Bug 1131846 - Check the return value of MResumePoint::Copy. r=h4writer

js/src/jit/IonBuilder.cpp

@@ -821,7 +821,10 @@ IonBuilder::build()
     // register/stack pressure.
     MCheckOverRecursed *check = MCheckOverRecursed::New(alloc());
     current->add(check);
-    check->setResumePoint(MResumePoint::Copy(alloc(), current->entryResumePoint()));
+    MResumePoint *entryRpCopy = MResumePoint::Copy(alloc(), current->entryResumePoint());
+    if (!entryRpCopy)
+        return false;
+    check->setResumePoint(entryRpCopy);
 
     // Parameters have been checked to correspond to the typeset, now we unbox
     // what we can in an infallible manner.
@@ -851,8 +854,13 @@ IonBuilder::build()
     // effectful operations).
     for (uint32_t i = 0; i < info().endArgSlot(); i++) {
         MInstruction *ins = current->getEntrySlot(i)->toInstruction();
-        if (ins->type() == MIRType_Value)
-            ins->setResumePoint(MResumePoint::Copy(alloc(), current->entryResumePoint()));
+        if (ins->type() != MIRType_Value)
+            continue;
+
+        MResumePoint *entryRpCopy = MResumePoint::Copy(alloc(), current->entryResumePoint());
+        if (!entryRpCopy)
+            return false;
+        ins->setResumePoint(entryRpCopy);
     }
 
     // lazyArguments should never be accessed in |argsObjAliasesFormals| scripts.
@@ -6798,7 +6806,8 @@ IonBuilder::newOsrPreheader(MBasicBlock *predecessor, jsbytecode *loopEntry)
     // Link the same MResumePoint from the MStart to each MOsrValue.
     // This causes logic in ShouldSpecializeInput() to not replace Uses with
     // Unboxes in the MResumePiont, so that the MStart always sees Values.
-    osrBlock->linkOsrValues(start);
+    if (!osrBlock->linkOsrValues(start))
+        return nullptr;
 
     // Clone types of the other predecessor of the pre-header to the osr block,
     // such as pre-header phi's won't discard specialized type of the

js/src/jit/MIRGraph.cpp

@@ -535,7 +535,7 @@ MBasicBlock::shimmySlots(int discardDepth)
     --stackPosition_;
 }
 
-void
+bool
 MBasicBlock::linkOsrValues(MStart *start)
 {
     MOZ_ASSERT(start->startType() == MStart::StartType_Osr);
@@ -572,9 +572,15 @@ MBasicBlock::linkOsrValues(MStart *start)
                 cloneRp = def->toParameter();
         }
 
-        if (cloneRp)
-            cloneRp->setResumePoint(MResumePoint::Copy(graph().alloc(), res));
+        if (cloneRp) {
+            MResumePoint *clone = MResumePoint::Copy(graph().alloc(), res);
+            if (!clone)
+                return false;
+            cloneRp->setResumePoint(clone);
+        }
     }
+
+    return true;
 }
 
 void

js/src/jit/MIRGraph.h

@@ -166,7 +166,7 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
 
     // In an OSR block, set all MOsrValues to use the MResumePoint attached to
     // the MStart.
-    void linkOsrValues(MStart *start);
+    bool linkOsrValues(MStart *start);
 
     // Sets the instruction associated with various slot types. The
     // instruction must lie at the top of the stack.