Bug 959167 - Handle OOM in js::CloneRegExpObject. r=jandem, a=bajaj
authorChristian Holler <choller@mozilla.com>
Wed, 22 Jan 2014 14:37:22 +0100
changeset 175922 b4912bd395c71c7a7841be09f9e3b09f00b09a49
parent 175921 590e76b01565638da69afa4eab396a4ce58c6a96
child 175923 164d5ef28143b2e344678818f8ff0682e254eab5
push id445
push userffxbld
push dateMon, 10 Mar 2014 22:05:19 +0000
treeherdermozilla-release@dc38b741b04e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, bajaj
bugs959167
milestone28.0a2
Bug 959167 - Handle OOM in js::CloneRegExpObject. r=jandem, a=bajaj
js/src/vm/RegExpObject.cpp
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -739,17 +739,17 @@ RegExpCompartment::sizeOfExcludingThis(m
 
 JSObject *
 js::CloneRegExpObject(JSContext *cx, JSObject *obj_, JSObject *proto_)
 {
     RegExpObjectBuilder builder(cx);
     Rooted<RegExpObject*> regex(cx, &obj_->as<RegExpObject>());
     Rooted<RegExpObject*> proto(cx, &proto_->as<RegExpObject>());
     JSObject *res = builder.clone(regex, proto);
-    JS_ASSERT(res->type() == regex->type());
+    JS_ASSERT_IF(res, res->type() == regex->type());
     return res;
 }
 
 bool
 js::ParseRegExpFlags(JSContext *cx, JSString *flagStr, RegExpFlag *flagsOut)
 {
     size_t n = flagStr->length();
     const jschar *s = flagStr->getChars(cx);