Bug 469012 - crashing LirBufWriter::insLinkToFar, r=danderson.
--- a/js/src/nanojit/LIR.cpp
+++ b/js/src/nanojit/LIR.cpp
@@ -149,32 +149,32 @@ namespace nanojit
}
void LirBufWriter::ensureRoom(uint32_t count)
{
LInsp before = _buf->next();
LInsp after = before+count+LIR_FAR_SLOTS;
if (!samepage(before,after+LirBuffer::LIR_BUF_THRESHOLD))
{
+ if (!_buf->_thresholdPage)
+ {
+ // LIR_BUF_THRESHOLD away from a new page but pre-alloc it, setting noMem for early OOM detection
+ _buf->_thresholdPage = _buf->pageAlloc();
+ NanoAssert(_buf->_thresholdPage || _buf->_noMem);
+ }
// transition to the next page?
if (!samepage(before,after))
{
NanoAssert(_buf->_thresholdPage);
_buf->_unused = &_buf->_thresholdPage->lir[0];
_buf->_thresholdPage = 0; // pageAlloc() stored it in _pages already
// link LIR stream back to prior instruction (careful insLink relies on _unused...)
insLinkTo(LIR_skip, before-1);
}
- else if (!_buf->_thresholdPage)
- {
- // LIR_BUF_THRESHOLD away from a new page but pre-alloc it, setting noMem for early OOM detection
- _buf->_thresholdPage = _buf->pageAlloc();
- NanoAssert(_buf->_thresholdPage || _buf->_noMem);
- }
}
}
LInsp LirBufWriter::insLinkTo(LOpcode op, LInsp to)
{
LInsp l = _buf->next();
NanoAssert(samepage(l,l+LIR_FAR_SLOTS)); // must have called ensureRoom()
if (can24bReach(l,to))