From 3103c8e33d53ceb2344c1652b334fc467cd94a6e Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Wed, 15 Jul 2015 19:11:55 +0200
Subject: [PATCH] Bug 1180049 - Add OOM check in MNewArray constructor.
 r=bhackett

---
 js/src/jit/MIR.cpp | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index e6272a40d7d..01c15a08f81 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4103,10 +4103,11 @@ MNewArray::MNewArray(CompilerConstraintList* constraints, uint32_t count, MConst
 {
     setResultType(MIRType_Object);
     if (templateObject()) {
-        TemporaryTypeSet* types = MakeSingletonTypeSet(constraints, templateObject());
-        setResultTypeSet(types);
-        if (types->convertDoubleElements(constraints) == TemporaryTypeSet::AlwaysConvertToDoubles)
-            convertDoubleElements_ = true;
+        if (TemporaryTypeSet* types = MakeSingletonTypeSet(constraints, templateObject())) {
+            setResultTypeSet(types);
+            if (types->convertDoubleElements(constraints) == TemporaryTypeSet::AlwaysConvertToDoubles)
+                convertDoubleElements_ = true;
+        }
     }
 }