Bug 1471371 - OOM handling in RegExp construction. r=jorendorff

js/src/tests/non262/RegExp/oom-in-construction.js

@@ -0,0 +1,17 @@
+// |reftest| skip-if(!this.hasOwnProperty("oomTest"))
+var BUGNUMBER = 1471371;
+var summary = 'Handle OOM in RegExp';
+
+printBugNumber(BUGNUMBER);
+printStatus(summary);
+
+oomTest(function () {
+    for (var i = 0; i < 10; ++i) {
+        try {
+            RegExp("", "gimuyz");
+        } catch { }
+    }
+});
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);

js/src/vm/RegExpObject.cpp

@@ -1415,7 +1415,7 @@ js::ParseRegExpFlags(JSContext* cx, JSString* flagStr, RegExpFlag* flagsOut)
 
     if (!ok) {
         TwoByteChars range(&invalidFlag, 1);
-        UniqueChars utf8(JS::CharsToNewUTF8CharsZ(nullptr, range).c_str());
+        UniqueChars utf8(JS::CharsToNewUTF8CharsZ(cx, range).c_str());
         if (!utf8)
             return false;
         JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_BAD_REGEXP_FLAG, utf8.get());