Bug 1198090 - Use AutoInitGCManagedObject when creating UnboxedLayout in TryConvertToUnboxedLayout() r=terrence

js/src/jit-test/tests/basic/bug-1198090.js

@@ -0,0 +1,12 @@
+// |jit-test| allow-oom
+
+if (!('oomAtAllocation' in this))
+    quit();
+
+for (let a of [
+        null, function() {}, function() {}, null, function() {}, function() {},
+        function() {}, null, null, null, null, null, null, null, null,
+        function() {}, null, null, null, function() {}
+    ]) {
+    oomAtAllocation(5);
+}

js/src/vm/Runtime.h

@@ -2180,6 +2180,10 @@ class MOZ_STACK_CLASS AutoInitGCManagedObject
         return ptr_.get() != nullptr;
     }
 
+    T* get() {
+        return ptr_.get();
+    }
+
     T* release() {
         return ptr_.release();
     }

js/src/vm/UnboxedObject.cpp

@@ -2006,8 +2006,7 @@ js::TryConvertToUnboxedLayout(ExclusiveContext* cx, Shape* templateShape,
             return true;
     }
 
-    UniquePtr<UnboxedLayout, JS::DeletePolicy<UnboxedLayout> > layout;
-    layout.reset(group->zone()->new_<UnboxedLayout>());
+    AutoInitGCManagedObject<UnboxedLayout> layout(group->zone()->make_unique<UnboxedLayout>());
     if (!layout)
         return false;
 
@@ -2063,7 +2062,7 @@ js::TryConvertToUnboxedLayout(ExclusiveContext* cx, Shape* templateShape,
     }
 
     group->setClasp(clasp);
-    group->setUnboxedLayout(layout.get());
+    group->setUnboxedLayout(layout.release());
 
     size_t valueCursor = 0;
     for (size_t i = 0; i < PreliminaryObjectArray::COUNT; i++) {