Bug 939614: IonMonkey: Fix trying to enter at wrong pc, r=jandem

js/src/jit/BaselineIC.cpp

@@ -801,6 +801,7 @@ EnsureCanEnterIon(JSContext *cx, ICUseCount_Fallback *stub, BaselineFrame *frame
     if (isLoopEntry) {
         IonScript *ion = script->ionScript();
         JS_ASSERT(cx->runtime()->spsProfiler.enabled() == ion->hasSPSInstrumentation());
+        JS_ASSERT(ion->osrPc() == pc);
 
         // If the baseline frame's SPS handling doesn't match up with the Ion code's SPS
         // handling, don't OSR.

js/src/jit/Ion.cpp

@@ -1967,7 +1967,12 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
     }
 
     // Compilation succeeded or we invalidated right away or an inlining/alloc abort
-    return HasIonScript(script, executionMode) ? Method_Compiled : Method_Skipped;
+    if (HasIonScript(script, executionMode)) {
+        if (osrPc && script->ionScript()->osrPc() != osrPc)
+            return Method_Skipped;
+        return Method_Compiled;
+    }
+    return Method_Skipped;
 }
 
 } // namespace jit