Bug 800179 - Initialize CallArgsList::active_ in the constructor. r=luke a=bajaj

js/src/ion/Ion.cpp

@@ -1452,7 +1452,7 @@ ion::SideCannon(JSContext *cx, StackFrame *fp, jsbytecode *pc)
 }
 
 IonExecStatus
-ion::FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args)
+ion::FastInvoke(JSContext *cx, HandleFunction fun, CallArgsList &args)
 {
     JS_CHECK_RECURSION(cx, return IonExec_Error);
 
@@ -1494,7 +1494,9 @@ ion::FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args)
     Value result = Int32Value(fun->nargs);
 
     JSAutoResolveFlags rf(cx, RESOLVE_INFER);
+    args.setActive();
     enter(jitcode, args.length() + 1, &args[0] - 1, fp, calleeToken, &result);
+    args.setInactive();
 
     if (clearCallingIntoIon)
         fp->clearCallingIntoIon();

js/src/ion/Ion.h

@@ -239,7 +239,7 @@ IonExecStatus Cannon(JSContext *cx, StackFrame *fp);
 IonExecStatus SideCannon(JSContext *cx, StackFrame *fp, jsbytecode *pc);
 
 // Used to enter Ion from C++ natives like Array.map. Called from FastInvokeGuard.
-IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args);
+IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgsList &args);
 
 // Walk the stack and invalidate active Ion frames for the invalid scripts.
 void Invalidate(types::TypeCompartment &types, FreeOp *fop,

js/src/vm/Stack.h

@@ -173,6 +173,8 @@ class CallArgsList : public JS::CallArgs
     friend class StackSegment;
     CallArgsList *prev_;
     bool active_;
+  protected:
+    CallArgsList() : prev_(NULL), active_(false) {}
   public:
     friend CallArgsList CallArgsListFromVp(unsigned, Value *, CallArgsList *);
     friend CallArgsList CallArgsListFromArgv(unsigned, Value *, CallArgsList *);