[INFER] Fix orange.

js/src/methodjit/FrameState.cpp

@@ -1324,7 +1324,9 @@ FrameState::sync(Assembler &masm, Uses uses) const
     Registers avail(freeRegs.freeMask & Registers::AvailRegs);
     Registers temp(Registers::TempAnyRegs);
 
-    FrameEntry *bottom = cx->typeInferenceEnabled() ? entries : a->sp - uses.nuses;
+    FrameEntry *bottom = (cx->typeInferenceEnabled() || cx->compartment->debugMode())
+        ? entries
+        : a->sp - uses.nuses;
 
     for (FrameEntry *fe = a->sp - 1; fe >= bottom; fe--) {
         if (!fe->isTracked())
@@ -1456,7 +1458,10 @@ FrameState::syncAndKill(Registers kill, Uses uses, Uses ignore)
     }
 
     uint32 maxvisits = tracker.nentries;
-    FrameEntry *bottom = cx->typeInferenceEnabled() ? entries : a->sp - uses.nuses;
+
+    FrameEntry *bottom = (cx->typeInferenceEnabled() || cx->compartment->debugMode())
+        ? entries
+        : a->sp - uses.nuses;
 
     for (FrameEntry *fe = a->sp - 1; fe >= bottom && maxvisits; fe--) {
         if (!fe->isTracked())

js/src/methodjit/InvokeHelpers.cpp

@@ -623,7 +623,7 @@ js_InternalThrow(VMFrame &f)
     StackFrame *fp = cx->fp();
     JSScript *script = fp->script();
 
-    if (cx->typeInferenceEnabled()) {
+    if (cx->typeInferenceEnabled() || !fp->jit()) {
         /*
          * Fall back to EnterMethodJIT and finish the frame in the interpreter.
          * With type inference enabled, we may wipe out all JIT code on the