Bug 803219 - Fix TI sanity checks in the interpreter. r=terrence

js/src/jsinterp.cpp

@@ -1030,15 +1030,11 @@ IteratorNext(JSContext *cx, HandleObject iterobj, MutableHandleValue rval)
  * types of the pushed values are consistent with type inference information.
  */
 static inline void
-TypeCheckNextBytecode(JSContext *cx, JSScript *script_, unsigned n, const FrameRegs &regs)
+TypeCheckNextBytecode(JSContext *cx, HandleScript script, unsigned n, const FrameRegs &regs)
 {
 #ifdef DEBUG
-    if (cx->typeInferenceEnabled() &&
-        n == GetBytecodeLength(regs.pc))
-    {
-        RootedScript script(cx, script_);
+    if (cx->typeInferenceEnabled() && n == GetBytecodeLength(regs.pc))
         TypeScript::CheckBytecode(cx, script, regs.pc, regs.sp);
-    }
 #endif
 }
 
@@ -1256,6 +1252,7 @@ js::Interpret(JSContext *cx, StackFrame *entryFrame, InterpMode interpMode)
         JS_ASSERT(js_CodeSpec[op].length == 1);
         len = 1;
       advance_pc:
+        TypeCheckNextBytecode(cx, script, len, regs);
         js::gc::MaybeVerifyBarriers(cx);
         regs.pc += len;
         op = (JSOp) *regs.pc;