Fix from Gavin Reaney <gavin@picsel.com> for OOM/should-be-OOM bugs (361273, r=me).

js/src/jsarena.c

@@ -165,9 +165,11 @@ JS_ArenaAllocate(JSArenaPool *pool, size_t nb)
             extra = (nb > pool->arenasize) ? HEADER_SIZE(pool) : 0;
             hdrsz = sizeof *a + extra + pool->mask;
             gross = hdrsz + JS_MAX(nb, pool->arenasize);
+            if (gross < nb)
+                return NULL;
             b = (JSArena *) malloc(gross);
             if (!b)
-                return 0;
+                return NULL;
             b->next = NULL;
             b->limit = (jsuword)b + gross;
             JS_COUNT_ARENA(pool,++);
@@ -220,6 +222,7 @@ JS_ArenaRealloc(JSArenaPool *pool, void *p, size_t size, size_t incr)
     extra = HEADER_SIZE(pool);                  /* oversized header holds ap */
     hdrsz = sizeof *a + extra + pool->mask;     /* header and alignment slop */
     gross = hdrsz + aoff;
+    JS_ASSERT(gross > aoff);
     a = (JSArena *) realloc(a, gross);
     if (!a)
         return NULL;

js/src/jsemit.c

@@ -1813,7 +1813,7 @@ EmitAtomIndexOp(JSContext *cx, JSOp op, jsatomid atomIndex, JSCodeGenerator *cg)
  */
 #define EMIT_ATOM_INDEX_OP(op, atomIndex)                                     \
     JS_BEGIN_MACRO                                                            \
-        if (!EmitAtomIndexOp(cx, op, atomIndex, cg) < 0)                      \
+        if (!EmitAtomIndexOp(cx, op, atomIndex, cg))                          \
             return JS_FALSE;                                                  \
     JS_END_MACRO