411702 - Bogus OOM handling in js_InitTokenStream

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Crowder]

Following a JS_ARENA_ALLOCATE_CAST, this routine checks one of its input parameters for null, rather than the pointer returned by the allocation (found this while coding a buggy change for arena allocations):

    JS_ARENA_ALLOCATE_CAST(buf, jschar *, &cx->tempPool, nb);
    if (!ts) {
        js_ReportOutOfScriptQuota(cx);
        return JS_FALSE;
    }

I think the comparison here should be |if (!buf)|

I'll look for other instances of this and submit a patch.

Comment 1

[Brian Crowder]

cc:ing igor since this is near code he's changed recently

Comment 2

[Brian Crowder]

Attachment: Typo fix?

This was the only instance of this I could find.  Either the code is unclear or there is a bug here.

Comment 3

[Brian Crowder]

I r?d brendan because the code doesn't seem to be Igor's, really.  The conditional here seems actually to have existed since the lizard was released.

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 296400 [details] [diff] [review]
Typo fix?

Oldest bug I've seen in a while -- thanks!

/be

Comment 5

[Brian Crowder]

jsscan.c: 3.145

Didn't see any other obvious examples of bugs like this, btw.