Fixed potential crash if up-recursive trace compiles and runs before down-recursive trace (build bustage, no_r=me).

This commit is contained in:
David Anderson 2009-09-30 18:12:14 -07:00
parent 293e13ba18
commit 3dbb9078fb

View File

@ -5722,6 +5722,8 @@ AttemptToStabilizeTree(JSContext* cx, JSObject* globalObj, VMSideExit* exit, jsb
if (exit->recursive_pc != cx->fp->regs->pc)
return false;
from = getLoop(tm, exit->recursive_pc, from->globalObj, from->globalShape, cx->fp->argc);
if (!from)
return false;
/* use stale TI for RecordTree - since from might not have one anymore. */
}