Crash [@ ensureLinear] due to OOM in ReadFile

RESOLVED FIXED in Firefox 28

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: decoder, Assigned: decoder)

Tracking

(Blocks: 2 bugs, {crash, testcase})

Trunk
mozilla28
x86_64
Linux
crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox28 fixed)

Details

(Whiteboard: [jsbugmon:update])

Attachments

(1 attachment)

(Assignee)

Description

4 years ago
Created attachment 8341455 [details] [diff] [review]
js-readfile-oom.patch

The following test crashes on mozilla-central revision e014d47fc576 (no options required):

oomAfterAllocations(1);
read("x");


The problem is caused by calling ResolvePath and not checking its return value properly. Patch attached.
Attachment #8341455 - Flags: review?(terrence)
Comment on attachment 8341455 [details] [diff] [review]
js-readfile-oom.patch

Review of attachment 8341455 [details] [diff] [review]:
-----------------------------------------------------------------

Great! r=me
Attachment #8341455 - Flags: review?(terrence) → review+
(Assignee)

Comment 2

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/bb06cc9a7088
Status: NEW → ASSIGNED
https://hg.mozilla.org/mozilla-central/rev/bb06cc9a7088
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
status-firefox28: --- → fixed
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.