From 21688e7ca8a8ac24ed9d466c9ce3fbbb32a40f93 Mon Sep 17 00:00:00 2001
From: Cameron Kaiser <classilla@floodgap.com>
Date: Wed, 7 Mar 2018 00:33:33 -0800
Subject: [PATCH] #478: M1437507 M1437450

---
 js/src/jit/IonAnalysis.cpp | 6 ++++++
 js/src/vm/Shape.cpp        | 8 ++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 8a41afc51..789565e5f 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -1824,6 +1824,12 @@ jit::ApplyTypeInformation(MIRGenerator* mir, MIRGraph& graph)
 bool
 jit::MakeMRegExpHoistable(MIRGraph& graph)
 {
+    // If we are compiling try blocks, regular expressions may be observable
+    // from catch blocks (which Ion does not compile). For now just disable the
+    // pass in this case.
+    if (graph.hasTryBlock())
+        return true;
+
     for (ReversePostorderIterator block(graph.rpoBegin()); block != graph.rpoEnd(); block++) {
         for (MDefinitionIterator iter(*block); iter; iter++) {
             if (!iter->isRegExp())
diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
index 195156e64..cf936758a 100644
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1124,6 +1124,10 @@ JSObject::setFlags(ExclusiveContext* cx, BaseShape::Flag flags, GenerateShape ge
 
     RootedObject self(cx, this);
 
+    Shape* existingShape = self->ensureShape(cx);
+    if (!existingShape)
+        return false;
+
     if (isNative() && as<NativeObject>().inDictionaryMode()) {
         if (generateShape == GENERATE_SHAPE && !as<NativeObject>().generateOwnShape(cx))
             return false;
@@ -1137,10 +1141,6 @@ JSObject::setFlags(ExclusiveContext* cx, BaseShape::Flag flags, GenerateShape ge
         return true;
     }
 
-    Shape* existingShape = self->ensureShape(cx);
-    if (!existingShape)
-        return false;
-
     Shape* newShape = Shape::setObjectFlags(cx, flags, self->getTaggedProto(), existingShape);
     if (!newShape)
         return false;