From 0587fde91b793bc87d486a0c39c1b9988e1ca712 Mon Sep 17 00:00:00 2001
From: Andreas Gal <gal@mozilla.com>
Date: Wed, 28 Oct 2009 15:32:40 -0700
Subject: [PATCH] Use reserve double pool when running into OOM in LeaveTrace
 (523947, r=dvander).

---
 js/src/jsgc.cpp     | 32 +++++++++++++-------------------
 js/src/jstracer.cpp | 27 +++++++++++++++------------
 2 files changed, 28 insertions(+), 31 deletions(-)

diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 6243808cf17..35259dc9552 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1509,9 +1509,17 @@ NewFinalizableGCThing(JSContext *cx, unsigned thingKind)
             break;
         }
 
-#if defined JS_GC_ZEAL && defined JS_TRACER
-        if (cx->runtime->gcZeal >= 1 && JS_TRACE_MONITOR(cx).useReservedObjects)
-            goto testReservedObjects;
+#ifdef JS_TRACER
+        if (JS_TRACE_MONITOR(cx).useReservedObjects) {
+            JS_ASSERT(JS_ON_TRACE(cx));
+            JS_ASSERT(thingKind == FINALIZE_OBJECT);
+            JSTraceMonitor *tm = &JS_TRACE_MONITOR(cx);
+            thing = (JSGCThing *) tm->reservedObjects;
+            JS_ASSERT(thing);
+            tm->reservedObjects = JSVAL_TO_OBJECT(tm->reservedObjects->fslots[0]);
+            fromTraceReserve = true;
+            break;
+        }
 #endif
 
         thing = RefillFinalizableFreeList(cx, thingKind);
@@ -1525,22 +1533,6 @@ NewFinalizableGCThing(JSContext *cx, unsigned thingKind)
             break;
         }
 
-#ifdef JS_TRACER
-        if (JS_TRACE_MONITOR(cx).useReservedObjects) {
-#ifdef JS_GC_ZEAL
-          testReservedObjects:
-#endif
-            JS_ASSERT(JS_ON_TRACE(cx));
-            JS_ASSERT(thingKind == FINALIZE_OBJECT);
-            JSTraceMonitor *tm = &JS_TRACE_MONITOR(cx);
-            thing = (JSGCThing *) tm->reservedObjects;
-            JS_ASSERT(thing);
-            tm->reservedObjects = JSVAL_TO_OBJECT(tm->reservedObjects->fslots[0]);
-            fromTraceReserve = true;
-            break;
-        }
-#endif
-
         js_ReportOutOfMemory(cx);
         return NULL;
     }
@@ -1709,6 +1701,8 @@ js_NewDoubleInRootedValue(JSContext *cx, jsdouble d, jsval *vp)
 
     JSGCThing *thing = JS_THREAD_DATA(cx)->gcFreeLists.doubles;
     if (!thing) {
+        if (JS_TRACE_MONITOR(cx).useReservedObjects)
+            return false;
         thing = RefillDoubleFreeList(cx);
         if (!thing) {
             METER(astats->fail++);
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 45daea6425e..f94721654d1 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -2887,14 +2887,7 @@ NativeToValueBase(JSContext* cx, jsval& v, JSTraceType type, double* slot)
         if (JSDOUBLE_IS_INT(d, i))
             goto store_int;
       store_double:
-        if (js_NewDoubleInRootedValue(cx, d, &v))
-            return true;
-
-        /*
-         * It's not safe to trigger the GC here, so use an emergency heap
-         * if we are out of double boxes.
-         */
-        return E::handleDoubleOOM(cx, d, v);
+        return E::NewDoubleInRootedValue(cx, d, v);
 
       case TT_JSVAL:
         v = *(jsval*)slot;
@@ -2937,7 +2930,13 @@ NativeToValueBase(JSContext* cx, jsval& v, JSTraceType type, double* slot)
 }
 
 struct ReserveDoubleOOMHandler {
-    static bool handleDoubleOOM(JSContext *cx, double d, jsval& v) {
+    static bool NewDoubleInRootedValue(JSContext *cx, double d, jsval& v) {
+        JS_ASSERT(!JS_TRACE_MONITOR(cx).useReservedObjects);
+        JS_TRACE_MONITOR(cx).useReservedObjects = true;
+        bool ok = js_NewDoubleInRootedValue(cx, d, &v);
+        JS_TRACE_MONITOR(cx).useReservedObjects = false;
+        if (ok)
+            return true;
         v = AllocateDoubleFromReservedPool(cx);
         JS_ASSERT(JSVAL_IS_DOUBLE(v) && *JSVAL_TO_DOUBLE(v) == 0.0);
         *JSVAL_TO_DOUBLE(v) = d;
@@ -2956,9 +2955,13 @@ NativeToValue(JSContext* cx, jsval& v, JSTraceType type, double* slot)
 }
 
 struct FailDoubleOOMHandler {
-    static bool handleDoubleOOM(JSContext *cx, double d, jsval& v) {
-        js_ReportOutOfMemory(cx);
-        return false;
+    static bool NewDoubleInRootedValue(JSContext *cx, double d, jsval& v) {
+        bool ok = js_NewDoubleInRootedValue(cx, d, &v);
+        if (!ok) {
+            js_ReportOutOfMemory(cx);
+            return false;
+        }
+        return true;
     }
 };