From 780d346651bba5470d8f3d6da4c2fe720bc07268 Mon Sep 17 00:00:00 2001 From: Jakob Olesen Date: Thu, 24 Sep 2015 16:33:00 +0200 Subject: [PATCH] Bug 1208259 - ARM64: Handle an empty nursery in branchValueIsNurseryObject(). r=bhackett Fixes jsapitests testGCOutOfMemory. --- js/src/jit/arm64/MacroAssembler-arm64.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/js/src/jit/arm64/MacroAssembler-arm64.cpp b/js/src/jit/arm64/MacroAssembler-arm64.cpp index 859ace64092f..7efc9470be33 100644 --- a/js/src/jit/arm64/MacroAssembler-arm64.cpp +++ b/js/src/jit/arm64/MacroAssembler-arm64.cpp @@ -238,8 +238,13 @@ MacroAssemblerCompat::branchValueIsNurseryObject(Condition cond, ValueOperand va MOZ_ASSERT(cond == Assembler::Equal || cond == Assembler::NotEqual); MOZ_ASSERT(temp != ScratchReg && temp != ScratchReg2); // Both may be used internally. - // 'Value' representing the start of the nursery tagged as a JSObject const Nursery& nursery = GetJitContext()->runtime->gcNursery(); + + // Avoid creating a bogus ObjectValue below. + if (!nursery.exists()) + return; + + // 'Value' representing the start of the nursery tagged as a JSObject Value start = ObjectValue(*reinterpret_cast(nursery.start())); movePtr(ImmWord(-ptrdiff_t(start.asRawBits())), temp);