Handle OOM in NewPropertyIteratorObject

RESOLVED DUPLICATE of bug 948188

Status

()

Core
JavaScript Engine
--
critical
RESOLVED DUPLICATE of bug 948188
4 years ago
4 years ago

People

(Reporter: decoder, Unassigned)

Tracking

(Blocks: 2 bugs, {crash})

Trunk
x86_64
Linux
crash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
In NewPropertyIteratorObject we seem to be calling NewBuiltinClassInstance without checking its return value, although it's fallible:

>     return &NewBuiltinClassInstance(cx, &PropertyIteratorObject::class_)->as<PropertyIteratorObject>();


The attached patch checks the return value first and returns NULL on failure. This fixes an OOM crash bug for me that the fuzzer keeps hitting.
(Reporter)

Comment 1

4 years ago
Nice.. now we have two bugs. Horray Bugzilla for messing the forms up.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 948188
You need to log in before you can comment on or make changes to this bug.