Bug 1117240 - Check return value when creating type object in RegExpCompartment::createMatchResultTemp() r=bhackett
authorJon Coppeard <jcoppeard@mozilla.com>
Tue, 06 Jan 2015 11:28:16 +0000
changeset 248036 b25b5bedc53a28d5fbe6639fb38662483ce94c38
parent 248035 3405b354e2f1e49513ffb49b24a8106b4b3d06a9
child 248037 1d470bfb9e47db87db7b1654758a57d670ed8a0d
push id4489
push userraliiev@mozilla.com
push dateMon, 23 Feb 2015 15:17:55 +0000
treeherdermozilla-beta@fd7c3dc24146 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1117240
milestone37.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1117240 - Check return value when creating type object in RegExpCompartment::createMatchResultTemp() r=bhackett
js/src/vm/RegExpObject.cpp
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -705,16 +705,18 @@ RegExpCompartment::createMatchResultTemp
     RootedArrayObject templateObject(cx, NewDenseUnallocatedArray(cx, 0, nullptr, TenuredObject));
     if (!templateObject)
         return matchResultTemplateObject_; // = nullptr
 
     // Create a new type for the template.
     Rooted<TaggedProto> proto(cx, templateObject->getTaggedProto());
     types::TypeObject *type =
         cx->compartment()->types.newTypeObject(cx, templateObject->getClass(), proto);
+    if (!type)
+        return matchResultTemplateObject_; // = nullptr
     templateObject->setType(type);
 
     /* Set dummy index property */
     RootedValue index(cx, Int32Value(0));
     if (!baseops::DefineProperty(cx, templateObject, cx->names().index, index, nullptr, nullptr,
                                  JSPROP_ENUMERATE))
     {
         return matchResultTemplateObject_; // = nullptr