js::ArraySetLength should return false when getGroup returns nullptr.

RESOLVED FIXED in Firefox 47

Status

()

Core
JavaScript Engine
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: arai, Assigned: arai)

Tracking

Trunk
mozilla47
Points:
---

Firefox Tracking Flags

(firefox47 fixed)

Details

Attachments

(1 attachment)

(Assignee)

Description

2 years ago
Similar to bug 1248405, 

https://dxr.mozilla.org/mozilla-central/rev/e355cacefc881ba360d412853b57e8e060e966f4/js/src/jsarray.cpp#618
>         ObjectGroup* arrGroup = arr->getGroup(cx);
>         if (!arr->isIndexed() &&
>             !MOZ_UNLIKELY(!arrGroup || arrGroup->hasAllFlags(OBJECT_FLAG_ITERATED)))

it should return false immediately when !arrGroup.
(Assignee)

Comment 1

2 years ago
Created attachment 8719517 [details] [diff] [review]
Handle JSObject::getGroup OOM in js::ArraySetLength.

just handled group == nullptr case.
Assignee: nobody → arai.unmht
Attachment #8719517 - Flags: review?(jdemooij)

Updated

2 years ago
Attachment #8719517 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 2

2 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/995ff53a4d50c9986e3475c1b4bc1ea8cc0f7aad
Bug 1248420 - Handle JSObject::getGroup OOM in js::ArraySetLength. r=jandem

Comment 3

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/995ff53a4d50
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox47: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla47
You need to log in before you can comment on or make changes to this bug.