From 2031854aca0557afc7c34cadd0d3527e87be3d80 Mon Sep 17 00:00:00 2001
From: David Mandelin <dmandelin@mozilla.com>
Date: Fri, 11 Sep 2009 17:32:20 -0700
Subject: [PATCH] Bug 516009: do stack update after all guards for
 JSOP_LAMBDA_FC, r=gal

---
 js/src/jstracer.cpp                        |  2 +-
 js/src/trace-test/tests/basic/bug516009.js | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 js/src/trace-test/tests/basic/bug516009.js

diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 17b2cfc53eed..d83282d49af0 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -12354,7 +12354,6 @@ TraceRecorder::record_JSOP_LAMBDA_FC()
           addName(lir->ins2(LIR_peq, call_ins, INS_NULL()),
                   "guard(js_AllocFlatClosure)"),
           OOM_EXIT);
-    stack(0, call_ins);
 
     if (fun->u.i.nupvars) {
         JSUpvarArray *uva = fun->u.i.script->upvars();
@@ -12368,6 +12367,7 @@ TraceRecorder::record_JSOP_LAMBDA_FC()
         }
     }
 
+    stack(0, call_ins);
     return JSRS_CONTINUE;
 }
 
diff --git a/js/src/trace-test/tests/basic/bug516009.js b/js/src/trace-test/tests/basic/bug516009.js
new file mode 100644
index 000000000000..db3a359425dc
--- /dev/null
+++ b/js/src/trace-test/tests/basic/bug516009.js
@@ -0,0 +1,20 @@
+var gFutureCalls = [];
+
+function add_future_call(index, func)
+{
+    if (!(index in gFutureCalls)) {
+        gFutureCalls[index] = [];
+    }
+}
+
+function check_reset_test(time)
+{
+}
+
+check_reset_test(0);
+
+for (var i = 1; i <= 8; ++i) {
+    (function(j) {
+        add_future_call(j, function() { check_reset_test(j); });
+    })(i);
+}