Last Comment Bug 948187 - Handle OOM in NewPropertyIteratorObject
: Handle OOM in NewPropertyIteratorObject
Status: RESOLVED DUPLICATE of bug 948188
: crash
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
-- critical (vote)
: ---
Assigned To: general
: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: langfuzz 912928
  Show dependency treegraph
Reported: 2013-12-09 15:46 PST by Christian Holler (:decoder)
Modified: 2013-12-09 15:50 PST (History)
2 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

js-NewPropertyIteratorObject-oom.patch (1.12 KB, patch)
2013-12-09 15:46 PST, Christian Holler (:decoder)
no flags Details | Diff | Splinter Review

Description User image Christian Holler (:decoder) 2013-12-09 15:46:32 PST
In NewPropertyIteratorObject we seem to be calling NewBuiltinClassInstance without checking its return value, although it's fallible:

>     return &NewBuiltinClassInstance(cx, &PropertyIteratorObject::class_)->as<PropertyIteratorObject>();

The attached patch checks the return value first and returns NULL on failure. This fixes an OOM crash bug for me that the fuzzer keeps hitting.
Comment 1 User image Christian Holler (:decoder) 2013-12-09 15:50:18 PST
Nice.. now we have two bugs. Horray Bugzilla for messing the forms up.

*** This bug has been marked as a duplicate of bug 948188 ***

Note You need to log in before you can comment on or make changes to this bug.