Bug 1331058 - Fix analysis check in IonBuilder::initEnvironmentChain. r=shu a=lizzard
authorJan de Mooij <jdemooij@mozilla.com>
Sat, 14 Jan 2017 00:12:43 +0100
changeset 462199 34030b2a1cd430e080d5b2a0df5e8f954ccb727e
parent 462198 64b8f9218c9894223a9ae02c43de6643bd97c98d
child 462200 69934dc20e17c4f1c3071a3c6ef49c9a07ad325c
push id41678
push userfelipc@gmail.com
push dateMon, 16 Jan 2017 20:19:38 +0000
reviewersshu, lizzard
bugs1331058
milestone51.0
Bug 1331058 - Fix analysis check in IonBuilder::initEnvironmentChain. r=shu a=lizzard
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1228,19 +1228,21 @@ IonBuilder::initEnvironmentChain(MDefini
             MCallee* calleeIns = MCallee::New(alloc());
             current->add(calleeIns);
             callee = calleeIns;
         }
         env = MFunctionEnvironment::New(alloc(), callee);
         current->add(env);
 
         // This reproduce what is done in CallObject::createForFunction. Skip
-        // this for analyses, as the script might not have a baseline script
-        // with template objects yet.
-        if (fun->needsSomeEnvironmentObject() && !info().isAnalysis()) {
+        // this for the arguments analysis, as the script might not have a
+        // baseline script with template objects yet.
+        if (fun->needsSomeEnvironmentObject() &&
+            info().analysisMode() != Analysis_ArgumentsUsage)
+        {
             if (fun->needsNamedLambdaEnvironment()) {
                 env = createNamedLambdaObject(callee, env);
                 if (!env)
                     return false;
             }
 
             // TODO: Parameter expression-induced extra var environment not
             // yet handled.
@@ -6247,16 +6249,19 @@ IonBuilder::createCallObject(MDefinition
     //if (!script()->functionHasParameterExprs()) {
 
     // Copy closed-over argument slots if there aren't parameter expressions.
     MSlots* slots = nullptr;
     for (PositionalFormalParameterIter fi(script()); fi; fi++) {
         if (!fi.closedOver())
             continue;
 
+        if (!alloc().ensureBallast())
+            return nullptr;
+
         unsigned slot = fi.location().slot();
         unsigned formal = fi.argumentSlot();
         unsigned numFixedSlots = templateObj->numFixedSlots();
         MDefinition* param;
         if (script()->functionHasParameterExprs())
             param = constant(MagicValue(JS_UNINITIALIZED_LEXICAL));
         else
             param = current->getSlot(info().argSlotUnchecked(formal));