Bug 1062869 part 2 - Separate the recovery of instructions from the frame reconstruction. r=h4writer

js/src/jit/BaselineBailouts.cpp

@@ -1380,12 +1380,8 @@ jit::BailoutIonToBaseline(JSContext *cx, JitActivation *activation, IonBailoutIt
     jsbytecode *topCallerPC = nullptr;
 
     while (true) {
-        if (!snapIter.instruction()->isResumePoint()) {
-            if (!snapIter.instruction()->recover(cx, snapIter))
-                return BAILOUT_RETURN_FATAL_ERROR;
-            snapIter.nextInstruction();
-            continue;
-        }
+        // Skip recover instructions as they are already recovered by |initInstructionResults|.
+        snapIter.settleOnFrame();
 
         if (frameNo > 0) {
             TraceLogStartEvent(logger, TraceLogCreateTextId(logger, scr));

js/src/jit/IonFrames.cpp

@@ -1779,8 +1779,25 @@ SnapshotIterator::initInstructionResults(JSContext *cx, RInstructionResults *res
     MOZ_ASSERT(recover_.numInstructions() > 1);
     size_t numResults = recover_.numInstructions() - 1;
     instructionResults_ = results;
-    if (!instructionResults_->isInitialized() && !instructionResults_->init(cx, numResults, fp_))
-        return false;
+    if (!instructionResults_->isInitialized()) {
+        if (!instructionResults_->init(cx, numResults, fp_))
+            return false;
+
+        // Fill with the results of recover instructions.
+        SnapshotIterator s(*this);
+        while (s.moreInstructions()) {
+            // Skip resume point and only interpret recover instructions.
+            if (s.instruction()->isResumePoint()) {
+                s.skipInstruction();
+                continue;
+            }
+
+            if (!s.instruction()->recover(cx, s))
+                return false;
+            s.nextInstruction();
+        }
+    }
+
     return true;
 }