Bug 1307651 - IonMonkey - Ensure ballast in jsop_rest, r=nbp a=gchang
authorHannes Verschore <hv1989@gmail.com>
Mon, 06 Feb 2017 17:18:18 +0100
changeset 378533 879c3bea29b7a42bb476a45d468b5c728818613e
parent 378532 974771bbb0029af85cedf3eeb106ea5b51d8eba9
child 378534 53cd0f71c36116b6b764fd7aa3d54917be2c8da6
push id1419
push userjlund@mozilla.com
push dateMon, 10 Apr 2017 20:44:07 +0000
treeherdermozilla-release@5e6801b73ef6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp, gchang
bugs1307651
milestone53.0a2
Bug 1307651 - IonMonkey - Ensure ballast in jsop_rest, r=nbp a=gchang
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -9334,16 +9334,19 @@ IonBuilder::jsop_rest()
     MDefinition *array = current->peek(-1);
     MElements* elements = MElements::New(alloc(), array);
     current->add(elements);
 
     // Unroll the argument copy loop. We don't need to do any bounds or hole
     // checking here.
     MConstant* index = nullptr;
     for (unsigned i = numFormals; i < numActuals; i++) {
+        if (!alloc().ensureBallast())
+            return abort(AbortReason::Alloc);
+
         index = MConstant::New(alloc(), Int32Value(i - numFormals));
         current->add(index);
 
         MDefinition* arg = inlineCallInfo_->argv()[i];
         MStoreElement* store = MStoreElement::New(alloc(), elements, index, arg,
                                                   /* needsHoleCheck = */ false);
         current->add(store);