Bug 1315943 - Part 1: Fix NumClosedOverBindingsLimit value. r=till

--HG--
extra : amend_source : 99b256707e0970747f97f79ea683a767f9d37337

js/src/jit-test/tests/auto-regress/bug1315943.js

@@ -0,0 +1,11 @@
+var s = "{}";
+for (var i = 0; i < 21; i++) s += s;
+var g = newGlobal();
+var dbg = Debugger(g);
+dbg.onDebuggerStatement = function(frame) {
+    var s = frame.eval("f").return.script;
+};
+g.eval("line0 = Error().lineNumber;\n" + "debugger;\n" + // line0 + 1
+    "function f(i) {\n" + // line0 + 2
+    s + // line0 + 3 ... line0 + where - 2
+    "}\n");

js/src/jsscript.h

@@ -1910,7 +1910,9 @@ class LazyScript : public gc::TenuredCell
         uint32_t shouldDeclareArguments : 1;
         uint32_t hasThisBinding : 1;
         uint32_t isAsync : 1;
+        // The number of bits should match to NumClosedOverBindingsLimit.
         uint32_t numClosedOverBindings : 21;
+        // The number of bits should match to NumInnerFunctionsLimit.
         uint32_t numInnerFunctions : 20;
 
         uint32_t generatorKindBits : 2;
@@ -1951,7 +1953,7 @@ class LazyScript : public gc::TenuredCell
                                  uint32_t lineno, uint32_t column);
 
   public:
-    static const uint32_t NumClosedOverBindingsLimit = 1 << 22;
+    static const uint32_t NumClosedOverBindingsLimit = 1 << 21;
     static const uint32_t NumInnerFunctionsLimit = 1 << 20;
 
     // Create a LazyScript and initialize closedOverBindings and innerFunctions