Bug 529147 - fix flipped numSideExitsBefore assertion (r=dvander)

js/src/jstracer.cpp

@@ -2557,7 +2557,7 @@ TraceRecorder::finishAbort(const char* reason)
     if (fragment->root == fragment) {
         TrashTree(cx, fragment->toTreeFragment());
     } else {
-        JS_ASSERT(numSideExitsBefore >= fragment->root->treeInfo->sideExits.length());
+        JS_ASSERT(numSideExitsBefore <= fragment->root->treeInfo->sideExits.length());
         fragment->root->treeInfo->sideExits.setLength(numSideExitsBefore);
     }
 

js/src/trace-test/tests/basic/testBug529147.js

@@ -0,0 +1,22 @@
+var magicNumbers = [1, -1, 0, 0];
+var magicIndex = 0;
+
+var sum = 0;
+
+function foo(n) {
+    for (var i = 0; i < n; ++i) {
+        sum += 10;
+        bar();
+    }
+}
+
+function bar() {
+    var q = magicNumbers[magicIndex++];
+    if (q != -1) {
+        sum += 1;
+        foo(q);
+    }
+}
+
+foo(3);
+assertEq(sum, 43);