Merge

js/src/jsapi.cpp

@@ -3956,7 +3956,6 @@ JS_PUBLIC_API(JSBool)
 JS_NextProperty(JSContext *cx, JSObject *iterobj, jsid *idp)
 {
     jsint i;
-    JSObject *obj;
     const Shape *shape;
     JSIdArray *ida;
 
@@ -3965,15 +3964,9 @@ JS_NextProperty(JSContext *cx, JSObject *iterobj, jsid *idp)
     i = iterobj->getSlot(JSSLOT_ITER_INDEX).toInt32();
     if (i < 0) {
         /* Native case: private data is a property tree node pointer. */
-        obj = iterobj->getParent();
-        JS_ASSERT(obj->isNative());
+        JS_ASSERT(iterobj->getParent()->isNative());
         shape = (Shape *) iterobj->getPrivate();
 
-        /*
-         * If the next property mapped by obj in the property tree ancestor
-         * line is not enumerable, or it's an alias, skip it and keep on trying
-         * to find an enumerable property that is still in obj.
-         */
         while (shape->previous() && (!shape->enumerable() || shape->isAlias()))
             shape = shape->previous();
 

js/src/jsotypes.h

@@ -91,6 +91,14 @@ typedef JSIntn intn;
  */
 #if defined(AIX) && defined(HAVE_SYS_INTTYPES_H)
 #include <sys/inttypes.h>
+#elif defined(__SUNPRO_C) || defined(__SUNPRO_CC)
+typedef JSInt64 int64;
+
+/* Explicit signed keyword for bitfield types is required. */
+/* Some compilers may treat them as unsigned without it. */
+typedef signed int int32;
+typedef signed short int16;
+typedef signed char int8;
 #else
 typedef JSInt64 int64;
 

js/src/jspropertytree.cpp

@@ -140,7 +140,7 @@ KidsChunk::destroy(JSContext *cx, KidsChunk *chunk)
 
 /*
  * NB: Called with cx->runtime->gcLock held, always.
- * On failure, return null after unlocking the GC and reporting out of memory.
+ * On failure, return false after unlocking the GC and reporting out of memory.
  */
 bool
 PropertyTree::insertChild(JSContext *cx, Shape *parent, Shape *child)
@@ -219,8 +219,11 @@ PropertyTree::insertChild(JSContext *cx, Shape *parent, Shape *child)
     KidsHash *hash = kidp->toHash();
     KidsHash::AddPtr addPtr = hash->lookupForAdd(child);
     if (!addPtr) {
-        if (!hash->add(addPtr, child))
+        if (!hash->add(addPtr, child)) {
+            JS_UNLOCK_GC(cx->runtime);
+            JS_ReportOutOfMemory(cx);
             return false;
+        }
     } else {
         // FIXME ignore duplicate child case here, going thread-local soon!
     }

js/src/methodjit/MethodJIT.h

@@ -87,7 +87,7 @@ struct VMFrame
 
 # ifdef JS_NO_FASTCALL
     inline void** returnAddressLocation() {
-        return reinterpret_cast<void**>(this) - 3;
+        return reinterpret_cast<void**>(this) - 5;
     }
 # else
     inline void** returnAddressLocation() {

js/src/methodjit/TrampolineCompiler.cpp

@@ -146,7 +146,7 @@ TrampolineCompiler::generateForceReturnFast(Assembler &masm)
 #else
     // In case of no fast call, when we change the return address,
     // we need to make sure add esp by 8.
-    masm.addPtr(Imm32(8), Registers::StackPointer);
+    masm.addPtr(Imm32(16), Registers::StackPointer);
 #endif
     return generateForceReturn(masm);
 }

js/src/methodjit/TrampolineSUNWX86.s

@@ -1,4 +1,4 @@
-/ -*- Mode: C++/ tab-width: 4/ indent-tabs-mode: nil/ c-basic-offset: 4 -*-
+/ -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
 / ***** BEGIN LICENSE BLOCK *****
 / Version: MPL 1.1/GPL 2.0/LGPL 2.1
 /
@@ -92,8 +92,8 @@ JaegerTrampolineReturn:
 .type   JaegerThrowpoline, @function
 JaegerThrowpoline:
     /* For Sun Studio there is no fast call. */
-    /* We add the stack by 8 before. */
-    addl $0x8, %esp
+    /* We add the stack by 16 before. */
+    addl $0x10, %esp
     /* Align the stack to 16 bytes. */
     pushl %esp 
     pushl (%esp)
@@ -127,8 +127,8 @@ InjectJaegerReturn:
     movl 0x1C(%ebx), %ecx                        /* fp->rval_ type */
     movl 0x14(%ebx), %eax                        /* fp->ncode_ */
     /* For Sun Studio there is no fast call. */
-    /* We add the stack by 8 before. */
-    addl $0x8, %esp
+    /* We add the stack by 16 before. */
+    addl $0x10, %esp
     /* Restore frame regs. */
     movl 0x1C(%esp), %ebx                        /* f.fp */
     jmp *%eax

js/src/tests/js1_5/extensions/regress-336410-1.js

@@ -73,7 +73,7 @@ try
 }
 catch(ex)
 {
-  expect = 'InternalError: script stack space quota is exhausted';
+  expect = 'InternalError: allocation size overflow';
   actual = ex + '';
   print(actual);
 }

js/src/tests/js1_8_5/regress/regress-595230-1.js

@@ -11,7 +11,8 @@ var src =
     '    *\n' +
     '} catch(e) {}\n' +
     'default xml namespace = x\n' +
-    'for (let b in [0, 0]) <x/>\n';
+    'for (let b in [0, 0]) <x/>\n' +
+    '0\n';
 
 evalcx(src, box);