Bug 1370922 - [Ion] Handle allocation failure when generating Math.min. r?nbp draft
authorTed Campbell <tcampbell@mozilla.com>
Fri, 30 Jun 2017 20:30:40 -0400
changeset 602998 2060073ef0a03905e086c4304e23250f233161e3
parent 602915 6ed59d9db340ef128d85f2406f37dd3074b6767c
child 635801 56887ce6f187648c3e07e25f89dea3e79f5af929
push id66647
push userbmo:tcampbell@mozilla.com
push dateSat, 01 Jul 2017 00:31:07 +0000
reviewersnbp
bugs1370922
milestone56.0a1
Bug 1370922 - [Ion] Handle allocation failure when generating Math.min. r?nbp MozReview-Commit-ID: 6rENb7VcLyq
js/src/jit-test/tests/ion/bug1370922.js
js/src/jit/MCallOptimize.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1370922.js
@@ -0,0 +1,24 @@
+function f(y)
+      Math.min(0, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
+               0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8,
+               9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7,
+               9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7,
+               9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7,
+               9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6,
+               7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5,
+               6, 7, 8, 9);
+function g() f({});
+x = 0
+for (var j = 0; j < 3000; j++)
+   g([j])
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1466,16 +1466,18 @@ IonBuilder::inlineMathMinMax(CallInfo& c
         return InliningStatus_Inlined;
     }
 
     // Chain N-1 MMinMax instructions to compute the MinMax.
     MMinMax* last = MMinMax::New(alloc(), cases[0], cases[1], returnType, max);
     current->add(last);
 
     for (unsigned i = 2; i < cases.length(); i++) {
+        if (!alloc().ensureBallast())
+            return abort(AbortReason::Alloc);
         MMinMax* ins = MMinMax::New(alloc(), last, cases[i], returnType, max);
         current->add(ins);
         last = ins;
     }
 
     current->push(last);
     return InliningStatus_Inlined;
 }