Bug 959167 - Handle OOM in js::CloneRegExpObject. r=jandem, a=bajaj
authorChristian Holler <choller@mozilla.com>
Wed, 22 Jan 2014 14:37:53 +0100
changeset 167971 840132b6f702ae359d954cbf6c0920e405de4825
parent 167970 95fd8e21ee4947e727c978216fa62ded2918c5df
child 167972 f14cc0345552e00184193a9836e7a798efb3cd1c
push id428
push userbbajaj@mozilla.com
push dateTue, 28 Jan 2014 00:16:25 +0000
treeherdermozilla-release@cd72a7ff3a75 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, bajaj
bugs959167
milestone27.0
Bug 959167 - Handle OOM in js::CloneRegExpObject. r=jandem, a=bajaj
js/src/vm/RegExpObject.cpp
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -750,17 +750,17 @@ RegExpCompartment::sizeOfExcludingThis(m
 
 JSObject *
 js::CloneRegExpObject(JSContext *cx, JSObject *obj_, JSObject *proto_)
 {
     RegExpObjectBuilder builder(cx);
     Rooted<RegExpObject*> regex(cx, &obj_->as<RegExpObject>());
     Rooted<RegExpObject*> proto(cx, &proto_->as<RegExpObject>());
     JSObject *res = builder.clone(regex, proto);
-    JS_ASSERT(res->type() == regex->type());
+    JS_ASSERT_IF(res, res->type() == regex->type());
     return res;
 }
 
 bool
 js::ParseRegExpFlags(JSContext *cx, JSString *flagStr, RegExpFlag *flagsOut)
 {
     size_t n = flagStr->length();
     const jschar *s = flagStr->getChars(cx);