From a7ff33a68bb23a1805d3263172a00cd1c60e2957 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Tue, 8 Mar 2016 13:19:34 +0000
Subject: [PATCH] Bug 1240521 - IonBuilder processSwitchEnd returns
 ControlStatus_Error on allocation errors. r=h4writer

---
 js/src/jit-test/tests/ion/bug1240521.js | 13 +++++++++++++
 js/src/jit/IonBuilder.cpp               |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/ion/bug1240521.js

diff --git a/js/src/jit-test/tests/ion/bug1240521.js b/js/src/jit-test/tests/ion/bug1240521.js
new file mode 100644
index 000000000000..9a0bb2eddfba
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1240521.js
@@ -0,0 +1,13 @@
+// |jit-test| allow-oom
+var egc = 138;
+function SwitchTest(value) {
+    switch (value) {
+        case 0:
+            break
+        case new Number:
+            result = 8
+        case oomAfterAllocations(egc):
+    }
+}
+!(SwitchTest(4) === 4);
+!(SwitchTest(true) === 2);
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index e0e089d50f76..c299823b7e90 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3054,7 +3054,7 @@ IonBuilder::processSwitchEnd(DeferredEdge* breaks, jsbytecode* exitpc)
         successor = newBlock(current, exitpc);
 
     if (!successor)
-        return ControlStatus_Ended;
+        return ControlStatus_Error;
 
     // If there is current, the current block flows into this one.
     // So current is also a predecessor to this block