[tor-commits] [tor-browser/tor-browser-60.2.1esr-8.5-1] Bug 1493900. r=bhackett, sunfish a=dveditz

[gk at torproject.org]

commit 34bcbdca41c7949318930b44b504e88696d0aeee
Author: Jan de Mooij <jdemooij at mozilla.com>
Date:   Tue Sep 25 12:14:11 2018 +0200

    Bug 1493900.  r=bhackett,sunfish a=dveditz
    
    --HG--
    extra : source : b5e3f4138c0ca0a2a42ec8007f27e1e7b6cb2150
    extra : intermediate-source : d596c94e62cd99b7efa048cb8016368047aaa079
---
 js/src/jit/BacktrackingAllocator.cpp | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index 16f7ff56397c..414de92e5bbc 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -1930,8 +1930,16 @@ BacktrackingAllocator::resolveControlFlow()
 
                 if (!alloc().ensureBallast())
                     return false;
-                if (!moveAtExit(predecessor, from, to, def->type()))
-                    return false;
+                if (mSuccessor->numPredecessors() > 1) {
+                    MOZ_ASSERT(predecessor->mir()->numSuccessors() == 1);
+                    if (!moveAtExit(predecessor, from, to, def->type())) {
+                        return false;
+                    }
+                } else {
+                    if (!moveAtEntry(successor, from, to, def->type())) {
+                        return false;
+                    }
+                }
             }
         }
     }