Last Comment Bug 771723 - IonMonkey: defineReturn() ignores error return of fallible function call.
: IonMonkey: defineReturn() ignores error return of fallible function call.
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86 Mac OS X
: -- normal (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-06 17:09 PDT by Eric Faust [:efaust]
Modified: 2012-07-06 17:15 PDT (History)
0 users
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Eric Faust [:efaust] 2012-07-06 17:09:32 PDT
defineReturn() in Lowering-shared-inl.h calls defineBox(), which can fail, without checking the return value or propagating the error.
Comment 1 Eric Faust [:efaust] 2012-07-06 17:15:44 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/749524f1d326

Note You need to log in before you can comment on or make changes to this bug.