Bug 1212343 - Propagate OOM from SafepointWriter r=nbp

js/src/jit-test/tests/gc/oomInArrayProtoTest.js

@@ -0,0 +1,24 @@
+load(libdir + 'oomTest.js');
+
+function arrayProtoOutOfRange() {
+    function f(obj) {
+        return typeof obj[15];
+    }
+
+    function test() {
+        var a = [1, 2];
+        a.__proto__ = {15: 1337};
+        var b = [1, 2, 3, 4];
+
+        for (var i = 0; i < 1000; i++) {
+            var r = f(i % 2 ? a : b);
+            assertEq(r, i % 2 ? "number" : "undefined");
+        }
+    }
+
+    test();
+    test();
+    test();
+}
+
+oomTest(arrayProtoOutOfRange);

js/src/jit/CodeGenerator.cpp

@@ -8024,7 +8024,8 @@ CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints)
                            : FrameSizeClass::FromDepth(frameDepth_).frameSize();
 
     // We encode safepoints after the OSI-point offsets have been determined.
-    encodeSafepoints();
+    if (!encodeSafepoints())
+        return false;
 
     AutoDiscardIonCode discardIonCode(cx, &recompileInfo);
 

js/src/jit/Safepoints.h

@@ -57,6 +57,9 @@ class SafepointWriter
     const uint8_t* buffer() const {
         return stream_.buffer();
     }
+    bool oom() const {
+        return stream_.oom();
+    }
 };
 
 class SafepointReader

js/src/jit/shared/CodeGenerator-shared.cpp

@@ -626,7 +626,7 @@ CodeGeneratorShared::assignBailoutId(LSnapshot* snapshot)
     return bailouts_.append(snapshot->snapshotOffset());
 }
 
-void
+bool
 CodeGeneratorShared::encodeSafepoints()
 {
     for (SafepointIndex& index : safepointIndices_) {
@@ -639,6 +639,8 @@ CodeGeneratorShared::encodeSafepoints()
 
         index.resolve();
     }
+
+    return !safepoints_.oom();
 }
 
 bool

js/src/jit/shared/CodeGenerator-shared.h

@@ -303,7 +303,7 @@ class CodeGeneratorShared : public LElementVisitor
 
     // Encode all encountered safepoints in CG-order, and resolve |indices| for
     // safepoint offsets.
-    void encodeSafepoints();
+    bool encodeSafepoints();
 
     // Fixup offsets of native-to-bytecode map.
     bool createNativeToBytecodeScriptList(JSContext* cx);

js/src/vm/TypeInference.cpp

@@ -4338,7 +4338,8 @@ TypeZone::beginSweep(FreeOp* fop, bool releaseTypes, AutoClearTypeInferenceState
             if (output.isValid()) {
                 JSScript* script = output.script();
                 if (IsAboutToBeFinalizedUnbarriered(&script)) {
-                    script->ionScript()->recompileInfoRef() = RecompileInfo();
+                    if (script->hasIonScript())
+                        script->ionScript()->recompileInfoRef() = RecompileInfo();
                     output.invalidate();
                 } else {
                     CompilerOutput newOutput(script);