My fix for bug 355258 introduced a regression in js_OnUnknownMethod: the method got early return after failed js_IsFunctionQName. That would lead to the missing JS_POP_TEMP_ROOT on out-of-memory. The static analyzer for the control flow discovered this bug, see bug 432915.
Created attachment 322345 [details] [diff] [review] fix v1 The fix added the missing goto.
Comment on attachment 322345 [details] [diff] [review] fix v1 Should go into .next -- guess that means into jsinterp.cpp in mozilla-central when it is open. /be
3.0.1, pretty please.
Comment on attachment 322345 [details] [diff] [review] fix v1 a=shaver, please land on CVS trunk before noon Pacific.
I checked in the patch from the comment 1 to the trunk: http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&branch=HEAD&cvsroot=%2Fcvsroot&date=explicit&mindate=1211997242&maxdate=1211997600&who=igor%25mir2.org