Bug 1022891 - Part 1: Fix IonBailoutIterator for non-top frames. (r=nbp)

js/src/jit/Bailouts.h

@@ -125,11 +125,14 @@ class IonBailoutIterator : public JitFrameIterator
     IonBailoutIterator(const JitActivationIterator &activations, const JitFrameIterator &frame);
 
     SnapshotOffset snapshotOffset() const {
-        JS_ASSERT(topIonScript_);
-        return snapshotOffset_;
+        if (topIonScript_)
+            return snapshotOffset_;
+        return osiIndex()->snapshotOffset();
     }
-    const MachineState &machineState() const {
-        return machine_;
+    const MachineState machineState() const {
+        if (topIonScript_)
+            return machine_;
+        return JitFrameIterator::machineState();
     }
     size_t topFrameSize() const {
         JS_ASSERT(topIonScript_);
@@ -141,6 +144,14 @@ class IonBailoutIterator : public JitFrameIterator
         return JitFrameIterator::ionScript();
     }
 
+    IonBailoutIterator &operator++() {
+        JitFrameIterator::operator++();
+        // Clear topIonScript_ now that we've advanced past it, so that
+        // snapshotOffset() and machineState() reflect the current script.
+        topIonScript_ = nullptr;
+        return *this;
+    }
+
     void dump() const;
 };