Bug 855807 - Register 'inliner' and not 'inlinee' as the aborted script r=shu

js/src/ion/CodeGenerator.cpp

@@ -5849,7 +5849,14 @@ CodeGenerator::visitFunctionBoundary(LFunctionBoundary *lir)
 bool
 CodeGenerator::visitOutOfLineParallelAbort(OutOfLineParallelAbort *ool)
 {
-    masm.movePtr(ImmWord((void *) current->mir()->info().script()), CallTempReg0);
+    // Subtle: Do not pass the script associated with `current`, which
+    // is often an inlined script or something like that, but rather the
+    // "outermost" JSScript.
+
+    MIRGraph &graph = current->mir()->graph();
+    MBasicBlock *entryBlock = graph.entryBlock();
+
+    masm.movePtr(ImmWord((void *) entryBlock->info().script()), CallTempReg0);
     masm.setupUnalignedABICall(1, CallTempReg1);
     masm.passABIArg(CallTempReg0);
     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ParallelAbort));

js/src/ion/ParallelFunctions.cpp

@@ -207,7 +207,12 @@ ion::ParallelAbort(JSScript *script)
 
     ForkJoinSlice *slice = ForkJoinSlice::Current();
 
-    Spew(SpewBailouts, "Parallel abort in %p:%s:%d", script, script->filename(), script->lineno);
+    Spew(SpewBailouts, "Parallel abort in %p:%s:%d (hasParallelIonScript:%d)",
+         script, script->filename(), script->lineno,
+         script->hasParallelIonScript());
+
+    // Otherwise what the heck are we executing?
+    JS_ASSERT(script->hasParallelIonScript());
 
     if (!slice->abortedScript)
         slice->abortedScript = script;

js/src/vm/ParallelDo.cpp

@@ -614,6 +614,8 @@ class ParallelDo : public ForkJoinOp
         JS_ASSERT(ok == !slice.abortedScript);
         if (!ok) {
             JSScript *script = slice.abortedScript;
+            Spew(SpewBailouts, "Aborted script: %p (hasParallelIonScript? %d)",
+                 script, script->hasParallelIonScript());
             JS_ASSERT(script->hasParallelIonScript());
             pendingInvalidations[slice.sliceId] = script;
         }