diff --git a/js/src/jit/Bailouts.cpp b/js/src/jit/Bailouts.cpp index 284f29585b3b..6476ce8b2728 100644 --- a/js/src/jit/Bailouts.cpp +++ b/js/src/jit/Bailouts.cpp @@ -35,7 +35,6 @@ jit::Bailout(BailoutStack *sp, BaselineBailoutInfo **bailoutInfo) IsInRange(FAKE_JIT_TOP_FOR_BAILOUT + sizeof(IonCommonFrameLayout), 0, 0x1000), "Fake jitTop pointer should be within the first page."); cx->mainThread().jitTop = FAKE_JIT_TOP_FOR_BAILOUT; - gc::AutoSuppressGC suppress(cx); JitActivationIterator jitActivations(cx->runtime()); BailoutFrameInfo bailoutData(jitActivations, sp); @@ -103,7 +102,6 @@ jit::InvalidationBailout(InvalidationBailoutStack *sp, size_t *frameSizeOut, // We don't have an exit frame. cx->mainThread().jitTop = FAKE_JIT_TOP_FOR_BAILOUT; - gc::AutoSuppressGC suppress(cx); JitActivationIterator jitActivations(cx->runtime()); BailoutFrameInfo bailoutData(jitActivations, sp); diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp index 97c0817b0af0..bbf6461f2ac8 100644 --- a/js/src/jit/BaselineBailouts.cpp +++ b/js/src/jit/BaselineBailouts.cpp @@ -525,6 +525,10 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC, jsbytecode **callPC, const ExceptionBailoutInfo *excInfo, bool *poppedLastSPSFrameOut) { + // The Baseline frames we will reconstruct on the heap are not rooted, so GC + // must be suppressed here. + MOZ_ASSERT(cx->mainThread().suppressGC); + MOZ_ASSERT(script->hasBaselineScript()); MOZ_ASSERT(poppedLastSPSFrameOut); MOZ_ASSERT(!*poppedLastSPSFrameOut); @@ -1308,10 +1312,6 @@ jit::BailoutIonToBaseline(JSContext *cx, JitActivation *activation, JitFrameIter bool invalidate, BaselineBailoutInfo **bailoutInfo, const ExceptionBailoutInfo *excInfo, bool *poppedLastSPSFrameOut) { - // The Baseline frames we will reconstruct on the heap are not rooted, so GC - // must be suppressed here. - MOZ_ASSERT(cx->mainThread().suppressGC); - MOZ_ASSERT(bailoutInfo != nullptr); MOZ_ASSERT(*bailoutInfo == nullptr); @@ -1424,6 +1424,8 @@ jit::BailoutIonToBaseline(JSContext *cx, JitActivation *activation, JitFrameIter RootedScript topCaller(cx); jsbytecode *topCallerPC = nullptr; + gc::AutoSuppressGC suppress(cx); + while (true) { // Skip recover instructions as they are already recovered by |initInstructionResults|. snapIter.settleOnFrame();