Bug 1264948 - IonBuilder::addOsrValueTypeBarrier, check for OOMs when unboxing OSR values. r=h4writer
☠☠ backed out by fd1ff601b561 ☠ ☠
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Wed, 15 Jun 2016 16:27:18 +0000
changeset 301898 87f37f6cde598e58168536e9907c00f035cc375c
parent 301897 831077a22f587ba1c45e44336ee9aa00d5c51d89
child 301899 a509094fc1f8f470570dff6911333b7bf3591b36
push id78493
push usernpierron@mozilla.com
push dateWed, 15 Jun 2016 16:28:34 +0000
treeherdermozilla-inbound@87f37f6cde59 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1264948
milestone50.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1264948 - IonBuilder::addOsrValueTypeBarrier, check for OOMs when unboxing OSR values. r=h4writer
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1409,16 +1409,19 @@ IonBuilder::maybeAddOsrTypeBarriers()
     MOZ_ASSERT(stackDepth == osrBlock->stackDepth());
     for (uint32_t slot = info().startArgSlot(); slot < stackDepth; slot++) {
         // Aliased slots are never accessed, since they need to go through
         // the callobject. The typebarriers are added there and can be
         // discarded here.
         if (info().isSlotAliasedAtOsr(slot))
             continue;
 
+        if (!alloc().ensureBallast())
+            return false;
+
         MInstruction* def = osrBlock->getSlot(slot)->toInstruction();
         MPhi* preheaderPhi = preheader->getSlot(slot)->toPhi();
         MPhi* headerPhi = headerRp->getOperand(slot)->toPhi();
 
         MIRType type = headerPhi->type();
         TemporaryTypeSet* typeSet = headerPhi->resultTypeSet();
 
         if (!addOsrValueTypeBarrier(slot, &def, type, typeSet))