Bug 1829637: Make sure a jit hints map is allocated in the runtime before accessing it. r=iain

Differential Revision: https://phabricator.services.mozilla.com/D176432

UltraBlame original commit: 07f0aa2b869d5bcb38011341004d2a51e217c260

Author: marco-c

js/src/jit/BaselineCodeGen.cpp

@@ -221,7 +221,8 @@ MethodStatus BaselineCompiler::compile() {
     }
   }
 
-  if (!JitOptions.disableJitHints) {
+  if (!JitOptions.disableJitHints &&
+      cx->runtime()->jitRuntime()->hasJitHintsMap()) {
     JitHintsMap* jitHints = cx->runtime()->jitRuntime()->getJitHintsMap();
     jitHints->setEagerBaselineHint(script);
   }

js/src/jit/BaselineJIT.cpp

@@ -293,7 +293,8 @@ static MethodStatus CanEnterBaselineJIT(JSContext* cx, HandleScript script,
 
 
   bool mightHaveEagerBaselineHint = false;
-  if (!JitOptions.disableJitHints && !script->noEagerBaselineHint()) {
+  if (!JitOptions.disableJitHints && !script->noEagerBaselineHint() &&
+      cx->runtime()->jitRuntime()->hasJitHintsMap()) {
     JitHintsMap* jitHints = cx->runtime()->jitRuntime()->getJitHintsMap();
 
 

js/src/jit/Ion.cpp

@@ -94,9 +94,7 @@ JitRuntime::~JitRuntime() {
   MOZ_ASSERT_IF(interpreterEntryMap_, interpreterEntryMap_->empty());
   js_delete(interpreterEntryMap_.ref());
 
-#ifdef NIGHTLY_BUILD
   js_delete(jitHintsMap_.ref());
-#endif
 }
 
 uint32_t JitRuntime::startTrampolineCode(MacroAssembler& masm) {
@@ -128,14 +126,12 @@ bool JitRuntime::initialize(JSContext* cx) {
     return false;
   }
 
-#ifdef NIGHTLY_BUILD
   if (!JitOptions.disableJitHints) {
     jitHintsMap_ = cx->new_<JitHintsMap>();
     if (!jitHintsMap_) {
       return false;
     }
   }
-#endif
 
   if (JitOptions.emitInterpreterEntryTrampoline) {
     interpreterEntryMap_ = cx->new_<EntryTrampolineMap>();