Fix extra decref in rare IC path (bug 635968, r=dmandelin, a=blocking).
authorDavid Anderson <danderson@mozilla.com>
Thu, 24 Feb 2011 12:09:18 -0800
changeset 63076 c6c296b5629cc71f687d2adf06e73e6d8075236f
parent 63075 2b2fc7d3a193591c1b75bc668e6e02bd808901c0
child 63077 30b87b9ea0cc18aa6f999b88850befde345e11af
push id1
push userroot
push dateTue, 10 Dec 2013 15:46:25 +0000
reviewersdmandelin, blocking
bugs635968
milestone2.0b13pre
Fix extra decref in rare IC path (bug 635968, r=dmandelin, a=blocking).
js/src/methodjit/MonoIC.cpp
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -227,20 +227,18 @@ AttachSetGlobalNameStub(VMFrame &f, ic::
     if (!ep)
         return Lookup_Error;
     if (!jit->execPools.append(ep)) {
         ep->release();
         js_ReportOutOfMemory(f.cx);
         return Lookup_Error;
     }
 
-    if (!linker.verifyRange(jit)) {
-        ep->release();
+    if (!linker.verifyRange(jit))
         return Lookup_Uncacheable;
-    }
 
     linker.link(done, ic->fastPathStart.labelAtOffset(ic->fastRejoinOffset));
     linker.link(guard, ic->slowPathStart);
     linker.link(isFun, ic->slowPathStart);
 
     JSC::CodeLocationLabel cs = linker.finalize();
     JaegerSpew(JSpew_PICs, "generated setgname stub at %p\n", cs.executableAddress());