From d3b2cdfe659de8fd10ce6a5e88c328253c927147 Mon Sep 17 00:00:00 2001
From: Luke Wagner <lw@mozilla.com>
Date: Mon, 16 Nov 2009 17:45:50 -0800
Subject: [PATCH] Bug 529147 - fix flipped numSideExitsBefore assertion
 (r=dvander)

---
 js/src/jstracer.cpp                           |  2 +-
 .../trace-test/tests/basic/testBug529147.js   | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 js/src/trace-test/tests/basic/testBug529147.js

diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index ec0f5127e8bf..61e62f950164 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -2557,7 +2557,7 @@ TraceRecorder::finishAbort(const char* reason)
     if (fragment->root == fragment) {
         TrashTree(cx, fragment->toTreeFragment());
     } else {
-        JS_ASSERT(numSideExitsBefore >= fragment->root->treeInfo->sideExits.length());
+        JS_ASSERT(numSideExitsBefore <= fragment->root->treeInfo->sideExits.length());
         fragment->root->treeInfo->sideExits.setLength(numSideExitsBefore);
     }
 
diff --git a/js/src/trace-test/tests/basic/testBug529147.js b/js/src/trace-test/tests/basic/testBug529147.js
new file mode 100644
index 000000000000..8b700879d881
--- /dev/null
+++ b/js/src/trace-test/tests/basic/testBug529147.js
@@ -0,0 +1,22 @@
+var magicNumbers = [1, -1, 0, 0];
+var magicIndex = 0;
+
+var sum = 0;
+
+function foo(n) {
+    for (var i = 0; i < n; ++i) {
+        sum += 10;
+        bar();
+    }
+}
+
+function bar() {
+    var q = magicNumbers[magicIndex++];
+    if (q != -1) {
+        sum += 1;
+        foo(q);
+    }
+}
+
+foo(3);
+assertEq(sum, 43);