Bug 794025 - Detect IC purging in JM generateNativeStub(). r=dvander

js/src/methodjit/MonoIC.cpp

@@ -1028,6 +1028,9 @@ class CallCompiler : public BaseCompiler
         /* Snapshot the frameDepth before SplatApplyArgs modifies it. */
         unsigned initialFrameDepth = f.regs.sp - f.fp()->slots();
 
+        /* Protect against accessing the IC if it may have been purged. */
+        RecompilationMonitor monitor(cx);
+
         /*
          * SplatApplyArgs has not been called, so we call it here before
          * potentially touching f.u.call.dynamicArgc.
@@ -1039,7 +1042,8 @@ class CallCompiler : public BaseCompiler
         } else {
             JS_ASSERT(!f.regs.inlined());
             JS_ASSERT(*f.regs.pc == JSOP_FUNAPPLY && GET_ARGC(f.regs.pc) == 2);
-            if (!ic::SplatApplyArgs(f))       /* updates regs.sp */
+            /* Updates regs.sp -- may cause GC. */
+            if (!ic::SplatApplyArgs(f))
                 THROWV(true);
             args = CallArgsFromSp(f.u.call.dynamicArgc, f.regs.sp);
         }
@@ -1054,8 +1058,6 @@ class CallCompiler : public BaseCompiler
         if (callingNew)
             args.setThis(MagicValue(JS_IS_CONSTRUCTING));
 
-        RecompilationMonitor monitor(cx);
-
         if (!CallJSNative(cx, fun->native(), args))
             THROWV(true);