Bug 1264948 - IonBuilder::addOsrValueTypeBarrier, check for OOMs when unboxing OSR values. r=h4writer
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Mon, 20 Jun 2016 13:54:08 +0000
changeset 302092 ab5f00905c50354585c89bb18d16d3c4749a3a61
parent 302091 a7a5f51c271b800af05b967554a7152d7ba230fc
child 302093 87d0b9d9da9478d6a06612400e0a43842962912a
push id78584
push usernpierron@mozilla.com
push dateMon, 20 Jun 2016 13:54:38 +0000
treeherdermozilla-inbound@ab5f00905c50 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1264948
milestone50.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1264948 - IonBuilder::addOsrValueTypeBarrier, check for OOMs when unboxing OSR values. r=h4writer
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1409,16 +1409,19 @@ IonBuilder::maybeAddOsrTypeBarriers()
     MOZ_ASSERT(stackDepth == osrBlock->stackDepth());
     for (uint32_t slot = info().startArgSlot(); slot < stackDepth; slot++) {
         // Aliased slots are never accessed, since they need to go through
         // the callobject. The typebarriers are added there and can be
         // discarded here.
         if (info().isSlotAliasedAtOsr(slot))
             continue;
 
+        if (!alloc().ensureBallast())
+            return false;
+
         MInstruction* def = osrBlock->getSlot(slot)->toInstruction();
         MPhi* preheaderPhi = preheader->getSlot(slot)->toPhi();
         MPhi* headerPhi = headerRp->getOperand(slot)->toPhi();
 
         MIRType type = headerPhi->type();
         TemporaryTypeSet* typeSet = headerPhi->resultTypeSet();
 
         if (!addOsrValueTypeBarrier(slot, &def, type, typeSet))