Bug 959167 - Handle OOM in js::CloneRegExpObject. r=jandem, a=bajaj
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -739,17 +739,17 @@ RegExpCompartment::sizeOfExcludingThis(m
JSObject *
js::CloneRegExpObject(JSContext *cx, JSObject *obj_, JSObject *proto_)
{
RegExpObjectBuilder builder(cx);
Rooted<RegExpObject*> regex(cx, &obj_->as<RegExpObject>());
Rooted<RegExpObject*> proto(cx, &proto_->as<RegExpObject>());
JSObject *res = builder.clone(regex, proto);
- JS_ASSERT(res->type() == regex->type());
+ JS_ASSERT_IF(res, res->type() == regex->type());
return res;
}
bool
js::ParseRegExpFlags(JSContext *cx, JSString *flagStr, RegExpFlag *flagsOut)
{
size_t n = flagStr->length();
const jschar *s = flagStr->getChars(cx);