Bug 1191756: Prevent one OOM in jsop_if; r=jonco

Also fixes the test for bug 1193043.

--HG--
extra : commitid : 7zlrT0yPI2f
extra : rebase_source : 22363ccc2bfda5dd59470dcf6a30f126ae02dd57

js/src/jit-test/tests/gc/bug1191756.js

@@ -0,0 +1,18 @@
+// |jit-test| exitstatus: 3
+
+if (typeof 'oomAtAllocation' === 'undefined')
+    quit(3);
+
+function fn(i) {
+    if (i == 3)
+      return ["isFinite"].map(function (i) {});
+    return [];
+}
+
+fn(0);
+fn(1);
+fn(2);
+oomAtAllocation(50);
+fn(3);
+
+quit(3);

js/src/jit-test/tests/ion/scalar-replacement-oom.js

@@ -1,5 +1,6 @@
+// |jit-test| exitstatus: 3
 if (typeof oomAtAllocation !== 'function')
-    quit();
+    quit(3);
 
 var lfcode = new Array();
 function k(a, f_arg, b, c) {
@@ -12,8 +13,10 @@ function t() {
     k(50, function(i) {
         x = i;
     }, 100, 200);
-    oomAtAllocation(100);
+    oomAtAllocation(101);
 }
 
 t();
 t();
+
+quit(3);

js/src/jit/IonBuilder.cpp

@@ -3838,7 +3838,7 @@ IonBuilder::improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test)
         type = TypeSet::intersectSets(&base, oldType, alloc_->lifoAlloc());
     }
 
-    return replaceTypeSet(ins, type, test);
+    return type && replaceTypeSet(ins, type, test);
 }
 
 bool