From f7f35438f5e257575ea2b7a430c58e458ae56b4e Mon Sep 17 00:00:00 2001
From: wolfbeast <mcwerewolf@gmail.com>
Date: Tue, 15 Aug 2017 20:12:03 +0200
Subject: Add rematerialized frames to the table on JitActivation after
 rematerialization succeeds.

---
 js/src/jit-test/tests/debug/bug1353356.js | 65 +++++++++++++++++++++++++++++++
 js/src/vm/Stack.cpp                       | 14 +++----
 2 files changed, 71 insertions(+), 8 deletions(-)
 create mode 100644 js/src/jit-test/tests/debug/bug1353356.js

diff --git a/js/src/jit-test/tests/debug/bug1353356.js b/js/src/jit-test/tests/debug/bug1353356.js
new file mode 100644
index 000000000..389bb7860
--- /dev/null
+++ b/js/src/jit-test/tests/debug/bug1353356.js
@@ -0,0 +1,65 @@
+// |jit-test| allow-oom; --fuzzing-safe
+
+var lfLogBuffer = `
+//corefuzz-dcd-endofdata
+//corefuzz-dcd-endofdata
+//corefuzz-dcd-endofdata
+    setJitCompilerOption("ion.warmup.trigger", 4);
+    var g = newGlobal();
+    g.debuggeeGlobal = this;
+    g.eval("(" + function () {
+        dbg = new Debugger(debuggeeGlobal);
+        dbg.onExceptionUnwind = function (frame, exc) {
+            var s = '!';
+            for (var f = frame; f; f = f.older)
+            debuggeeGlobal.log += s;
+        };
+    } + ")();");
+      j('Number.prototype.toSource.call([])');
+//corefuzz-dcd-endofdata
+//corefuzz-dcd-endofdata
+//corefuzz-dcd-endofdata
+//corefuzz-dcd-selectmode 4
+//corefuzz-dcd-endofdata
+}
+//corefuzz-dcd-endofdata
+//corefuzz-dcd-selectmode 5
+//corefuzz-dcd-endofdata
+oomTest(() => i({
+    new  : (true  ),
+    thisprops: true
+}));
+`;
+lfLogBuffer = lfLogBuffer.split('\n');
+var lfRunTypeId = -1;
+var lfCodeBuffer = "";
+while (true) {
+    var line = lfLogBuffer.shift();
+    if (line == null) {
+        break;
+    } else if (line == "//corefuzz-dcd-endofdata") {
+        loadFile(lfCodeBuffer);
+        lfCodeBuffer = "";
+        loadFile(line);
+    } else {
+        lfCodeBuffer += line + "\n";
+    }
+}
+if (lfCodeBuffer) loadFile(lfCodeBuffer);
+function loadFile(lfVarx) {
+    try {
+        if (lfVarx.indexOf("//corefuzz-dcd-selectmode ") === 0) {
+            lfRunTypeId = parseInt(lfVarx.split(" ")[1]) % 6;
+        } else {
+            switch (lfRunTypeId) {
+                case 4:
+                    oomTest(function() {
+                        let m = parseModule(lfVarx);
+                    });
+                    break;
+                default:
+                    evaluate(lfVarx);
+            }
+        }
+    } catch (lfVare) {}
+}
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 7978d8dbc..439bb1ed4 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -1517,11 +1517,7 @@ jit::JitActivation::getRematerializedFrame(JSContext* cx, const JitFrameIterator
     uint8_t* top = iter.fp();
     RematerializedFrameTable::AddPtr p = rematerializedFrames_->lookupForAdd(top);
     if (!p) {
-        RematerializedFrameVector empty(cx);
-        if (!rematerializedFrames_->add(p, top, Move(empty))) {
-            ReportOutOfMemory(cx);
-            return nullptr;
-        }
+        RematerializedFrameVector frames(cx);
 
         // The unit of rematerialization is an uninlined frame and its inlined
         // frames. Since inlined frames do not exist outside of snapshots, it
@@ -1536,9 +1532,11 @@ jit::JitActivation::getRematerializedFrame(JSContext* cx, const JitFrameIterator
         // be in the activation's compartment.
         AutoCompartment ac(cx, compartment_);
 
-        if (!RematerializedFrame::RematerializeInlineFrames(cx, top, inlineIter, recover,
-                                                            p->value()))
-        {
+        if (!RematerializedFrame::RematerializeInlineFrames(cx, top, inlineIter, recover, frames))
+            return nullptr;
+
+        if (!rematerializedFrames_->add(p, top, Move(frames))) {
+            ReportOutOfMemory(cx);
             return nullptr;
         }
 
-- 
cgit v1.2.3