Closed Bug 556340 Opened 10 years ago Closed 10 years ago

TypedArrayTemplate<*>::fun_slice leaks ntarray when JS_NewObject fails

Categories

(Core :: JavaScript Engine, defect, minor)

defect
Not set
minor

Tracking

()

RESOLVED FIXED

People

(Reporter: timeless, Assigned: timeless)

References

(Blocks 1 open bug, )

Details

(Keywords: coverity, Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

701 bytes, patch
jorendorff
: review+
Details | Diff | Splinter Review
724     fun_slice(JSContext *cx, uintN argc, jsval *vp)
769         ThisTypeArray *ntarray = tarray->slice(begin, end);

779         JSObject *nobj = JS_NewObject(cx, slowClass(), NULL, NULL);
780         if (!nobj)
781             return false;
Attached patch patchSplinter Review
Assignee: general → timeless
Status: NEW → ASSIGNED
Attachment #436240 - Flags: review?(jorendorff)
Whiteboard: fixed-in-tracemonkey
http://hg.mozilla.org/mozilla-central/rev/3c97945fb93c
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.