Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 13:51:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1240521 - IonBuilder processSwitchEnd returns ControlStatus_Error on allocation errors. r=h4writer

Browse Source
This commit is contained in:
Nicolas B. Pierron 2016-03-08 13:19:34 +00:00
parent 1996b83ba5
commit a7ff33a68b
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
js/src/jit-test/tests/ion/bug1240521.js Normal file
View File

@ -0,0 +1,13 @@
// |jit-test| allow-oom
var egc = 138;
function SwitchTest(value) {
switch (value) {
case 0:
break
case new Number:
result = 8
case oomAfterAllocations(egc):
}
}
!(SwitchTest(4) === 4);
!(SwitchTest(true) === 2);

2
js/src/jit/IonBuilder.cpp
View File

@ -3054,7 +3054,7 @@ IonBuilder::processSwitchEnd(DeferredEdge* breaks, jsbytecode* exitpc)
successor = newBlock(current, exitpc);
if (!successor)
return ControlStatus_Ended;
return ControlStatus_Error;
// If there is current, the current block flows into this one.
// So current is also a predecessor to this block