332415 - Double free lurking in js_NewRegExpObject

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

I noticed this piece of code the other day:

    obj = js_NewObject(cx, &js_RegExpClass, NULL, NULL);
    if (!obj || !JS_SetPrivate(cx, obj, re) || !js_SetLastIndex(cx, obj, 0)) {
        js_DestroyRegExp(cx, re);

In the case that the JS_SetPrivate succeeds and the js_SetLastIndex fails, re is held on to by the object (to be released in its finalizer) but it's also destroyed by the explict call to js_DestroyRegExp. Brendan has a patch.

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Brendan Eich [:brendan]]

Fixed on trunk and 1.8 branch.

/be

Comment 3

[Bob Clary [:bc] (inactive)]

not on 1.8.0, not making js16