mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-25 19:25:43 +00:00
Bug 1212343 - Propagate OOM from SafepointWriter r=nbp
This commit is contained in:
parent
b21dc0c589
commit
daef6b660b
24
js/src/jit-test/tests/gc/oomInArrayProtoTest.js
Normal file
24
js/src/jit-test/tests/gc/oomInArrayProtoTest.js
Normal file
@ -0,0 +1,24 @@
|
||||
load(libdir + 'oomTest.js');
|
||||
|
||||
function arrayProtoOutOfRange() {
|
||||
function f(obj) {
|
||||
return typeof obj[15];
|
||||
}
|
||||
|
||||
function test() {
|
||||
var a = [1, 2];
|
||||
a.__proto__ = {15: 1337};
|
||||
var b = [1, 2, 3, 4];
|
||||
|
||||
for (var i = 0; i < 1000; i++) {
|
||||
var r = f(i % 2 ? a : b);
|
||||
assertEq(r, i % 2 ? "number" : "undefined");
|
||||
}
|
||||
}
|
||||
|
||||
test();
|
||||
test();
|
||||
test();
|
||||
}
|
||||
|
||||
oomTest(arrayProtoOutOfRange);
|
@ -8024,7 +8024,8 @@ CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints)
|
||||
: FrameSizeClass::FromDepth(frameDepth_).frameSize();
|
||||
|
||||
// We encode safepoints after the OSI-point offsets have been determined.
|
||||
encodeSafepoints();
|
||||
if (!encodeSafepoints())
|
||||
return false;
|
||||
|
||||
AutoDiscardIonCode discardIonCode(cx, &recompileInfo);
|
||||
|
||||
|
@ -57,6 +57,9 @@ class SafepointWriter
|
||||
const uint8_t* buffer() const {
|
||||
return stream_.buffer();
|
||||
}
|
||||
bool oom() const {
|
||||
return stream_.oom();
|
||||
}
|
||||
};
|
||||
|
||||
class SafepointReader
|
||||
|
@ -626,7 +626,7 @@ CodeGeneratorShared::assignBailoutId(LSnapshot* snapshot)
|
||||
return bailouts_.append(snapshot->snapshotOffset());
|
||||
}
|
||||
|
||||
void
|
||||
bool
|
||||
CodeGeneratorShared::encodeSafepoints()
|
||||
{
|
||||
for (SafepointIndex& index : safepointIndices_) {
|
||||
@ -639,6 +639,8 @@ CodeGeneratorShared::encodeSafepoints()
|
||||
|
||||
index.resolve();
|
||||
}
|
||||
|
||||
return !safepoints_.oom();
|
||||
}
|
||||
|
||||
bool
|
||||
|
@ -303,7 +303,7 @@ class CodeGeneratorShared : public LElementVisitor
|
||||
|
||||
// Encode all encountered safepoints in CG-order, and resolve |indices| for
|
||||
// safepoint offsets.
|
||||
void encodeSafepoints();
|
||||
bool encodeSafepoints();
|
||||
|
||||
// Fixup offsets of native-to-bytecode map.
|
||||
bool createNativeToBytecodeScriptList(JSContext* cx);
|
||||
|
@ -4338,6 +4338,7 @@ TypeZone::beginSweep(FreeOp* fop, bool releaseTypes, AutoClearTypeInferenceState
|
||||
if (output.isValid()) {
|
||||
JSScript* script = output.script();
|
||||
if (IsAboutToBeFinalizedUnbarriered(&script)) {
|
||||
if (script->hasIonScript())
|
||||
script->ionScript()->recompileInfoRef() = RecompileInfo();
|
||||
output.invalidate();
|
||||
} else {
|
||||
|
Loading…
Reference in New Issue
Block a user