From e620dcbddc626086938fc19d396466b128091c4f Mon Sep 17 00:00:00 2001
From: David Anderson <danderson@mozilla.com>
Date: Wed, 9 Jun 2010 22:33:54 -0700
Subject: [PATCH] [JAEGER] Make syncFancy() resume properly.

---
 js/src/methodjit/FrameState.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/js/src/methodjit/FrameState.cpp b/js/src/methodjit/FrameState.cpp
index a13241d2d3..89a1911b74 100644
--- a/js/src/methodjit/FrameState.cpp
+++ b/js/src/methodjit/FrameState.cpp
@@ -265,7 +265,7 @@ struct SyncRegInfo {
  * a situation where a copy's backing store has no register. If we run into
  * this situation, the structure below is used to allocate registers.
  *
- * While walking the tracer, we remember all registers that have been sunk,
+ * While walking the tracker, we remember all registers that have been sunk,
  * and can thus be clobbered. These are given out on a first-come, first-serve
  * basis. If none are available, one is evicted (explained later).
  *
@@ -368,6 +368,7 @@ struct SyncRegs {
          * nothing triggers it. Yay?
          */
         JS_NOT_REACHED("wat");
+        return RegisterID(worst);
     }
 
     /* Returns true if had an fe */
@@ -410,7 +411,7 @@ FrameState::syncFancy(Assembler &masm, Registers avail, uint32 resumeAt) const
     SyncRegs sr(*this, masm, avail);
 
     FrameEntry *tos = tosFe();
-    for (uint32 i = tracker.nentries - 1; i < tracker.nentries; i--) {
+    for (uint32 i = resumeAt; i < tracker.nentries; i--) {
         FrameEntry *fe = tracker[i];
         if (fe >= tos)
             continue;
-- 
2.11.4.GIT