Bug 1483183 - Discard pending exception during CCW GetProp IC failure r=tcampbell
authorMatthew Gaudet <mgaudet@mozilla.com>
Wed, 15 Aug 2018 17:33:08 -0700
changeset 432430 79082cb95664b59e9507d7099854bae30caa4921
parent 432429 2e949e5a9a62d0db0d33833e1e875f12f2969ac4
child 432431 a6c928f38da70047596a5933427166932a3540a3
push id106734
push usermgaudet@mozilla.com
push dateMon, 20 Aug 2018 17:37:49 +0000
treeherdermozilla-inbound@a6c928f38da7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstcampbell
bugs1483183
milestone63.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1483183 - Discard pending exception during CCW GetProp IC failure r=tcampbell
js/src/jit-test/tests/cacheir/bug1483183.js
js/src/jit/CacheIR.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/cacheir/bug1483183.js
@@ -0,0 +1,8 @@
+if (!('stackTest' in this))
+    quit();
+
+stackTest(new Function(`
+newGlobal({
+  sameZoneAs: []
+}).frame;
+`));
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -1136,18 +1136,20 @@ GetPropIRGenerator::tryAttachCrossCompar
     // If we allowed different zones we would have to wrap strings.
     if (unwrapped->compartment()->zone() != cx_->compartment()->zone())
         return false;
 
     // Take the unwrapped object's global, and wrap in a
     // this-compartment wrapper. This is what will be stored in the IC
     // keep the compartment alive.
     RootedObject wrappedTargetGlobal(cx_, &unwrapped->nonCCWGlobal());
-    if (!cx_->compartment()->wrap(cx_, &wrappedTargetGlobal))
-        return false;
+    if (!cx_->compartment()->wrap(cx_, &wrappedTargetGlobal)) {
+        cx_->clearPendingException();
+        return false;
+    }
 
     bool isWindowProxy = false;
     RootedShape shape(cx_);
     RootedNativeObject holder(cx_);
 
     // Enter realm of target since some checks have side-effects
     // such as de-lazifying type info.
     {