Bug 876434 - Compile JSOP_CALLEE with Baseline. r=djvj

js/src/ion/BaselineCompiler.cpp

@@ -2399,6 +2399,17 @@ BaselineCompiler::emit_JSOP_SETRVAL()
     return true;
 }
 
+bool
+BaselineCompiler::emit_JSOP_CALLEE()
+{
+    JS_ASSERT(function());
+    frame.syncStack(0);
+    masm.loadPtr(frame.addressOfCallee(), R0.scratchReg());
+    masm.tagValue(JSVAL_TYPE_OBJECT, R0.scratchReg(), R0);
+    frame.push(R0);
+    return true;
+}
+
 bool
 BaselineCompiler::emit_JSOP_POPV()
 {

js/src/ion/BaselineCompiler.h

@@ -160,6 +160,7 @@ namespace ion {
     _(JSOP_MOREITER)           \
     _(JSOP_ITERNEXT)           \
     _(JSOP_ENDITER)            \
+    _(JSOP_CALLEE)             \
     _(JSOP_POPV)               \
     _(JSOP_SETRVAL)            \
     _(JSOP_RETURN)             \

js/src/jit-test/tests/baseline/callee.js

@@ -0,0 +1,5 @@
+ff = (function g() {
+    for (var i=0; i<15; i++) {}
+    return g;
+});
+assertEq(ff(), ff);

js/src/jit-test/tests/basic/bug522136.js

@@ -7,4 +7,4 @@ try {
 }
 
 // Exact behavior of recursion check depends on which JIT we use.
-assertEq(thrown && Q > 8000, true);
+assertEq(thrown && Q > 3500, true);