1 files changed, 19 insertions, 4 deletions
diff --git a/js/src/gc/MallocedBlockCache.h b/js/src/gc/MallocedBlockCache.h
index cd7d1e1064..6fc577044e 100644
--- a/js/src/gc/MallocedBlockCache.h
+++ b/js/src/gc/MallocedBlockCache.h
@@ -70,6 +70,8 @@ class MallocedBlockCache {
 
   ~MallocedBlockCache();
 
+  static inline size_t listIDForSize(size_t size);
+
   // Allocation and freeing.  Use `alloc` to allocate.  `allocSlow` is
   // `alloc`s fallback path.  Do not call it directly, since it doesn't handle
   // all cases by itself.
@@ -89,7 +91,8 @@ class MallocedBlockCache {
   size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
 };
 
-inline PointerAndUint7 MallocedBlockCache::alloc(size_t size) {
+/* static */
+inline size_t MallocedBlockCache::listIDForSize(size_t size) {
   // Figure out which free list can give us a block of size `size`, after it
   // has been rounded up to a multiple of `step`.
   //
@@ -122,11 +125,23 @@ inline PointerAndUint7 MallocedBlockCache::alloc(size_t size) {
   size_t i = size / STEP;
   MOZ_ASSERT(i > 0);
 
+  if (i >= NUM_LISTS) {
+    return OVERSIZE_BLOCK_LIST_ID;
+  }
+
+  return i;
+}
+
+inline PointerAndUint7 MallocedBlockCache::alloc(size_t size) {
+  size_t i = listIDForSize(size);
+  MOZ_ASSERT(i < NUM_LISTS);
+
   // Fast path: try to pull a block from the relevant list.
-  if (MOZ_LIKELY(i < NUM_LISTS &&       // "block is small enough to cache"
-                 !lists[i].empty())) {  // "a cached block is available"
+  if (MOZ_LIKELY(
+          i != OVERSIZE_BLOCK_LIST_ID &&  // "block is small enough to cache"
+          !lists[i].empty())) {           // "a cached block is available"
     // Check that i is the right list
-    MOZ_ASSERT(i * STEP == size);
+    MOZ_ASSERT(i * STEP == js::RoundUp(size, STEP));
     void* block = lists[i].popCopy();
     return PointerAndUint7(block, i);
   }