Bug 683470 - InlineReturn should assert using js_GetOpcode instead of *regs.pc (r=dvander)

js/src/jit-test/tests/basic/testBug683470.js

@@ -0,0 +1,15 @@
+// |jit-test| debug
+
+f = (function() {
+  function b() {
+    "use strict";
+    Object.defineProperty(this, "x", ({}));
+  }
+  for each(let d in [0, 0]) {
+    try {
+      b(d);
+    } catch (e) {}
+  }
+})
+trap(f, 54, undefined);
+f()

js/src/methodjit/InvokeHelpers.cpp

@@ -181,11 +181,12 @@ InlineReturn(VMFrame &f)
     JS_ASSERT(!js_IsActiveWithOrBlock(f.cx, &f.fp()->scopeChain(), 0));
     f.cx->stack.popInlineFrame(f.regs);
 
-    JS_ASSERT(*f.regs.pc == JSOP_CALL ||
+    DebugOnly<JSOp> op = js_GetOpcode(f.cx, f.fp()->script(), f.regs.pc);
-              *f.regs.pc == JSOP_NEW ||
+    JS_ASSERT(op == JSOP_CALL ||
-              *f.regs.pc == JSOP_EVAL ||
+              op == JSOP_NEW ||
-              *f.regs.pc == JSOP_FUNCALL ||
+              op == JSOP_EVAL ||
-              *f.regs.pc == JSOP_FUNAPPLY);
+              op == JSOP_FUNCALL ||
+              op == JSOP_FUNAPPLY);
     f.regs.pc += JSOP_CALL_LENGTH;
 }