325479 - Failure to free a JSScript in obj_eval

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Michael Daumling pointed this out in a private e-mail to brendan. I've checked in a fix for it on the trunk, but we should fix it on the branch too, since it's such a simple fix.

The code in question is:
    ok = js_CheckPrincipalsAccess(cx, scopeobj, principals, js_eval_str);
    if (!ok)
        goto out;

    ok = js_Execute(cx, scopeobj, script, caller, JSFRAME_EVAL, rval);
    JS_DestroyScript(cx, script);

out:

I'll attach a patch for branch consideration in a second.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Branch patch

This is the patch I checked in (backported to the paramaterization changes for js_CheckPrincipalsAccess). Brendan, mind stamping this for posterity?

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

This is already fixed on the trunk, marking it as such.

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 210375 [details] [diff] [review]
Branch patch

Another no-braner ;-).

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branches.

Comment 5

[Dave Liebreich [:davel]]

Please provide a testcase and/or testing guidance for this fix.