Bug 698584 - Fix crash in RegExp.test in case of OOM. r=mrbkap
authorTom Schuster <evilpies@gmail.com>
Thu, 03 Nov 2011 21:57:32 +0100
changeset 79702 f73841ef020aeb6662e3d2aaf98e116c16bfb62c
parent 79701 797d8083efcac52490a8182017eea6ea52e528e7
child 79703 a242f11d7c58f72c91894847c99bc41819a0fd92
push id3104
push userevilpies@gmail.com
push dateThu, 03 Nov 2011 20:59:18 +0000
treeherdermozilla-inbound@a242f11d7c58 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmrbkap
bugs698584
milestone10.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 698584 - Fix crash in RegExp.test in case of OOM. r=mrbkap
js/src/builtin/RegExp.cpp
js/src/jit-test/tests/basic/bug698584.js
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -530,16 +530,18 @@ ExecuteRegExp(JSContext *cx, Native nati
 
     /* Step 2. */
     JSString *input = js_ValueToString(cx, (args.length() > 0) ? args[0] : UndefinedValue());
     if (!input)
         return false;
 
     /* Step 3. */
     JSLinearString *linearInput = input->ensureLinear(cx);
+    if (!linearInput)
+        return false;
     const jschar *chars = linearInput->chars();
     size_t length = input->length();
 
     /* Step 4. */
     const Value &lastIndex = reobj->getLastIndex();
 
     /* Step 5. */
     jsdouble i;
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug698584.js
@@ -0,0 +1,13 @@
+/* 
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+const MAX = 10000;
+var str = "";
+for (var i = 0; i < MAX; ++i) {
+    /x/.test(str);
+    str += str + 'xxxxxxxxxxxxxx';
+}
+
+/* Don't crash */