Bug 1134969. Make DeepCloneObjectLiteral correctly handle setLastProperty failures. r=waldo
authorBoris Zbarsky <bzbarsky@mit.edu>
Tue, 24 Feb 2015 16:04:22 -0500
changeset 248864 bf95ae9bfe5708671c43e7b1de08aae329a91b2d
parent 248863 5dabb5e547e85a85e3839f57970ef7f7caf26785
child 248865 0512c8c17930163fc91b9f0afe3e64f7f3028d1f
push id7860
push userjlund@mozilla.com
push dateMon, 30 Mar 2015 18:46:02 +0000
treeherdermozilla-aurora@8ac636cd51f3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerswaldo
bugs1134969
milestone39.0a1
Bug 1134969. Make DeepCloneObjectLiteral correctly handle setLastProperty failures. r=waldo
js/src/jsobj.cpp
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1864,17 +1864,18 @@ js::DeepCloneObjectLiteral(JSContext *cx
         clone->setDenseInitializedLength(i + 1);
         clone->initDenseElement(i, v);
     }
 
     MOZ_ASSERT(obj->compartment() == clone->compartment());
     MOZ_ASSERT(!obj->hasPrivate());
     RootedShape shape(cx, obj->lastProperty());
     size_t span = shape->slotSpan();
-    clone->setLastProperty(cx, shape);
+    if (!clone->setLastProperty(cx, shape))
+        return nullptr;
     for (size_t i = 0; i < span; i++) {
         v = obj->getSlot(i);
         if (v.isObject()) {
             deepObj = &v.toObject().as<NativeObject>();
             deepObj = js::DeepCloneObjectLiteral(cx, deepObj, newKind);
             if (!deepObj)
                 return nullptr;
             v.setObject(*deepObj);