620182 - [@ QuoteString | DecompileSwitch] when JSVAL_IS_DOUBLE(key) and SprintDoubleValue fails due to oom

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[timeless]

1168 DecompileSwitch(SprintStack *ss, TableEntry *table, uintN tableLength,

1235                 todo = -1;
1236                 if (table[i].label) {
1239                 } else if (JSVAL_IS_DOUBLE(key)) {
this can return -1 on oom:
1242                     todo = SprintDoubleValue(&ss->sprinter, key, &junk);
1243                     str = NULL;
1244                 } else {
1248                 }
1249                 if (todo >= 0) {
1251                 } else {
and we crash under here:
1252                     rval = QuoteString(&ss->sprinter, str, (jschar)
1253                                        (JSVAL_IS_STRING(key) ? '"' : 0));

684 QuoteString(Sprinter *sp, JSString *str, uint32 quote)
701     str->getCharsAndEnd(s, z);

Comment 1

[timeless]

Attachment: patch

Comment 2

[Jason Orendorff [:jorendorff]]

Comment on attachment 498576 [details] [diff] [review]
patch

Review of attachment 498576 [details] [diff] [review]:

Write `todo < 0` instead of `todo == -1`. They're equivalent here, but `< 0` is more consistent with what the rest of the file does. r=me with that.

Comment 3

[(no longer active)]

Attachment: For checkin

Comment 4

[Phil Ringnalda (:philor)]

http://hg.mozilla.org/tracemonkey/rev/7e6f3b179644

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/7e6f3b179644