Closed Bug 661867 Opened 13 years ago Closed 13 years ago

IonMonkey: Fix null pointer deref in MUseIterator when last element of use chain is removed during iteration

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Attached patch Easy fix.Splinter Review
next() null pointer derefs if there's no more entries in the chain, which can happen unchecked after removing the last entry from the use chain.
Attachment #537169 - Flags: review?(dvander)
Attachment #537169 - Flags: review?(dvander) → review+
http://hg.mozilla.org/users/danderson_mozilla.com/ionmonkey/rev/3a6a471a2e1a
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.