Closed Bug 1488173 Opened Last year Closed Last year

DefineConstructorAndPrototype has fallible failure path

Categories

(Core :: JavaScript Engine, enhancement)

61 Branch
enhancement
Not set

Tracking

()

RESOLVED FIXED
mozilla64
Tracking Status
firefox64 --- fixed

People

(Reporter: jonco, Assigned: jonco)

Details

Attachments

(1 file)

This function can define a constructor property only to delete it again on failure.  There's a comment that says:

        // XXX FIXME - absurd to call this here; instead define the property last.
        DeleteProperty(cx, obj, id, ignored);

I came across this while investigating OOM handling.  Here we can fail earlier in the function due to OOM, and then fail to delete the property in the failure path.
Attachment #9005986 - Flags: review?(jdemooij)
Comment on attachment 9005986 [details] [diff] [review]
bug1488173-define-ctor-property

Review of attachment 9005986 [details] [diff] [review]:
-----------------------------------------------------------------

Definitely simpler.
Attachment #9005986 - Flags: review?(jdemooij) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/cac2d3edfc63
Define constructor property last in DefineConstructorAndPrototype r=jandem
https://hg.mozilla.org/mozilla-central/rev/cac2d3edfc63
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
Target Milestone: mozilla64 → mozilla63
Target Milestone: mozilla63 → mozilla64
You need to log in before you can comment on or make changes to this bug.