If js_AddAsGCBytes is called from trace and wants to GC and we can bail off trace then do so instead of returning an error (476869, r=jorendorff).

js/src/jsgc.cpp

@@ -2290,8 +2290,15 @@ js_AddAsGCBytes(JSContext *cx, size_t sz)
 #endif
         ) {
         if (JS_ON_TRACE(cx)) {
-            JS_UNLOCK_GC(rt);
-            return JS_FALSE;
+            /*
+             * If we can't leave the trace, signal OOM condition, otherwise
+             * exit from trace and proceed with GC.
+             */
+            if (!js_CanLeaveTrace(cx)) {
+                JS_UNLOCK_GC(rt);
+                return JS_FALSE;
+            }
+            js_LeaveTrace(cx);
         }
         js_GC(cx, GC_LAST_DITCH);
         if (rt->gcBytes >= rt->gcMaxBytes ||

js/src/jstracer.h

@@ -626,4 +626,15 @@ js_LeaveTrace(JSContext *cx)
         js_GetTopStackFrame(cx);
 }
 
+static JS_INLINE bool
+js_CanLeaveTrace(JSContext *cx)
+{
+    JS_ASSERT(JS_ON_TRACE(cx));
+#ifdef JS_TRACER
+    return cx->bailExit;
+#else
+    return false;
+#endif
+}
+
 #endif /* jstracer_h___ */