Bug 1336054: Add allocation check in wasmTextToBinary's ParseBlock; r?luke draft
authorBenjamin Bouvier <benj@benj.me>
Thu, 02 Feb 2017 12:23:32 +0100
changeset 469558 e02dafc2f9540323047ff4ab583575b81545c9e6
parent 469557 b4d24ef6105c8a2b380caab845f00dc08e8f2cf3
child 544237 e70f5a5831e5195cc78b08ff780ed8b97c67849f
push id43767
push userbbouvier@mozilla.com
push dateThu, 02 Feb 2017 11:26:10 +0000
reviewersluke
bugs1336054
milestone54.0a1
Bug 1336054: Add allocation check in wasmTextToBinary's ParseBlock; r?luke MozReview-Commit-ID: 2Wkg8SMy6RT
js/src/jit-test/tests/wasm/regress/oom-wasmtexttobinary-block.js
js/src/wasm/WasmTextToBinary.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/oom-wasmtexttobinary-block.js
@@ -0,0 +1,8 @@
+if (typeof oomTest === 'undefined')
+    quit();
+
+try {
+    oomTest((function () {
+        wasmTextToBinary("(module(func(loop $label1 $label0)))");
+    }));
+} catch(e) { }
--- a/js/src/wasm/WasmTextToBinary.cpp
+++ b/js/src/wasm/WasmTextToBinary.cpp
@@ -1614,16 +1614,18 @@ ParseBlock(WasmParseContext& c, Op op, b
     if (!inParens) {
         if (!c.ts.match(WasmToken::End, c.error))
             return nullptr;
         if (!MaybeMatchName(c, name))
             return nullptr;
     }
 
     AstBlock* result = new(c.lifo) AstBlock(op, type, name, Move(exprs));
+    if (!result)
+        return nullptr;
 
     if (op == Op::Loop && !otherName.empty()) {
         if (!exprs.append(result))
             return nullptr;
         result = new(c.lifo) AstBlock(Op::Block, type, otherName, Move(exprs));
     }
 
     return result;