Bug 1900523 - Don't use bailout data for JSJitToWasm frames. r=iain

Differential Revision: https://phabricator.services.mozilla.com/D212554

js/src/jit-test/tests/ion/bug1900523.js

+// |jit-test| --fast-warmup; --no-threads; skip-if: !wasmIsSupported()
+function f1() {
+  Promise.allSettled().catch(e => null);
+  do {
+    f2(10n, -1n);
+    try {
+      f2(-2147483648n);
+    } catch {}
+  } while (!inIon());
+}
+function f2(x, y) {
+  const z = x >> x;
+  z <= z ? z : z;
+  y ^ y;
+}
+const binary = wasmTextToBinary(`
+  (module
+    (import "m" "f" (func $f))
+    (func (export "test")
+      (call $f)
+    )
+  )
+`);
+const mod = new WebAssembly.Module(binary);
+const inst = new WebAssembly.Instance(mod, {"m": {"f": f1}});
+for (let i = 0; i < 6; i++) {
+  inst.exports.test();
+}

js/src/jit/JSJitFrameIter.cpp

@@ -35,8 +35,12 @@ JSJitFrameIter::JSJitFrameIter(const JitActivation* activation,
       resumePCinCurrentFrame_(nullptr),
       cachedSafepointIndex_(nullptr),
       activation_(activation) {
+  // If we're currently performing a bailout, we have to use the activation's
+  // bailout data when we start iterating over the activation's frames.
+  // Note: JSJitToWasm indicates the activation contains both JS and Wasm frames
+  // and we're resuming iteration of the JS frames.
   MOZ_ASSERT(type_ == FrameType::JSJitToWasm || type_ == FrameType::Exit);
-  if (activation_->bailoutData()) {
+  if (type_ == FrameType::Exit && activation_->bailoutData()) {
     current_ = activation_->bailoutData()->fp();
     type_ = FrameType::Bailout;
   } else {