Bug 840012 - Handle OOM in CreateThisForFunction (r=hannes)

--HG--
extra : rebase_source : 0a4cf9d0eb6373ff61f21dd386c103854236e0d1

js/src/ion/VMFunctions.cpp

@@ -531,7 +531,10 @@ CreateThis(JSContext *cx, HandleObject callee, MutableHandleValue rval)
             JSScript *script = fun->getOrCreateScript(cx);
             if (!script || !script->ensureHasTypes(cx))
                 return false;
-            rval.set(ObjectValue(*CreateThisForFunction(cx, callee, false)));
+            JSObject *thisObj = CreateThisForFunction(cx, callee, false);
+            if (!thisObj)
+                return false;
+            rval.set(ObjectValue(*thisObj));
         }
     }
 

js/src/jit-test/tests/basic/testBug0012.js

@@ -0,0 +1,16 @@
+// |jit-test| error:out of memory
+
+gcPreserveCode();
+evaluate("gcparam(\"maxBytes\", gcparam(\"gcBytes\") + 4*1024);");
+evaluate("\
+function testDontEnum(F) { \
+  function test() {\
+    typeof (new test(\"1\")) != 'function'\
+  }\
+  test();\
+} \
+var list = [];\
+for (i in list)\
+  var F = this[list[i]];\
+actual = testDontEnum(F);\
+");

js/src/shell/js.cpp

@@ -1043,7 +1043,10 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
         }
         if (!JS_ExecuteScript(cx, global, script, vp)) {
             if (catchTermination && !JS_IsExceptionPending(cx)) {
-                args.rval().setString(JS_NewStringCopyZ(cx, "terminated"));
+                JSString *str = JS_NewStringCopyZ(cx, "terminated");
+                if (!str)
+                    return false;
+                args.rval().setString(str);
                 return true;
             }
             return false;