Bug 1210760 - Don't simulate OOM in ExceptionHandlerBailout() r=terrence

js/src/jit-test/tests/gc/oomInExceptionHandlerBailout.js

@@ -0,0 +1,17 @@
+// |jit-test| --no-threads
+
+load(libdir + 'oomTest.js');
+
+oomTest(() => {
+    let x = 0;
+    try {
+        for (let i = 0; i < 100; i++) {
+            if (i == 99)
+                throw "foo";
+            x += i;
+        }
+    } catch (e) {
+        x = 0;
+    }
+    return x;
+});

js/src/jit/Bailouts.cpp

@@ -206,8 +206,18 @@ jit::ExceptionHandlerBailout(JSContext* cx, const InlineFrameIterator& frame,
     CommonFrameLayout* currentFramePtr = iter.current();
 
     BaselineBailoutInfo* bailoutInfo = nullptr;
-    uint32_t retval = BailoutIonToBaseline(cx, bailoutData.activation(), iter, true,
-                                           &bailoutInfo, &excInfo);
+    uint32_t retval;
+
+    {
+        // Currently we do not tolerate OOM here so as not to complicate the
+        // exception handling code further.
+        AutoEnterOOMUnsafeRegion oomUnsafe;
+
+        retval = BailoutIonToBaseline(cx, bailoutData.activation(), iter, true,
+                                      &bailoutInfo, &excInfo);
+        if (retval == BAILOUT_RETURN_FATAL_ERROR && cx->isThrowingOutOfMemory())
+            oomUnsafe.crash("ExceptionHandlerBailout");
+    }
 
     if (retval == BAILOUT_RETURN_OK) {
         MOZ_ASSERT(bailoutInfo);
@@ -235,8 +245,6 @@ jit::ExceptionHandlerBailout(JSContext* cx, const InlineFrameIterator& frame,
 
             // Crash for now so as not to complicate the exception handling code
             // further.
-            if (cx->isThrowingOutOfMemory())
-                CrashAtUnhandlableOOM("ExceptionHandlerBailout");
             MOZ_CRASH();
         }
     }