commit 3943f44464ab5aa6bf92b3326cd99479779a83c7 Author: Jan de Mooij <jdemooij@mozilla.com> Date: Tue Sep 25 12:14:11 2018 +0200 Bug 1493900. r=bhackett,sunfish a=dveditz --HG-- extra : source : b5e3f4138c0ca0a2a42ec8007f27e1e7b6cb2150 extra : intermediate-source : d596c94e62cd99b7efa048cb8016368047aaa079 --- js/src/jit/BacktrackingAllocator.cpp | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp index 16f7ff56397c..414de92e5bbc 100644 --- a/js/src/jit/BacktrackingAllocator.cpp +++ b/js/src/jit/BacktrackingAllocator.cpp @@ -1930,8 +1930,16 @@ BacktrackingAllocator::resolveControlFlow() if (!alloc().ensureBallast()) return false; - if (!moveAtExit(predecessor, from, to, def->type())) - return false; + if (mSuccessor->numPredecessors() > 1) { + MOZ_ASSERT(predecessor->mir()->numSuccessors() == 1); + if (!moveAtExit(predecessor, from, to, def->type())) { + return false; + } + } else { + if (!moveAtEntry(successor, from, to, def->type())) { + return false; + } + } } } }