gistfile1.diff

diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index 7624ea1..325eb38 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -1563,10 +1563,7 @@ CopyFromRematerializedFrame(JSContext *cx, JitActivation *act, uint8_t *fp, size
             "  Copied from rematerialized frame at (%p,%u)",
             fp, inlineDepth);
 
+    if (cx->compartment()->debugMode())
+        return Debugger::handleIonBailout(cx, rematFrame, frame);
-
+    return true;
-    return Debugger::handleIonBailout(cx, rematFrame, frame);
 }
 
 uint32_t
@@ -1656,12 +1653,8 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo *bailoutInfo)
     MOZ_ASSERT(outerScript);
     MOZ_ASSERT(outerFp);
 
+    // If we rematerialized Ion frames due to debug mode toggling, copy their
+    // values into the baseline frame. We need to do this even when debug mode
+    // is off, as we should respect the mutations made while debug mode was
+    // on.
     JitActivation *act = cx->mainThread().activation()->asJit();
+    if (act->hasRematerializedFrame(outerFp)) {
-    if (cx->compartment()->debugMode() && act->hasRematerializedFrame(outerFp)) {
         IonFrameIterator iter(cx);
         size_t inlineDepth = numFrames;
         while (inlineDepth > 0) {