diff --git a/js/src/ion/IonBuilder.cpp b/js/src/ion/IonBuilder.cpp index 0a8bee8db55c..fde1c30c04fa 100644 --- a/js/src/ion/IonBuilder.cpp +++ b/js/src/ion/IonBuilder.cpp @@ -2993,7 +2993,7 @@ IonBuilder::inlineScriptedCall(HandleFunction target, CallInfo &callInfo) LifoAlloc *alloc = GetIonContext()->temp->lifoAlloc(); CompileInfo *info = alloc->new_(calleeScript.get(), target, (jsbytecode *)NULL, thisCall.constructing(), - SequentialExecution); + this->info().executionMode()); if (!info) return false; diff --git a/js/src/ion/ParallelArrayAnalysis.cpp b/js/src/ion/ParallelArrayAnalysis.cpp index 83cb6705551a..e16bf53965fa 100644 --- a/js/src/ion/ParallelArrayAnalysis.cpp +++ b/js/src/ion/ParallelArrayAnalysis.cpp @@ -529,7 +529,7 @@ ParallelArrayVisitor::convertToBailout(MBasicBlock *block, MInstruction *ins) continue; // create bailout block to insert on this edge - MBasicBlock *bailBlock = MBasicBlock::NewParBailout(graph_, block->info(), pred, pc); + MBasicBlock *bailBlock = MBasicBlock::NewParBailout(graph_, pred->info(), pred, pc); if (!bailBlock) return false; diff --git a/js/src/jit-test/tests/parallelarray/bug854021.js b/js/src/jit-test/tests/parallelarray/bug854021.js new file mode 100644 index 000000000000..a451e5413966 --- /dev/null +++ b/js/src/jit-test/tests/parallelarray/bug854021.js @@ -0,0 +1,2 @@ +// Don't crash. +ParallelArray(7, function ([y]) {})