Bug 829421 - Free ArgumentsData if JSObject allocation fails. r=nbp
☠☠ backed out by dbaf061c64fb ☠ ☠
authorTim Lunn <tim@feathertop.org>
Thu, 17 Jan 2013 09:26:09 -0800
changeset 119164 e7e4224b8c8d6bd5cfdc7f9e4bc5497ea7bc88de
parent 119163 ec5df8e5a755c8b2a3cb6dbb048fb2c85d94291f
child 119165 1f4836f0da578c9910b67213a90a403e54f353c0
push id24195
push userMs2ger@gmail.com
push dateSat, 19 Jan 2013 16:10:11 +0000
treeherderautoland@02e12a80aef9 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs829421
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 829421 - Free ArgumentsData if JSObject allocation fails. r=nbp
js/src/vm/ArgumentsObject.cpp
--- a/js/src/vm/ArgumentsObject.cpp
+++ b/js/src/vm/ArgumentsObject.cpp
@@ -156,18 +156,20 @@ ArgumentsObject::create(JSContext *cx, H
     /* Copy [0, numArgs) into data->slots. */
     HeapValue *dst = data->args, *dstEnd = data->args + numArgs;
     copy.copyArgs(cx, dst);
 
     data->deletedBits = reinterpret_cast<size_t *>(dstEnd);
     ClearAllBitArrayElements(data->deletedBits, numDeletedWords);
 
     RawObject obj = JSObject::create(cx, FINALIZE_KIND, shape, type, NULL);
-    if (!obj)
+    if (!obj) {
+        cx->free_(data);
         return NULL;
+    }
 
     obj->initFixedSlot(INITIAL_LENGTH_SLOT, Int32Value(numActuals << PACKED_BITS_COUNT));
     obj->initFixedSlot(DATA_SLOT, PrivateValue(data));
 
     copy.maybeForwardToCallObject(obj, data);
 
     ArgumentsObject &argsobj = obj->asArguments();
     JS_ASSERT(argsobj.initialLength() == numActuals);