Bug 1676631: Update local slots in SetFrameArgumentsObject r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D96928

Author: iainireland

js/src/vm/JSScript.cpp

@@ -4725,6 +4725,15 @@ void js::SetFrameArgumentsObject(JSContext* cx, AbstractFramePtr frame,
       frame.unaliasedLocal(frameSlot) = ObjectValue(*argsobj);
     }
   }
+
+  // JS_OPTIMIZED_ARGUMENTS may also have been stored to a local slot
+  // during bailout. Update those local slots.
+  for (uint32_t i = 0; i < script->nfixed(); i++) {
+    Value& value = frame.unaliasedLocal(i);
+    if (value.isMagic() && value.whyMagic() == JS_OPTIMIZED_ARGUMENTS) {
+      frame.unaliasedLocal(i) = ObjectValue(*argsobj);
+    }
+  }
 }
 
 /* static */