Bug 1354275 - Fix handling of Array() throwing in Ion r=jandem

MozReview-Commit-ID: 4bwSYSmvLUV

--HG--
extra : rebase_source : e9e1fd64dfa2ba330582dd0945b14de873a36f7e

js/src/jit-test/tests/ion/bug1354275.js

@@ -0,0 +1,16 @@
+// --ion-eager --ion-offthread-compile=off
+
+function f(t) {
+    for (var i = 0; i < 2; i++) {
+        try {
+            var x = 1;
+            Array(1);
+            x = 2;
+            Array(t);
+        } catch (e) {
+            assertEq(x, 2);
+        }
+    }
+}
+
+f(-1);

js/src/jit/MCallOptimize.cpp

@@ -517,6 +517,10 @@ IonBuilder::inlineArray(CallInfo& callInfo)
                                             arg);
             current->add(ins);
             current->push(ins);
+
+            // This may throw, so we need a resume point.
+            MOZ_TRY(resumeAfter(ins));
+
             return InliningStatus_Inlined;
         }