Bug 1403535 - Ionmonkey: ensureBallast before visitControlInstruction. r=tcampbell

js/src/jit/ValueNumbering.cpp

@@ -999,6 +999,9 @@ ValueNumberer::visitBlock(MBasicBlock* block, const MBasicBlock* dominatorRoot)
     }
     nextDef_ = nullptr;
 
+    if (!graph_.alloc().ensureBallast())
+        return false;
+
     return visitControlInstruction(block, dominatorRoot);
 }