Bug 1083716 - This value for scripts not marked in Ion frame r=nbp

js/src/jit/IonFrames.cpp

@@ -869,12 +869,16 @@ ReadAllocation(const JitFrameIterator &frame, const LAllocation *a)
 #endif
 
 static void
-MarkActualArguments(JSTracer *trc, const JitFrameIterator &frame)
+MarkFrameAndActualArguments(JSTracer *trc, const JitFrameIterator &frame)
 {
+    // The trampoline produced by |generateEnterJit| is pushing |this| on the
+    // stack, as requested by |setEnterJitData|.  Thus, this function is also
+    // used for marking the |this| value of the top-level frame.
+
     IonJSFrameLayout *layout = frame.jsFrame();
-    MOZ_ASSERT(CalleeTokenIsFunction(layout->calleeToken()));
 
     size_t nargs = frame.numActualArgs();
+    MOZ_ASSERT_IF(!CalleeTokenIsFunction(layout->calleeToken()), nargs == 0);
 
     // Trace function arguments. Note + 1 for thisv.
     Value *argv = layout->argv();
@@ -919,8 +923,7 @@ MarkIonJSFrame(JSTracer *trc, const JitFrameIterator &frame)
         ionScript = frame.ionScriptFromCalleeToken();
     }
 
-    if (CalleeTokenIsFunction(layout->calleeToken()))
-        MarkActualArguments(trc, frame);
+    MarkFrameAndActualArguments(trc, frame);
 
     const SafepointIndex *si = ionScript->getSafepointIndex(frame.returnAddressToFp());