Bug 1491350: Clear pending OOM exceptions before returning from hasNativeProperty / getNativePropertyByValue r=tcampbell

Differential Revision: https://phabricator.services.mozilla.com/D6394

--HG--
extra : moz-landing-system : lando

js/src/jit-test/tests/baseline/bug1491337.js

@@ -0,0 +1,19 @@
+if (!('oomTest' in this))
+    quit();
+
+oomTest(new Function(`
+  let kJSEmbeddingMaxTypes = 1000000;
+  let kJSEmbeddingMaxFunctions = 1000000;
+  let kJSEmbeddingMaxImports = 100000;
+  const known_failures = {};
+  function test(func, description) {
+    known_failures[description]
+  }
+  function testLimit(name, min, limit, gen) {
+    test(() => {}, \`Validate \${name} mininum\`);
+    test(() => {}, \`Async compile \${name} over limit\`);
+  }
+  testLimit("types", 1, kJSEmbeddingMaxTypes, (builder, count) => {});
+  testLimit("functions", 1, kJSEmbeddingMaxFunctions, (builder, count) => {});
+  testLimit("imports", 1, kJSEmbeddingMaxImports, (builder, count) => {});
+`));

js/src/jit-test/tests/baseline/bug1491350.js

@@ -0,0 +1,11 @@
+if (!('oomTest' in this))
+  quit();
+
+oomTest(new Function(`
+  var a = ['p', 'q', 'r', 's', 't'];
+  var o = {p:1, q:2, r:3, s:4, t:5};
+  for (var i in o)
+    delete o[i];
+  for (var i of a)
+    o.hasOwnProperty(undefined + this, false);
+`));

js/src/jit/CacheIRCompiler.cpp

@@ -3694,9 +3694,9 @@ CacheIRCompiler::emitMegamorphicLoadSlotByValueResult()
     masm.passABIArg(obj);
     masm.passABIArg(idVal.scratchReg());
     if (handleMissing) {
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, (GetNativeDataPropertyByValue<true>)));
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, (GetNativeDataPropertyByValuePure<true>)));
     } else {
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, (GetNativeDataPropertyByValue<false>)));
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, (GetNativeDataPropertyByValuePure<false>)));
     }
     masm.mov(ReturnReg, scratch);
     masm.PopRegsInMask(volatileRegs);
@@ -3751,9 +3751,9 @@ CacheIRCompiler::emitMegamorphicHasPropResult()
     masm.passABIArg(obj);
     masm.passABIArg(idVal.scratchReg());
     if (hasOwn) {
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, HasNativeDataProperty<true>));
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, HasNativeDataPropertyPure<true>));
     } else {
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, HasNativeDataProperty<false>));
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, HasNativeDataPropertyPure<false>));
     }
     masm.mov(ReturnReg, scratch);
     masm.PopRegsInMask(volatileRegs);
@@ -4130,4 +4130,4 @@ js::jit::LoadTypedThingLength(MacroAssembler& masm, TypedThingLayout layout, Reg
       default:
         MOZ_CRASH();
     }
-}
+}

js/src/jit/VMFunctions.cpp

@@ -1739,10 +1739,8 @@ template bool
 GetNativeDataProperty<false>(JSContext* cx, JSObject* obj, PropertyName* name, Value* vp);
 
 static MOZ_ALWAYS_INLINE bool
-ValueToAtomOrSymbol(JSContext* cx, Value& idVal, jsid* id)
+ValueToAtomOrSymbolPure(JSContext* cx, Value& idVal, jsid* id)
 {
-    AutoUnsafeCallWithABI unsafe;
-
     if (MOZ_LIKELY(idVal.isString())) {
         JSString* s = idVal.toString();
         JSAtom* atom;
@@ -1751,6 +1749,7 @@ ValueToAtomOrSymbol(JSContext* cx, Value& idVal, jsid* id)
         } else {
             atom = AtomizeString(cx, s);
             if (!atom) {
+                cx->recoverFromOutOfMemory();
                 return false;
             }
         }
@@ -1775,7 +1774,7 @@ ValueToAtomOrSymbol(JSContext* cx, Value& idVal, jsid* id)
 
 template <bool HandleMissing>
 bool
-GetNativeDataPropertyByValue(JSContext* cx, JSObject* obj, Value* vp)
+GetNativeDataPropertyByValuePure(JSContext* cx, JSObject* obj, Value* vp)
 {
     AutoUnsafeCallWithABI unsafe;
 
@@ -1785,7 +1784,7 @@ GetNativeDataPropertyByValue(JSContext* cx, JSObject* obj, Value* vp)
     // vp[0] contains the id, result will be stored in vp[1].
     Value idVal = vp[0];
     jsid id;
-    if (!ValueToAtomOrSymbol(cx, idVal, &id)) {
+    if (!ValueToAtomOrSymbolPure(cx, idVal, &id)) {
         return false;
     }
 
@@ -1794,10 +1793,10 @@ GetNativeDataPropertyByValue(JSContext* cx, JSObject* obj, Value* vp)
 }
 
 template bool
-GetNativeDataPropertyByValue<true>(JSContext* cx, JSObject* obj, Value* vp);
+GetNativeDataPropertyByValuePure<true>(JSContext* cx, JSObject* obj, Value* vp);
 
 template bool
-GetNativeDataPropertyByValue<false>(JSContext* cx, JSObject* obj, Value* vp);
+GetNativeDataPropertyByValuePure<false>(JSContext* cx, JSObject* obj, Value* vp);
 
 template <bool NeedsTypeBarrier>
 bool
@@ -1882,14 +1881,14 @@ ObjectHasGetterSetter(JSContext* cx, JSObject* objArg, Shape* propShape)
 
 template <bool HasOwn>
 bool
-HasNativeDataProperty(JSContext* cx, JSObject* obj, Value* vp)
+HasNativeDataPropertyPure(JSContext* cx, JSObject* obj, Value* vp)
 {
     AutoUnsafeCallWithABI unsafe;
 
     // vp[0] contains the id, result will be stored in vp[1].
     Value idVal = vp[0];
     jsid id;
-    if (!ValueToAtomOrSymbol(cx, idVal, &id)) {
+    if (!ValueToAtomOrSymbolPure(cx, idVal, &id)) {
         return false;
     }
 
@@ -1935,10 +1934,10 @@ HasNativeDataProperty(JSContext* cx, JSObject* obj, Value* vp)
 }
 
 template bool
-HasNativeDataProperty<true>(JSContext* cx, JSObject* obj, Value* vp);
+HasNativeDataPropertyPure<true>(JSContext* cx, JSObject* obj, Value* vp);
 
 template bool
-HasNativeDataProperty<false>(JSContext* cx, JSObject* obj, Value* vp);
+HasNativeDataPropertyPure<false>(JSContext* cx, JSObject* obj, Value* vp);
 
 
 bool

js/src/jit/VMFunctions.h

@@ -929,11 +929,11 @@ GetNativeDataProperty(JSContext* cx, JSObject* obj, PropertyName* name, Value* v
 
 template <bool HandleMissing>
 bool
-GetNativeDataPropertyByValue(JSContext* cx, JSObject* obj, Value* vp);
+GetNativeDataPropertyByValuePure(JSContext* cx, JSObject* obj, Value* vp);
 
 template <bool HasOwn>
 bool
-HasNativeDataProperty(JSContext* cx, JSObject* obj, Value* vp);
+HasNativeDataPropertyPure(JSContext* cx, JSObject* obj, Value* vp);
 
 bool
 HasNativeElement(JSContext* cx, NativeObject* obj, int32_t index, Value* vp);