Bug 1350171 - Try to transition IC mode before attaching AddSlot stubs. r=h4writer

js/src/jit-test/tests/cacheir/bug1350171.js

@@ -0,0 +1,8 @@
+function test() {
+    var o = {};
+    o.watch('x', test);
+    try {
+        o.x = 3;
+    } catch(e) {}
+}
+test();

js/src/jit/BaselineIC.cpp

@@ -1578,7 +1578,15 @@ DoSetPropFallback(JSContext* cx, BaselineFrame* frame, ICSetProp_Fallback* stub_
     if (stub.invalid())
         return true;
 
-    if (!attached && stub->state().canAttachStub()) {
+    if (attached)
+        return true;
+
+    // The SetProperty call might have entered this IC recursively, so try
+    // to transition.
+    if (stub->state().maybeTransition())
+        stub->discardStubs(cx);
+
+    if (stub->state().canAttachStub()) {
         RootedValue idVal(cx, StringValue(name));
         SetPropIRGenerator gen(cx, script, pc, CacheKind::SetProp, stub->state().mode(),
                                &isTemporarilyUnoptimizable, lhs, idVal, rhs);

js/src/jit/IonIC.cpp

@@ -248,7 +248,15 @@ IonSetPropertyIC::update(JSContext* cx, HandleScript outerScript, IonSetProperty
         }
     }
 
-    if (!attached && ic->state().canAttachStub()) {
+    if (attached)
+        return true;
+
+    // The SetProperty call might have entered this IC recursively, so try
+    // to transition.
+    if (ic->state().maybeTransition())
+        ic->discardStubs(cx->zone());
+
+    if (ic->state().canAttachStub()) {
         RootedValue objv(cx, ObjectValue(*obj));
         RootedScript script(cx, ic->script());
         jsbytecode* pc = ic->pc();