1640475 - Missing OOM handling after js_malloc in RegExpShared::initializeNamedCaptures

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[André Bargull [:anba]]

Test case:

var i = 0;
oomTest(function() {
    for (var j = 0; j < 10; ++j) {
        var r = RegExp(`(?<_${(i++).toString(32)}>a)`);
        r.exec("a");
    }
});

Asserts with:

Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?)

Reason:
OOM after js_malloc not handled in RegExpShared::initializeNamedCaptures.

Comment 1

[Steven DeTar [:sdetar]]

Iain, could you look at this bug

Comment 2

[Iain Ireland [:iain]]

Attachment: Bug 1640475: Report OOM in initializeNamedCaptures r=mgaudet

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b4c531b04559
Report OOM in initializeNamedCaptures r=mgaudet

Comment 4

[Razvan Maries]

Backed out for SM bustages on bug1640475.js.

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedTaskRun=OdLRGZL9STOjafUT6j462g-0&resultStatus=pending%2Crunning%2Csuccess%2Ctestfailed%2Cbusted%2Cexception&searchStr=linux%2Cx64%2Copt%2Cspidermonkey%2Cbuilds%2Cspidermonkey-sm-fuzzing-linux64%2Fopt%2Csm%28f%29&revision=b4c531b04559f2a59ef43d2f16c7549be01e154d

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=303987999&repo=autoland&lineNumber=14488

Backout: https://hg.mozilla.org/integration/autoland/rev/ca57ba90ff1ab5c8ca519bdeef486f4f65fdecd7

Comment 5

[Iain Ireland [:iain]]

Forgot to make the testcase conditional on oomTest being defined.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/08de9180d90c
Report OOM in initializeNamedCaptures r=mgaudet

Comment 7

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/08de9180d90c