = BaselineFrame::RUNNING_IN_INTERPRETER;
+
+  // If we are bailing to a script whose execution is observed, mark the
+  // baseline frame as a debuggee frame. This is to cover the case where we
+  // don't rematerialize the Ion frame via the Debugger.
+  if (script_->isDebuggee()) {
+    flags |= BaselineFrame::DEBUGGEE;
+  }
+
+  // Get |envChain|.
+  JSObject* envChain = nullptr;
+  Value envChainSlot = iter_.read();
+  if (envChainSlot.isObject()) {
+    // The env slot has been updated from UndefinedValue. It must be the
+    // complete initial environment.
+    envChain = &envChainSlot.toObject();
+
+    // Set the HAS_INITIAL_ENV flag if needed. See IsFrameInitialEnvironment.
+    MOZ_ASSERT(!script_->isForEval());
+    if (fun_ && fun_->needsFunctionEnvironmentObjects()) {
+      MOZ_ASSERT(fun_->nonLazyScript()->initialEnvironmentShape());
+      flags |= BaselineFrame::HAS_INITIAL_ENV;
+    }
+  } else {
+    MOZ_ASSERT(envChainSlot.isUndefined() ||
+               envChainSlot.isMagic(JS_OPTIMIZED_OUT));
+    MOZ_ASSERT(envChainSlotCanBeOptimized());
+
+    // The env slot has been optimized out.
+    // Get it from the function or script.
+    if (fun_) {
+      envChain = fun_->environment();
+    } else if (script_->isModule()) {
+      envChain = script_->module()->environment();
+    } else {
+      // For global scripts without a non-syntactic env the env
+      // chain is the script's global lexical environment. (We do
+      // not compile scripts with a non-syntactic global scope).
+      // Also note that it's invalid to resume into the prologue in
+      // this case because the prologue expects the env chain in R1
+      // for eval and global scripts.
+      MOZ_ASSERT(!script_->isForEval());
+      MOZ_ASSERT(!script_->hasNonSyntacticScope());
+      envChain = &(script_->global().lexicalEnvironment());
+    }
+  }
+
+  // Write |envChain|.
+  MOZ_ASSERT(envChain);
+  JitSpew(JitSpew_BaselineBailouts, "      EnvChain=%p", envChain);
+  blFrame()->setEnvironmentChain(envChain);
+
+  // Get |returnValue| if present.
+  Value returnValue = UndefinedValue();
+  if (script_->noScriptRval()) {
+    // Don't use the return value (likely a JS_OPTIMIZED_OUT MagicValue) to
+    // not confuse Baseline.
+    iter_.skip();
+  } else {
+    returnValue = iter_.read();
+    flags |= BaselineFrame::HAS_RVAL;
+  }
+
+  // Write |returnValue|.
+  JitSpew(JitSpew_BaselineBailouts, "      ReturnValue=%016" PRIx64,
+          *((uint64_t*)&returnValue));
+  blFrame()->setReturnValue(returnValue);
+
+  // Get |argsObj| if present.
+  ArgumentsObject* argsObj = nullptr;
+  if (script_->needsArgsObj()) {
+    Value maybeArgsObj = iter_.read();
+    MOZ_ASSERT(maybeArgsObj.isObject() || maybeArgsObj.isUndefined() ||
+               maybeArgsObj.isMagic(JS_OPTIMIZED_OUT));
+    if (maybeArgsObj.isObject()) {
+      argsObj = &maybeArgsObj.toObject().as<ArgumentsObject>();
+    }
+  }
+
+  // Note: we do not need to initialize the scratchValue field in BaselineFrame.
+
+  // Write |flags|.
+  blFrame()->setFlags(flags);
+
+  // Write |icScript|.
+  JitSpew(JitSpew_BaselineBailouts, "      ICScript=%p", icScript_);
+  blFrame()->setICScript(icScript_);
+
+  // initArgsObjUnchecked modifies the frame's flags, so call it after setFlags.
+  if (argsObj) {
+    blFrame()->initArgsObjUnchecked(*argsObj);
+  }
+  return true;
+}
+
+// Overwrite the pushed args present in the calling frame with
+// the unpacked |thisv| and argument values.
+bool BaselineStackBuilder::buildArguments() {
+  Value thisv = iter_.read();
+  JitSpew(JitSpew_BaselineBailouts, "      Is function!");
+  JitSpew(JitSpew_BaselineBailouts, "      thisv=%016" PRIx64,
+          *((uint64_t*)&thisv));
+
+  size_t thisvOffset = framePushed() + JitFrameLayout::offsetOfThis();
+  valuePointerAtStackOffset(thisvOffset).set(thisv);
+
+  MOZ_ASSERT(iter_.numAllocations() >= CountArgSlots(script_, fun_));
+  JitSpew(JitSpew_BaselineBailouts,
+          "      frame slots %u, nargs %zu, nfixed %zu", iter_.numAllocations(),
+          fun_->nargs(), script_->nfixed());
+
+  bool shouldStoreOutermostFormals =
+      isOutermostFrame() && !script_->argsObjAliasesFormals();
+  if (shouldStoreOutermostFormals) {
+    // This is the first (outermost) frame and we don't have an
+    // arguments object aliasing the formals. Due to UCE and phi
+    // elimination, we could store an UndefinedValue() here for
+    // formals we think are unused, but locals may still reference the
+    // original argument slot (MParameter/LArgument) and expect the
+    // original Value. To avoid this problem, store the formals in a
+    // Vector until we are done.
+    MOZ_ASSERT(outermostFrameFormals().empty());
+    if (!outermostFrameFormals().resize(fun_->nargs())) {
+      return false;
+    }
+  }
+
+  for (uint32_t i = 0; i < fun_->nargs(); i++) {
+    Value arg = iter_.read();
+    JitSpew(JitSpew_BaselineBailouts, "      arg %d = %016" PRIx64, (int)i,
+            *((uint64_t*)&arg));
+    if (!isOutermostFrame()) {
+      size_t argOffset = framePushed() + JitFrameLayout::offsetOfActualArg(i);
+      valuePointerAtStackOffset(argOffset).set(arg);
+    } else if (shouldStoreOutermostFormals) {
+      outermostFrameFormals()[i].set(arg);
+    } else {
+      // When the arguments object aliases the formal arguments, then
+      // JSOp::SetArg mutates the argument object. In such cases, the
+      // list of arguments reported by the snapshot are only aliases
+      // of argument object slots which are optimized to only store
+      // differences compared to arguments which are on the stack.
+    }
+  }
+  return true;
+}
+
+bool BaselineStackBuilder::buildFixedSlots() {
+  for (uint32_t i = 0; i < script_->nfixed(); i++) {
+    Value slot = iter_.read();
+    if (!writeValue(slot, "FixedValue")) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// The caller side of inlined js::fun_call and accessors must look
+// like the function wasn't inlined.
+bool BaselineStackBuilder::fixUpCallerArgs(
+    MutableHandleValueVector savedCallerArgs, bool* fixedUp) {
+  MOZ_ASSERT(!*fixedUp);
+
+  // Inlining of SpreadCall-like frames not currently supported.
+  MOZ_ASSERT(!IsSpreadOp(op_));
+
+  if (resumeMode() != ResumeMode::InlinedFunCall && !needToSaveCallerArgs()) {
+    return true;
+  }
+
+  // Calculate how many arguments are consumed by the inlined call.
+  // All calls pass |callee| and |this|.
+  uint32_t inlinedArgs = 2;
+  if (resumeMode() == ResumeMode::InlinedFunCall) {
+    // The first argument to an inlined FunCall becomes |this|,
+    // if it exists. The rest are passed normally.
+    MOZ_ASSERT(IsInvokeOp(op_));
+    inlinedArgs += GET_ARGC(pc_) > 0 ? GET_ARGC(pc_) - 1 : 0;
+  } else {
+    MOZ_ASSERT(resumeMode() == ResumeMode::InlinedAccessor);
+    MOZ_ASSERT(IsIonInlinableGetterOrSetterOp(op_));
+    // Setters are passed one argument. Getters are passed none.
+    if (IsSetPropOp(op_)) {
+      inlinedArgs++;
+    }
+  }
+
+  // Calculate how many values are live on the stack across the call,
+  // and push them.
+  MOZ_ASSERT(inlinedArgs <= exprStackSlots());
+  uint32_t liveStackSlots = exprStackSlots() - inlinedArgs;
+
+  JitSpew(JitSpew_BaselineBailouts,
+          "      pushing %u expression stack slots before fixup",
+          liveStackSlots);
+  for (uint32_t i = 0; i < liveStackSlots; i++) {
+    Value v = iter_.read();
+    if (!writeValue(v, "StackValue")) {
+      return false;
+    }
+  }
+
+  // When we inline js::fun_call, we bypass the native and inline the
+  // target directly. When rebuilding the stack, we need to fill in
+  // the right number of slots to make it look like the js_native was
+  // actually called.
+  if (resumeMode() == ResumeMode::InlinedFunCall) {
+    // We must transform the stack from |target, this, args| to
+    // |js_fun_call, target, this, args|. The value of |js_fun_call|
+    // will never be observed, so we push |undefined| for it, followed
+    // by the remaining arguments.
+    JitSpew(JitSpew_BaselineBailouts,
+            "      pushing undefined to fixup funcall");
+    if (!writeValue(UndefinedValue(), "StackValue")) {
+      return false;
+    }
+    if (GET_ARGC(pc_) > 0) {
+      JitSpew(JitSpew_BaselineBailouts,
+              "      pushing %u expression stack slots", inlinedArgs);
+      for (uint32_t i = 0; i < inlinedArgs; i++) {
+        Value arg = iter_.read();
+        if (!writeValue(arg, "StackValue")) {
+          return false;
+        }
+      }
+    } else {
+      // When we inline FunCall with no arguments, we push an extra
+      // |undefined| value for |this|. That value should not appear
+      // in the rebuilt baseline frame.
+      JitSpew(JitSpew_BaselineBailouts, "      pushing target of funcall");
+      Value target = iter_.read();
+      if (!writeValue(target, "StackValue")) {
+        return false;
+      }
+      // Skip |this|.
+      iter_.skip();
+    }
+  }
+
+  if (needToSaveCallerArgs()) {
+    // Save the actual arguments. They are needed to rebuild the callee frame.
+    if (!savedCallerArgs.resize(inlinedArgs)) {
+      return false;
+    }
+    for (uint32_t i = 0; i < inlinedArgs; i++) {
+      savedCallerArgs[i].set(iter_.read());
+    }
+
+    if (IsSetPropOp(op_)) {
+      // The RHS argument to SetProp remains on the stack after the
+      // operation and is observable, so we have to fill it in.
+      Value initialArg = savedCallerArgs[inlinedArgs - 1];
+      JitSpew(JitSpew_BaselineBailouts,
+              "     pushing setter's initial argument");
+      if (!writeValue(initialArg, "StackValue")) {
+        return false;
+      }
+    }
+  }
+
+  *fixedUp = true;
+  return true;
+}
+
+bool BaselineStackBuilder::buildExpressionStack() {
+  JitSpew(JitSpew_BaselineBailouts, "      pushing %u expression stack slots",
+          exprStackSlots());
+  for (uint32_t i = 0; i < exprStackSlots(); i++) {
+    Value v;
+    // If we are in the middle of propagating an exception from Ion by
+    // bailing to baseline due to debug mode, we might not have all
+    // the stack if we are at the newest frame.
+    //
+    // For instance, if calling |f()| pushed an Ion frame which threw,
+    // the snapshot expects the return value to be pushed, but it's
+    // possible nothing was pushed before we threw.
+    //
+    // We therefore use a fallible read here.
+    if (!iter_.tryRead(&v)) {
+      MOZ_ASSERT(propagatingIonExceptionForDebugMode() && !iter_.moreFrames());
+      v = MagicValue(JS_OPTIMIZED_OUT);
+    }
+    if (!writeValue(v, "StackValue")) {
+      return false;
+    }
+  }
+
+  if (resumeMode() == ResumeMode::ResumeAfterCheckIsObject) {
+    JitSpew(JitSpew_BaselineBailouts,
+            "      Checking that intermediate value is an object");
+    Value returnVal;
+    if (iter_.tryRead(&returnVal) && !returnVal.isObject()) {
+      MOZ_ASSERT(!returnVal.isMagic());
+      JitSpew(JitSpew_BaselineBailouts,
+              "      Not an object! Overwriting bailout kind");
+      bailoutKind_ = BailoutKind::ThrowCheckIsObject;
+    }
+  }
+
+  return true;
+}
+
+bool BaselineStackBuilder::buildFinallyException() {
+  MOZ_ASSERT(resumingInFinallyBlock());
+
+  if (!writeValue(excInfo_->finallyException(), "Exception")) {
+    return false;
+  }
+  if (!writeValue(BooleanValue(true), "throwing")) {
+    return false;
+  }
+
+  return true;
+}
+
+bool BaselineStackBuilder::prepareForNextFrame(
+    HandleValueVector savedCallerArgs) {
+  const uint32_t frameSize = framePushed();
+
+  // Write out descriptor and return address for the baseline frame.
+  // The icEntry in question MUST have an inlinable fallback stub.
+  if (!finishOuterFrame()) {
+    return false;
+  }
+
+  return buildStubFrame(frameSize, savedCallerArgs);
+}
+
+bool BaselineStackBuilder::finishOuterFrame() {
+  // .               .
+  // |  Descr(BLJS)  |
+  // +---------------+
+  // |  ReturnAddr   |
+  // +===============+
+
+  const BaselineInterpreter& baselineInterp =
+      cx_->runtime()->jitRuntime()->baselineInterpreter();
+
+  blFrame()->setInterpreterFields(script_, pc_);
+
+  // Write out descriptor of BaselineJS frame.
+  size_t baselineFrameDescr = MakeFrameDescriptor(FrameType::BaselineJS);
+  if (!writeWord(baselineFrameDescr, "Descriptor")) {
+    return false;
+  }
+
+  uint8_t* retAddr = baselineInterp.retAddrForIC(op_);
+  return writePtr(retAddr, "ReturnAddr");
+}
+
+bool BaselineStackBuilder::buildStubFrame(uint32_t frameSize,
+                                          HandleValueVector savedCallerArgs) {
+  // Build baseline stub frame:
+  // +===============+
+  // |   FramePtr    |
+  // +---------------+
+  // |    StubPtr    |
+  // +---------------+
+  // |   Padding?    |
+  // +---------------+
+  // |     ArgA      |
+  // +---------------+
+  // |     ...       |
+  // +---------------+
+  // |     Arg0      |
+  // +---------------+
+  // |     ThisV     |
+  // +---------------+
+  // |  CalleeToken  |
+  // +---------------+
+  // | Descr(BLStub) |
+  // +---------------+
+  // |  ReturnAddr   |
+  // +===============+
+
+  JitSpew(JitSpew_BaselineBailouts, "      [BASELINE-STUB FRAME]");
+
+  // Write previous frame pointer (saved earlier).
+  if (!writePtr(prevFramePtr(), "PrevFramePtr")) {
+    return false;
+  }
+  prevFramePtr_ = virtualPointerAtStackOffset(0);
+
+  // Write stub pointer.
+  uint32_t pcOff = script_->pcToOffset(pc_);
+  JitScript* jitScript = script_->jitScript();
+  const ICEntry& icEntry = jitScript->icEntryFromPCOffset(pcOff);
+  ICFallbackStub* fallback = jitScript->fallbackStubForICEntry(&icEntry);
+  if (!writePtr(fallback, "StubPtr")) {
+    return false;
+  }
+
+  // Write out the arguments, copied from the baseline frame. The order
+  // of the arguments is reversed relative to the baseline frame's stack
+  // values.
+  MOZ_ASSERT(IsIonInlinableOp(op_));
+  bool pushedNewTarget = IsConstructPC(pc_);
+  unsigned actualArgc;
+  Value callee;
+  if (needToSaveCallerArgs()) {
+    // For accessors, the arguments are not on the stack anymore,
+    // but they are copied in a vector and are written here.
+    callee = savedCallerArgs[0];
+    actualArgc = IsSetPropOp(op_) ? 1 : 0;
+
+    // Align the stack based on the number of arguments.
+    size_t afterFrameSize =
+        (actualArgc + 1) * sizeof(Value) + JitFrameLayout::Size();
+    if (!maybeWritePadding(JitStackAlignment, afterFrameSize, "Padding")) {
+      return false;
+    }
+
+    // Push arguments.
+    MOZ_ASSERT(actualArgc + 2 <= exprStackSlots());
+    MOZ_ASSERT(savedCallerArgs.length() == actualArgc + 2);
+    for (unsigned i = 0; i < actualArgc + 1; i++) {
+      size_t arg = savedCallerArgs.length() - (i + 1);
+      if (!writeValue(savedCallerArgs[arg], "ArgVal")) {
+        return false;
+      }
+    }
+  } else if (resumeMode() == ResumeMode::InlinedFunCall && GET_ARGC(pc_) == 0) {
+    // When calling FunCall with 0 arguments, we push |undefined|
+    // for this. See BaselineCacheIRCompiler::pushFunCallArguments.
+    MOZ_ASSERT(!pushedNewTarget);
+    actualArgc = 0;
+    // Align the stack based on pushing |this| and 0 arguments.
+    size_t afterFrameSize = sizeof(Value) + JitFrameLayout::Size();
+    if (!maybeWritePadding(JitStackAlignment, afterFrameSize, "Padding")) {
+      return false;
+    }
+    // Push an undefined value for |this|.
+    if (!writeValue(UndefinedValue(), "ThisValue")) {
+      return false;
+    }
+    size_t calleeSlot = blFrame()->numValueSlots(frameSize) - 1;
+    callee = *blFrame()->valueSlot(calleeSlot);
+
+  } else {
+    MOZ_ASSERT(resumeMode() == ResumeMode::InlinedStandardCall ||
+               resumeMode() == ResumeMode::InlinedFunCall);
+    actualArgc = GET_ARGC(pc_);
+    if (resumeMode() == ResumeMode::InlinedFunCall) {
+      // See BaselineCacheIRCompiler::pushFunCallArguments.
+      MOZ_ASSERT(actualArgc > 0);
+      actualArgc--;
+    }
+
+    // In addition to the formal arguments, we must also push |this|.
+    // When calling a constructor, we must also push |newTarget|.
+    uint32_t numArguments = actualArgc + 1 + pushedNewTarget;
+
+    // Align the stack based on the number of arguments.
+    size_t afterFrameSize =
+        numArguments * sizeof(Value) + JitFrameLayout::Size();
+    if (!maybeWritePadding(JitStackAlignment, afterFrameSize, "Padding")) {
+      return false;
+    }
+
+    // Copy the arguments and |this| from the BaselineFrame, in reverse order.
+    size_t valueSlot = blFrame()->numValueSlots(frameSize) - 1;
+    size_t calleeSlot = valueSlot - numArguments;
+
+    for (size_t i = valueSlot; i > calleeSlot; i--) {
+      Value v = *blFrame()->valueSlot(i);
+      if (!writeValue(v, "ArgVal")) {
+        return false;
+      }
+    }
+
+    callee = *blFrame()->valueSlot(calleeSlot);
+  }
+
+  // In case these arguments need to be copied on the stack again for a
+  // rectifier frame, save the framePushed values here for later use.
+  size_t endOfBaselineStubArgs = framePushed();
+
+  // Push callee token (must be a JS Function)
+  JitSpew(JitSpew_BaselineBailouts, "      Callee = %016" PRIx64,
+          callee.asRawBits());
+
+  JSFunction* calleeFun = &callee.toObject().as<JSFunction>();
+  if (!writePtr(CalleeToToken(calleeFun, pushedNewTarget), "CalleeToken")) {
+    return false;
+  }
+  setNextCallee(calleeFun);
+
+  // Push BaselineStub frame descriptor
+  size_t baselineStubFrameDescr =
+      MakeFrameDescriptorForJitCall(FrameType::BaselineStub, actualArgc);
+  if (!writeWord(baselineStubFrameDescr, "Descriptor")) {
+    return false;
+  }
+
+  // Push return address into ICCall_Scripted stub, immediately after the call.
+  void* baselineCallReturnAddr = getStubReturnAddress();
+  MOZ_ASSERT(baselineCallReturnAddr);
+  if (!writePtr(baselineCallReturnAddr, "ReturnAddr")) {
+    return false;
+  }
+
+  // The stack must be aligned after the callee pushes the frame pointer.
+  MOZ_ASSERT((framePushed() + sizeof(void*)) % JitStackAlignment == 0);
+
+  // Build a rectifier frame if necessary
+  if (actualArgc < calleeFun->nargs() &&
+      !buildRectifierFrame(actualArgc, endOfBaselineStubArgs)) {
+    return false;
+  }
+
+  return true;
+}
+
+bool BaselineStackBuilder::buildRectifierFrame(uint32_t actualArgc,
+                                               size_t endOfBaselineStubArgs) {
+  // Push a reconstructed rectifier frame.
+  // +===============+
+  // |   Padding?    |
+  // +---------------+
+  // |  UndefinedU   |
+  // +---------------+
+  // |     ...       |
+  // +---------------+
+  // |  Undefined0   |
+  // +---------------+
+  // |     ArgA      |
+  // +---------------+
+  // |     ...       |
+  // +---------------+
+  // |     Arg0      |
+  // +---------------+
+  // |     ThisV     |
+  // +---------------+
+  // |  CalleeToken  |
+  // +---------------+
+  // |  Descr(Rect)  |
+  // +---------------+
+  // |  ReturnAddr   |
+  // +===============+
+
+  JitSpew(JitSpew_BaselineBailouts, "      [RECTIFIER FRAME]");
+  bool pushedNewTarget = IsConstructPC(pc_);
+
+  if (!writePtr(prevFramePtr(), "PrevFramePtr")) {
+    return false;
+  }
+  prevFramePtr_ = virtualPointerAtStackOffset(0);
+
+  // Align the stack based on the number of arguments.
+  size_t afterFrameSize =
+      (nextCallee()->nargs() + 1 + pushedNewTarget) * sizeof(Value) +
+      RectifierFrameLayout::Size();
+  if (!maybeWritePadding(JitStackAlignment, afterFrameSize, "Padding")) {
+    return false;
+  }
+
+  // Copy new.target, if necessary.
+  if (pushedNewTarget) {
+    size_t newTargetOffset = (framePushed() - endOfBaselineStubArgs) +
+                             (actualArgc + 1) * sizeof(Value);
+    Value newTargetValue = *valuePointerAtStackOffset(newTargetOffset);
+    if (!writeValue(newTargetValue, "CopiedNewTarget")) {
+      return false;
+    }
+  }
+
+  // Push undefined for missing arguments.
+  for (unsigned i = 0; i < (nextCallee()->nargs() - actualArgc); i++) {
+    if (!writeValue(UndefinedValue(), "FillerVal")) {
+      return false;
+    }
+  }
+
+  // Copy arguments + thisv from BaselineStub frame.
+  if (!subtract((actualArgc + 1) * sizeof(Value), "CopiedArgs")) {
+    return false;
+  }
+  BufferPointer<uint8_t> stubArgsEnd =
+      pointerAtStackOffset<uint8_t>(framePushed() - endOfBaselineStubArgs);
+  JitSpew(JitSpew_BaselineBailouts, "      MemCpy from %p", stubArgsEnd.get());
+  memcpy(pointerAtStackOffset<uint8_t>(0).get(), stubArgsEnd.get(),
+         (actualArgc + 1) * sizeof(Value));
+
+  // Push calleeToken again.
+  if (!writePtr(CalleeToToken(nextCallee(), pushedNewTarget), "CalleeToken")) {
+    return false;
+  }
+
+  // Push rectifier frame descriptor
+  size_t rectifierFrameDescr =
+      MakeFrameDescriptorForJitCall(FrameType::Rectifier, actualArgc);
+  if (!writeWord(rectifierFrameDescr, "Descriptor")) {
+    return false;
+  }
+
+  // Push return address into the ArgumentsRectifier code, immediately after the
+  // ioncode call.
+  void* rectReturnAddr =
+      cx_->runtime()->jitRuntime()->getArgumentsRectifierReturnAddr().value;
+  MOZ_ASSERT(rectReturnAddr);
+  if (!writePtr(rectReturnAddr, "ReturnAddr")) {
+    return false;
+  }
+
+  // The stack must be aligned after the callee pushes the frame pointer.
+  MOZ_ASSERT((framePushed() + sizeof(void*)) % JitStackAlignment == 0);
+
+  return true;
+}
+
+bool BaselineStackBuilder::finishLastFrame() {
+  const BaselineInterpreter& baselineInterp =
+      cx_->runtime()->jitRuntime()->baselineInterpreter();
+
+  setResumeFramePtr(prevFramePtr());
+
+  // Compute the native address (within the Baseline Interpreter) that we will
+  // resume at and initialize the frame's interpreter fields.
+  uint8_t* resumeAddr;
+  if (isPrologueBailout()) {
+    JitSpew(JitSpew_BaselineBailouts, "      Resuming into prologue.");
+    MOZ_ASSERT(pc_ == script_->code());
+    blFrame()->setInterpreterFieldsForPrologue(script_);
+    resumeAddr = baselineInterp.bailoutPrologueEntryAddr();
+  } else if (propagatingIonExceptionForDebugMode()) {
+    // When propagating an exception for debug mode, set the
+    // resume pc to the throwing pc, so that Debugger hooks report
+    // the correct pc offset of the throwing op instead of its
+    // successor.
+    jsbytecode* throwPC = script_->offsetToPC(iter_.pcOffset());
+    blFrame()->setInterpreterFields(script_, throwPC);
+    resumeAddr = baselineInterp.interpretOpAddr().value;
+  } else {
+    jsbytecode* resumePC = getResumePC();
+    blFrame()->setInterpreterFields(script_, resumePC);
+    resumeAddr = baselineInterp.interpretOpAddr().value;
+  }
+  setResumeAddr(resumeAddr);
+  JitSpew(JitSpew_BaselineBailouts, "      Set resumeAddr=%p", resumeAddr);
+
+  if (cx_->runtime()->geckoProfiler().enabled()) {
+    // Register bailout with profiler.
+    const char* filename = script_->filename();
+    if (filename == nullptr) {
+      filename = "<unknown>";
+    }
+    unsigned len = strlen(filename) + 200;
+    UniqueChars buf(js_pod_malloc<char>(len));
+    if (buf == nullptr) {
+      ReportOutOfMemory(cx_);
+      return false;
+    }
+    snprintf(buf.get(), len, "%s %s %s on line %u of %s:%u",
+             BailoutKindString(bailoutKind()), resumeAfter() ? "after" : "at",
+             CodeName(op_), PCToLineNumber(script_, pc_), filename,
+             script_->lineno());
+    cx_->runtime()->geckoProfiler().markEvent("Bailout", buf.get());
+  }
+
+  return true;
+}
+
+#ifdef DEBUG
+// The |envChain| slot must not be optimized out if the currently
+// active scope requires any EnvironmentObjects beyond what is
+// available at body scope. This checks that scope chain does not
+// require any such EnvironmentObjects.
+// See also: |CompileInfo::isObservableFrameSlot|
+bool BaselineStackBuilder::envChainSlotCanBeOptimized() {
+  jsbytecode* pc = script_->offsetToPC(iter_.pcOffset());
+  Scope* scopeIter = script_->innermostScope(pc);
+  while (scopeIter != script_->bodyScope()) {
+    if (!scopeIter || scopeIter->hasEnvironment()) {
+      return false;
+    }
+    scopeIter = scopeIter->enclosing();
+  }
+  return true;
+}
+
+bool jit::AssertBailoutStackDepth(JSContext* cx, JSScript* script,
+                                  jsbytecode* pc, ResumeMode mode,
+                                  uint32_t exprStackSlots) {
+  if (IsResumeAfter(mode)) {
+    pc = GetNextPc(pc);
+  }
+
+  uint32_t expectedDepth;
+  bool reachablePC;
+  if (!ReconstructStackDepth(cx, script, pc, &expectedDepth, &reachablePC)) {
+    return false;
+  }
+  if (!reachablePC) {
+    return true;
+  }
+
+  JSOp op = JSOp(*pc);
+
+  if (mode == ResumeMode::InlinedFunCall) {
+    // For inlined fun.call(this, ...); the reconstructed stack depth will
+    // include the |this|, but the exprStackSlots won't.
+    // Exception: if there are no arguments, the depths do match.
+    MOZ_ASSERT(IsInvokeOp(op));
+    if (GET_ARGC(pc) > 0) {
+      MOZ_ASSERT(expectedDepth == exprStackSlots + 1);
+    } else {
+      MOZ_ASSERT(expectedDepth == exprStackSlots);
+    }
+    return true;
+  }
+
+  if (mode == ResumeMode::InlinedAccessor) {
+    // Accessors coming out of ion are inlined via a complete lie perpetrated by
+    // the compiler internally. Ion just rearranges the stack, and pretends that
+    // it looked like a call all along.
+    // This means that the depth is actually one *more* than expected by the
+    // interpreter, as there is now a JSFunction, |this| and [arg], rather than
+    // the expected |this| and [arg].
+    // If the inlined accessor is a GetElem operation, the numbers do match, but
+    // that's just because GetElem expects one more item on the stack. Note that
+    // none of that was pushed, but it's still reflected in exprStackSlots.
+    MOZ_ASSERT(IsIonInlinableGetterOrSetterOp(op));
+    if (IsGetElemOp(op)) {
+      MOZ_ASSERT(exprStackSlots == expectedDepth);
+    } else {
+      MOZ_ASSERT(exprStackSlots == expectedDepth + 1);
+    }
+    return true;
+  }
+
+  // In all other cases, the depth must match.
+  MOZ_ASSERT(exprStackSlots == expectedDepth);
+  return true;
+}
+
+bool BaselineStackBuilder::validateFrame() {
+  const uint32_t frameSize = framePushed();
+  blFrame()->setDebugFrameSize(frameSize);
+  JitSpew(JitSpew_BaselineBailouts, "      FrameSize=%u", frameSize);
+
+  // debugNumValueSlots() is based on the frame size, do some sanity checks.
+  MOZ_ASSERT(blFrame()->debugNumValueSlots() >= script_->nfixed());
+  MOZ_ASSERT(blFrame()->debugNumValueSlots() <= script_->nslots());
+
+  uint32_t expectedSlots = exprStackSlots();
+  if (resumingInFinallyBlock()) {
+    // If we are resuming in a finally block, we push two extra values on the
+    // stack (the exception, and |throwing|), so the depth at the resume PC
+    // should be the depth at the fault PC plus two.
+    expectedSlots += 2;
+  }
+  return AssertBailoutStackDepth(cx_, script_, pc_, resumeMode(),
+                                 expectedSlots);
+}
+#endif
+
+void* BaselineStackBuilder::getStubReturnAddress() {
+  const BaselineICFallbackCode& code =
+      cx_->runtime()->jitRuntime()->baselineICFallbackCode();
+
+  if (IsGetPropOp(op_)) {
+    return code.bailoutReturnAddr(BailoutReturnKind::GetProp);
+  }
+  if (IsSetPropOp(op_)) {
+    return code.bailoutReturnAddr(BailoutReturnKind::SetProp);
+  }
+  if (IsGetElemOp(op_)) {
+    return code.bailoutReturnAddr(BailoutReturnKind::GetElem);
+  }
+
+  // This should be a call op of some kind, now.
+  MOZ_ASSERT(IsInvokeOp(op_) && !IsSpreadOp(op_));
+  if (IsConstructOp(op_)) {
+    return code.bailoutReturnAddr(BailoutReturnKind::New);
+  }
+  return code.bailoutReturnAddr(BailoutReturnKind::Call);
+}
+
+static inline jsbytecode* GetNextNonLoopHeadPc(jsbytecode* pc) {
+  JSOp op = JSOp(*pc);
+  switch (op) {
+    case JSOp::Goto:
+      return pc + GET_JUMP_OFFSET(pc);
+
+    case JSOp::LoopHead:
+    case JSOp::Nop:
+      return GetNextPc(pc);
+
+    default:
+      return pc;
+  }
+}
+
+// Returns the pc to resume execution at in Baseline after a bailout.
+jsbytecode* BaselineStackBuilder::getResumePC() {
+  if (resumeAfter()) {
+    return GetNextPc(pc_);
+  }
+
+  // If we are resuming at a LoopHead op, resume at the next op to avoid
+  // a bailout -> enter Ion -> bailout loop with --ion-eager.
+  //
+  // Cycles can cause the loop below to not terminate. Empty loops are one
+  // such example:
+  //
+  //   L: loophead
+  //      goto L
+  //
+  // We do cycle detection below with the "tortoise and the hare" algorithm.
+  jsbytecode* slowerPc = pc_;
+  jsbytecode* fasterPc = pc_;
+  while (true) {
+    // Advance fasterPc twice as fast as slowerPc.
+    slowerPc = GetNextNonLoopHeadPc(slowerPc);
+    fasterPc = GetNextNonLoopHeadPc(fasterPc);
+    fasterPc = GetNextNonLoopHeadPc(fasterPc);
+
+    // Break on cycles or at the end of goto sequences.
+    if (fasterPc == slowerPc) {
+      break;
+    }
+  }
+
+  return slowerPc;
+}
+
+bool BaselineStackBuilder::isPrologueBailout() {
+  // If we are propagating an exception for debug mode, we will not resume
+  // into baseline code, but instead into HandleExceptionBaseline (i.e.,
+  // never before the prologue).
+  return iter_.pcOffset() == 0 && !iter_.resumeAfter() &&
+         !propagatingIonExceptionForDebugMode();
+}
+
+// Build a baseline stack frame.
+bool BaselineStackBuilder::buildOneFrame() {
+  // Build a baseline frame:
+  // +===============+
+  // | PrevFramePtr  | <-- initFrame()
+  // +---------------+
+  // |   Baseline    | <-- buildBaselineFrame()
+  // |    Frame      |
+  // +---------------+
+  // |    Fixed0     | <-- buildFixedSlots()
+  // +---------------+
+  // |     ...       |
+  // +---------------+
+  // |    FixedF     |
+  // +---------------+
+  // |    Stack0     | <-- buildExpressionStack() -or- fixupCallerArgs()
+  // +---------------+
+  // |     ...       |
+  // +---------------+     If we are building the frame in which we will
+  // |    StackS     | <-- resume, we stop here.
+  // +---------------+     finishLastFrame() sets up the interpreter fields.
+  // .               .
+  // .               .
+  // .               . <-- If there are additional frames inlined into this
+  // |  Descr(BLJS)  |     one, we finish this frame. We generate a stub
+  // +---------------+     frame (and maybe also a rectifier frame) between
+  // |  ReturnAddr   |     this frame and the inlined frame.
+  // +===============+     See: prepareForNextFrame()
+
+  if (!initFrame()) {
+    return false;
+  }
+
+  if (!buildBaselineFrame()) {
+    return false;
+  }
+
+  if (fun_ && !buildArguments()) {
+    return false;
+  }
+
+  if (!buildFixedSlots()) {
+    return false;
+  }
+
+  bool fixedUp = false;
+  RootedValueVector savedCallerArgs(cx_);
+  if (iter_.moreFrames() && !fixUpCallerArgs(&savedCallerArgs, &fixedUp)) {
+    return false;
+  }
+
+  if (!fixedUp) {
+    if (!buildExpressionStack()) {
+      return false;
+    }
+    if (resumingInFinallyBlock() && !buildFinallyException()) {
+      return false;
+    }
+  }
+
+#ifdef DEBUG
+  if (!validateFrame()) {
+    return false;
+  }
+#endif
+
+#ifdef JS_JITSPEW
+  const uint32_t pcOff = script_->pcToOffset(pc());
+  JitSpew(JitSpew_BaselineBailouts,
+          "      Resuming %s pc offset %d (op %s) (line %u) of %s:%u:%u",
+          resumeAfter() ? "after" : "at", (int)pcOff, CodeName(op_),
+          PCToLineNumber(script_, pc()), script_->filename(), script_->lineno(),
+          script_->column());
+  JitSpew(JitSpew_BaselineBailouts, "      Bailout kind: %s",
+          BailoutKindString(bailoutKind()));
+#endif
+
+  // If this was the last inline frame, or we are bailing out to a catch or
+  // finally block in this frame, then unpacking is almost done.
+  if (done()) {
+    return finishLastFrame();
+  }
+
+  // Otherwise, this is an outer frame for an inlined call or
+  // accessor. We will be building an inner frame. Before that,
+  // we must create a stub frame, and potentially a rectifier frame.
+  return prepareForNextFrame(savedCallerArgs);
+}
+
+bool jit::BailoutIonToBaseline(JSContext* cx, JitActivation* activation,
+                               const JSJitFrameIter& iter,
+                               BaselineBailoutInfo** bailoutInfo,
+                               const ExceptionBailoutInfo* excInfo,
+                               BailoutReason reason) {
+  MOZ_ASSERT(bailoutInfo != nullptr);
+  MOZ_ASSERT(*bailoutInfo == nullptr);
+  MOZ_ASSERT(iter.isBailoutJS());
+
+  // Caller should have saved the exception while we perform the bailout.
+  MOZ_ASSERT(!cx->isExceptionPending());
+
+  // Ion bailout can fail due to overrecursion and OOM. In such cases we
+  // cannot honor any further Debugger hooks on the frame, and need to
+  // ensure that its Debugger.Frame entry is cleaned up.
+  auto guardRemoveRematerializedFramesFromDebugger =
+      mozilla::MakeScopeExit([&] {
+        activation->removeRematerializedFramesFromDebugger(cx, iter.fp());
+      });
+
+  // Always remove the RInstructionResults from the JitActivation, even in
+  // case of failures as the stack frame is going away after the bailout.
+  auto removeIonFrameRecovery = mozilla::MakeScopeExit(
+      [&] { activation->removeIonFrameRecovery(iter.jsFrame()); });
+
+  // The caller of the top frame must be one of the following:
+  //      IonJS - Ion calling into Ion.
+  //      BaselineStub - Baseline calling into Ion.
+  //      Entry / WasmToJSJit - Interpreter or other (wasm) calling into Ion.
+  //      Rectifier - Arguments rectifier calling into Ion.
+  //      BaselineJS - Resume'd Baseline, then likely OSR'd into Ion.
+  MOZ_ASSERT(iter.isBailoutJS());
+#if defined(DEBUG) || defined(JS_JITSPEW)
+  FrameType prevFrameType = iter.prevType();
+  MOZ_ASSERT(JSJitFrameIter::isEntry(prevFrameType) ||
+             prevFrameType == FrameType::IonJS ||
+             prevFrameType == FrameType::BaselineStub ||
+             prevFrameType == FrameType::Rectifier ||
+             prevFrameType == FrameType::IonICCall ||
+             prevFrameType == FrameType::BaselineJS);
+#endif
+
+  // All incoming frames are going to look like this:
+  //
+  //      +---------------+
+  //      |     ...       |
+  //      +---------------+
+  //      |     Args      |
+  //      |     ...       |
+  //      +---------------+
+  //      |    ThisV      |
+  //      +---------------+
+  //      |  ActualArgC   |
+  //      +---------------+
+  //      |  CalleeToken  |
+  //      +---------------+
+  //      |  Descriptor   |
+  //      +---------------+
+  //      |  ReturnAddr   |
+  //      +---------------+
+  //      |    |||||      | <---- Overwrite starting here.
+  //      |    |||||      |
+  //      |    |||||      |
+  //      +---------------+
+
+  JitSpew(JitSpew_BaselineBailouts,
+          "Bailing to baseline %s:%u:%u (IonScript=%p) (FrameType=%d)",
+          iter.script()->filename(), iter.script()->lineno(),
+          iter.script()->column(), (void*)iter.ionScript(), (int)prevFrameType);
+
+  if (excInfo) {
+    if (excInfo->catchingException()) {
+      JitSpew(JitSpew_BaselineBailouts, "Resuming in catch or finally block");
+    }
+    if (excInfo->propagatingIonExceptionForDebugMode()) {
+      JitSpew(JitSpew_BaselineBailouts, "Resuming in-place for debug mode");
+    }
+  }
+
+  JitSpew(JitSpew_BaselineBailouts,
+          "  Reading from snapshot offset %u size %zu", iter.snapshotOffset(),
+          iter.ionScript()->snapshotsListSize());
+
+  iter.script()->updateJitCodeRaw(cx->runtime());
+
+  // Under a bailout, there is no need to invalidate the frame after
+  // evaluating the recover instruction, as the invalidation is only needed in
+  // cases where the frame is introspected ahead of the bailout.
+  MaybeReadFallback recoverBailout(cx, activation, &iter,
+                                   MaybeReadFallback::Fallback_DoNothing);
+
+  // Ensure that all value locations are readable from the SnapshotIterator.
+  // Get the RInstructionResults from the JitActivation if the frame got
+  // recovered ahead of the bailout.
+  SnapshotIterator snapIter(iter, activation->bailoutData()->machineState());
+  if (!snapIter.initInstructionResults(recoverBailout)) {
+    return false;
+  }
+
+#ifdef TRACK_SNAPSHOTS
+  snapIter.spewBailingFrom();
+#endif
+
+  BaselineStackBuilder builder(cx, iter, snapIter, excInfo, reason);
+  if (!builder.init()) {
+    return false;
+  }
+
+  JitSpew(JitSpew_BaselineBailouts, "  Incoming frame ptr = %p",
+          builder.startFrame());
+  if (iter.maybeCallee()) {
+    JitSpew(JitSpew_BaselineBailouts, "  Callee function (%s:%u:%u)",
+            iter.script()->filename(), iter.script()->lineno(),
+            iter.script()->column());
+  } else {
+    JitSpew(JitSpew_BaselineBailouts, "  No callee!");
+  }
+
+  if (iter.isConstructing()) {
+    JitSpew(JitSpew_BaselineBailouts, "  Constructing!");
+  } else {
+    JitSpew(JitSpew_BaselineBailouts, "  Not constructing!");
+  }
+
+  JitSpew(JitSpew_BaselineBailouts, "  Restoring frames:");
+
+  while (true) {
+    // Skip recover instructions as they are already recovered by
+    // |initInstructionResults|.
+    snapIter.settleOnFrame();
+
+    JitSpew(JitSpew_BaselineBailouts, "    FrameNo %zu", builder.frameNo());
+
+    if (!builder.buildOneFrame()) {
+      MOZ_ASSERT(cx->isExceptionPending());
+      return false;
+    }
+
+    if (builder.done()) {
+      break;
+    }
+
+    builder.nextFrame();
+  }
+  JitSpew(JitSpew_BaselineBailouts, "  Done restoring frames");
+
+  BailoutKind bailoutKind = builder.bailoutKind();
+
+  if (!builder.outermostFrameFormals().empty()) {
+    // Set the first frame's formals, see the comment in InitFromBailout.
+    Value* argv = builder.startFrame()->actualArgs();
+    mozilla::PodCopy(argv, builder.outermostFrameFormals().begin(),
+                     builder.outermostFrameFormals().length());
+  }
+
+  // Do stack check.
+  bool overRecursed = false;
+  BaselineBailoutInfo* info = builder.info();
+  size_t numBytesToPush = info->copyStackTop - info->copyStackBottom;
+  MOZ_ASSERT((numBytesToPush % sizeof(uintptr_t)) == 0);
+  uint8_t* newsp = info->incomingStack - numBytesToPush;
+#ifdef JS_SIMULATOR
+  if (Simulator::Current()->overRecursed(uintptr_t(newsp))) {
+    overRecursed = true;
+  }
+#else
+  AutoCheckRecursionLimit recursion(cx);
+  if (!recursion.checkWithStackPointerDontReport(cx, newsp)) {
+    overRecursed = true;
+  }
+#endif
+  if (overRecursed) {
+    JitSpew(JitSpew_BaselineBailouts, "  Overrecursion check failed!");
+    ReportOverRecursed(cx);
+    return false;
+  }
+
+  // Take the reconstructed baseline stack so it doesn't get freed when builder
+  // destructs.
+  info = builder.takeBuffer();
+  info->numFrames = builder.frameNo() + 1;
+  info->bailoutKind.emplace(bailoutKind);
+  *bailoutInfo = info;
+  guardRemoveRematerializedFramesFromDebugger.release();
+  return true;
+}
+
+static void InvalidateAfterBailout(JSContext* cx, HandleScript outerScript,
+                                   const char* reason) {
+  // In some cases, the computation of recover instruction can invalidate the
+  // Ion script before we reach the end of the bailout. Thus, if the outer
+  // script no longer have any Ion script attached, then we just skip the
+  // invalidation.
+  //
+  // For example, such case can happen if the template object for an unboxed
+  // objects no longer match the content of its properties (see Bug 1174547)
+  if (!outerScript->hasIonScript()) {
+    JitSpew(JitSpew_BaselineBailouts, "Ion script is already invalidated");
+    return;
+  }
+
+  MOZ_ASSERT(!outerScript->ionScript()->invalidated());
+
+  JitSpew(JitSpew_BaselineBailouts, "Invalidating due to %s", reason);
+  Invalidate(cx, outerScript);
+}
+
+static void HandleLexicalCheckFailure(JSContext* cx, HandleScript outerScript,
+                                      HandleScript innerScript) {
+  JitSpew(JitSpew_IonBailouts,
+          "Lexical check failure %s:%u:%u, inlined into %s:%u:%u",
+          innerScript->filename(), innerScript->lineno(), innerScript->column(),
+          outerScript->filename(), outerScript->lineno(),
+          outerScript->column());
+
+  if (!innerScript->failedLexicalCheck()) {
+    innerScript->setFailedLexicalCheck();
+  }
+
+  InvalidateAfterBailout(cx, outerScript, "lexical check failure");
+  if (innerScript->hasIonScript()) {
+    Invalidate(cx, innerScript);
+  }
+}
+
+static bool CopyFromRematerializedFrame(JSContext* cx, JitActivation* act,
+                                        uint8_t* fp, size_t inlineDepth,
+                                        BaselineFrame* frame) {
+  RematerializedFrame* rematFrame =
+      act->lookupRematerializedFrame(fp, inlineDepth);
+
+  // We might not have rematerialized a frame if the user never requested a
+  // Debugger.Frame for it.
+  if (!rematFrame) {
+    return true;
+  }
+
+  MOZ_ASSERT(rematFrame->script() == frame->script());
+  MOZ_ASSERT(rematFrame->numActualArgs() == frame->numActualArgs());
+
+  frame->setEnvironmentChain(rematFrame->environmentChain());
+
+  if (frame->isFunctionFrame()) {
+    frame->thisArgument() = rematFrame->thisArgument();
+  }
+
+  for (unsigned i = 0; i < frame->numActualArgs(); i++) {
+    frame->argv()[i] = rematFrame->argv()[i];
+  }
+
+  for (size_t i = 0; i < frame->script()->nfixed(); i++) {
+    *frame->valueSlot(i) = rematFrame->locals()[i];
+  }
+
+  frame->setReturnValue(rematFrame->returnValue());
+
+  // Don't copy over the hasCachedSavedFrame bit. The new BaselineFrame we're
+  // building has a different AbstractFramePtr, so it won't be found in the
+  // LiveSavedFrameCache if we look there.
+
+  JitSpew(JitSpew_BaselineBailouts,
+          "  Copied from rematerialized frame at (%p,%zu)", fp, inlineDepth);
+
+  // Propagate the debuggee frame flag. For the case where the Debugger did
+  // not rematerialize an Ion frame, the baseline frame has its debuggee
+  // flag set iff its script is considered a debuggee. See the debuggee case
+  // in InitFromBailout.
+  if (rematFrame->isDebuggee()) {
+    frame->setIsDebuggee();
+    return DebugAPI::handleIonBailout(cx, rematFrame, frame);
+  }
+
+  return true;
+}
+
+enum class BailoutAction {
+  InvalidateImmediately,
+  InvalidateIfFrequent,
+  DisableIfFrequent,
+  NoAction
+};
+
+bool jit::FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfoArg) {
+  JitSpew(JitSpew_BaselineBailouts, "  Done restoring frames");
+
+  // Use UniquePtr to free the bailoutInfo before we return.
+  UniquePtr<BaselineBailoutInfo> bailoutInfo(bailoutInfoArg);
+  bailoutInfoArg = nullptr;
+
+  MOZ_DIAGNOSTIC_ASSERT(*bailoutInfo->bailoutKind != BailoutKind::Unreachable);
+
+  JSContext* cx = TlsContext.get();
+  BaselineFrame* topFrame = GetTopBaselineFrame(cx);
+
+  // We have to get rid of the rematerialized frame, whether it is
+  // restored or unwound.
+  uint8_t* incomingStack = bailoutInfo->incomingStack;
+  auto guardRemoveRematerializedFramesFromDebugger =
+      mozilla::MakeScopeExit([&] {
+        JitActivation* act = cx->activation()->asJit();
+        act->removeRematerializedFramesFromDebugger(cx, incomingStack);
+      });
+
+  // Ensure the frame has a call object if it needs one.
+  if (!EnsureHasEnvironmentObjects(cx, topFrame)) {
+    return false;
+  }
+
+  // Create arguments objects for bailed out frames, to maintain the invariant
+  // that script->needsArgsObj() implies frame->hasArgsObj().
+  RootedScript innerScript(cx, nullptr);
+  RootedScript outerScript(cx, nullptr);
+
+  MOZ_ASSERT(cx->currentlyRunningInJit());
+  JSJitFrameIter iter(cx->activation()->asJit());
+  uint8_t* outerFp = nullptr;
+
+  // Iter currently points at the exit frame.  Get the previous frame
+  // (which must be a baseline frame), and set it as the last profiling
+  // frame.
+  if (cx->runtime()->jitRuntime()->isProfilerInstrumentationEnabled(
+          cx->runtime())) {
+    MOZ_ASSERT(iter.prevType() == FrameType::BaselineJS);
+    JitFrameLayout* fp = reinterpret_cast<JitFrameLayout*>(iter.prevFp());
+    cx->jitActivation->setLastProfilingFrame(fp);
+  }
+
+  uint32_t numFrames = bailoutInfo->numFrames;
+  MOZ_ASSERT(numFrames > 0);
+
+  uint32_t frameno = 0;
+  while (frameno < numFrames) {
+    MOZ_ASSERT(!iter.isIonJS());
+
+    if (iter.isBaselineJS()) {
+      BaselineFrame* frame = iter.baselineFrame();
+      MOZ_ASSERT(frame->script()->hasBaselineScript());
+
+      // If the frame doesn't even have a env chain set yet, then it's resuming
+      // into the the prologue before the env chain is initialized.  Any
+      // necessary args object will also be initialized there.
+      if (frame->environmentChain() && frame->script()->needsArgsObj()) {
+        ArgumentsObject* argsObj;
+        if (frame->hasArgsObj()) {
+          argsObj = &frame->argsObj();
+        } else {
+          argsObj = ArgumentsObject::createExpected(cx, frame);
+          if (!argsObj) {
+            return false;
+          }
+        }
+
+        // The arguments is a local binding and needsArgsObj does not
+        // check if it is clobbered. Ensure that the local binding
+        // restored during bailout before storing the arguments object
+        // to the slot.
+        RootedScript script(cx, frame->script());
+        SetFrameArgumentsObject(cx, frame, script, argsObj);
+      }
+
+      if (frameno == 0) {
+        innerScript = frame->script();
+      }
+
+      if (frameno == numFrames - 1) {
+        outerScript = frame->script();
+        outerFp = iter.fp();
+        MOZ_ASSERT(outerFp == incomingStack);
+      }
+
+      frameno++;
+    }
+
+    ++iter;
+  }
+
+  MOZ_ASSERT(innerScript);
+  MOZ_ASSERT(outerScript);
+  MOZ_ASSERT(outerFp);
+
+  // If we rematerialized Ion frames due to debug mode toggling, copy their
+  // values into the baseline frame. We need to do this even when debug mode
+  // is off, as we should respect the mutations made while debug mode was
+  // on.
+  JitActivation* act = cx->activation()->asJit();
+  if (act->hasRematerializedFrame(outerFp)) {
+    JSJitFrameIter iter(act);
+    size_t inlineDepth = numFrames;
+    bool ok = true;
+    while (inlineDepth > 0) {
+      if (iter.isBaselineJS()) {
+        // We must attempt to copy all rematerialized frames over,
+        // even if earlier ones failed, to invoke the proper frame
+        // cleanup in the Debugger.
+        if (!CopyFromRematerializedFrame(cx, act, outerFp, --inlineDepth,
+                                         iter.baselineFrame())) {
+          ok = false;
+        }
+      }
+      ++iter;
+    }
+
+    if (!ok) {
+      return false;
+    }
+
+    // After copying from all the rematerialized frames, remove them from
+    // the table to keep the table up to date.
+    guardRemoveRematerializedFramesFromDebugger.release();
+    act->removeRematerializedFrame(outerFp);
+  }
+
+  // If we are unwinding for an exception, we need to unwind scopes.
+  // See |SettleOnTryNote|
+  if (bailoutInfo->faultPC) {
+    EnvironmentIter ei(cx, topFrame, bailoutInfo->faultPC);
+    UnwindEnvironment(cx, ei, bailoutInfo->tryPC);
+  }
+
+  // Check for interrupts now because we might miss an interrupt check in JIT
+  // code when resuming in the prologue, after the stack/interrupt check.
+  if (!cx->isExceptionPending()) {
+    if (!CheckForInterrupt(cx)) {
+      return false;
+    }
+  }
+
+  BailoutKind bailoutKind = *bailoutInfo->bailoutKind;
+  JitSpew(JitSpew_BaselineBailouts,
+          "  Restored outerScript=(%s:%u:%u,%u) innerScript=(%s:%u:%u,%u) "
+          "(bailoutKind=%u)",
+          outerScript->filename(), outerScript->lineno(), outerScript->column(),
+          outerScript->getWarmUpCount(), innerScript->filename(),
+          innerScript->lineno(), innerScript->column(),
+          innerScript->getWarmUpCount(), (unsigned)bailoutKind);
+
+  BailoutAction action = BailoutAction::InvalidateImmediately;
+  DebugOnly<bool> saveFailedICHash = false;
+  switch (bailoutKind) {
+    case BailoutKind::TranspiledCacheIR:
+      // A transpiled guard failed. If this happens often enough, we will
+      // invalidate and recompile.
+      action = BailoutAction::InvalidateIfFrequent;
+      saveFailedICHash = true;
+      break;
+
+    case BailoutKind::SpeculativePhi:
+      // A value of an unexpected type flowed into a phi.
+      MOZ_ASSERT(!outerScript->hadSpeculativePhiBailout());
+      outerScript->setHadSpeculativePhiBailout();
+      InvalidateAfterBailout(cx, outerScript, "phi specialization failure");
+      break;
+
+    case BailoutKind::TypePolicy:
+      // A conversion inserted by a type policy failed.
+      // We will invalidate and disable recompilation if this happens too often.
+      action = BailoutAction::DisableIfFrequent;
+      break;
+
+    case BailoutKind::LICM:
+      // LICM may cause spurious bailouts by hoisting unreachable
+      // guards past branches.  To prevent bailout loops, when an
+      // instruction hoisted by LICM bails out, we update the
+      // IonScript and resume in baseline. If the guard would have
+      // been executed anyway, then we will hit the baseline fallback,
+      // and call noteBaselineFallback. If that does not happen,
+      // then the next time we reach this point, we will disable LICM
+      // for this script.
+      MOZ_ASSERT(!outerScript->hadLICMInvalidation());
+      if (outerScript->hasIonScript()) {
+        switch (outerScript->ionScript()->licmState()) {
+          case IonScript::LICMState::NeverBailed:
+            outerScript->ionScript()->setHadLICMBailout();
+            action = BailoutAction::NoAction;
+            break;
+          case IonScript::LICMState::Bailed:
+            outerScript->setHadLICMInvalidation();
+            InvalidateAfterBailout(cx, outerScript, "LICM failure");
+            break;
+          case IonScript::LICMState::BailedAndHitFallback:
+            // This bailout is not due to LICM. Treat it like a
+            // regular TranspiledCacheIR bailout.
+            action = BailoutAction::InvalidateIfFrequent;
+            break;
+        }
+      }
+      break;
+
+    case BailoutKind::InstructionReordering:
+      // An instruction moved up by instruction reordering bailed out.
+      outerScript->setHadReorderingBailout();
+      action = BailoutAction::InvalidateIfFrequent;
+      break;
+
+    case BailoutKind::HoistBoundsCheck:
+      // An instruction hoisted or generated by tryHoistBoundsCheck bailed out.
+      MOZ_ASSERT(!outerScript->failedBoundsCheck());
+      outerScript->setFailedBoundsCheck();
+      InvalidateAfterBailout(cx, outerScript, "bounds check failure");
+      break;
+
+    case BailoutKind::EagerTruncation:
+      // An eager truncation generated by range analysis bailed out.
+      // To avoid bailout loops, we set a flag to avoid generating
+      // eager truncations next time we recompile.
+      MOZ_ASSERT(!outerScript->hadEagerTruncationBailout());
+      outerScript->setHadEagerTruncationBailout();
+      InvalidateAfterBailout(cx, outerScript, "eager range analysis failure");
+      break;
+
+    case BailoutKind::UnboxFolding:
+      // An unbox that was hoisted to fold with a load bailed out.
+      // To avoid bailout loops, we set a flag to avoid folding
+      // loads with unboxes next time we recompile.
+      MOZ_ASSERT(!outerScript->hadUnboxFoldingBailout());
+      outerScript->setHadUnboxFoldingBailout();
+      InvalidateAfterBailout(cx, outerScript, "unbox folding failure");
+      break;
+
+    case BailoutKind::TooManyArguments:
+      // A funapply or spread call had more than JIT_ARGS_LENGTH_MAX arguments.
+      // We will invalidate and disable recompilation if this happens too often.
+      action = BailoutAction::DisableIfFrequent;
+      break;
+
+    case BailoutKind::DuringVMCall:
+      if (cx->isExceptionPending()) {
+        // We are bailing out to catch an exception. We will invalidate
+        // and disable recompilation if this happens too often.
+        action = BailoutAction::DisableIfFrequent;
+      }
+      break;
+
+    case BailoutKind::Finally:
+      // We are bailing out for a finally block. We will invalidate
+      // and disable recompilation if this happens too often.
+      action = BailoutAction::DisableIfFrequent;
+      break;
+
+    case BailoutKind::Inevitable:
+    case BailoutKind::Debugger:
+      // Do nothing.
+      action = BailoutAction::NoAction;
+      break;
+
+    case BailoutKind::FirstExecution:
+      // We reached an instruction that had not been executed yet at
+      // the time we compiled. If this happens often enough, we will
+      // invalidate and recompile.
+      action = BailoutAction::InvalidateIfFrequent;
+      saveFailedICHash = true;
+      break;
+
+    case BailoutKind::UninitializedLexical:
+      HandleLexicalCheckFailure(cx, outerScript, innerScript);
+      break;
+
+    case BailoutKind::ThrowCheckIsObject:
+      MOZ_ASSERT(!cx->isExceptionPending());
+      return ThrowCheckIsObject(cx, CheckIsObjectKind::IteratorReturn);
+
+    case BailoutKind::IonExceptionDebugMode:
+      // Return false to resume in HandleException with reconstructed
+      // baseline frame.
+      return false;
+
+    case BailoutKind::OnStackInvalidation:
+      // The script has already been invalidated. There is nothing left to do.
+      action = BailoutAction::NoAction;
+      break;
+
+    default:
+      MOZ_CRASH("Unknown bailout kind!");
+  }
+
+#ifdef DEBUG
+  if (MOZ_UNLIKELY(cx->runtime()->jitRuntime()->ionBailAfterEnabled())) {
+    action = BailoutAction::NoAction;
+  }
+#endif
+
+  if (outerScript->hasIonScript()) {
+    IonScript* ionScript = outerScript->ionScript();
+    switch (action) {
+      case BailoutAction::InvalidateImmediately:
+        // The IonScript should already have been invalidated.
+        MOZ_ASSERT(false);
+        break;
+      case BailoutAction::InvalidateIfFrequent:
+        ionScript->incNumFixableBailouts();
+        if (ionScript->shouldInvalidate()) {
+#ifdef DEBUG
+          if (saveFailedICHash && !JitOptions.disableBailoutLoopCheck) {
+            outerScript->jitScript()->setFailedICHash(ionScript->icHash());
+          }
+#endif
+          InvalidateAfterBailout(cx, outerScript, "fixable bailouts");
+        }
+        break;
+      case BailoutAction::DisableIfFrequent:
+        ionScript->incNumUnfixableBailouts();
+        if (ionScript->shouldInvalidateAndDisable()) {
+          InvalidateAfterBailout(cx, outerScript, "unfixable bailouts");
+          outerScript->disableIon();
+        }
+        break;
+      case BailoutAction::NoAction:
+        break;
+    }
+  }
+
+  return true;
+}