Bug 623859 - Add missing OOM checks during array allocation (r=lw)

2011-01-07 18:55:35 -08:00
parent ee1ab7285d
commit 326619a3c1
2 changed files with 21 additions and 0 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2996,6 +2996,8 @@ NewArray(JSContext *cx, jsuint length, JSObject *proto)

    gc::FinalizeKind kind = GuessObjectGCKind(length, true);
    JSObject *obj = detail::NewObject<WithProto::Class, false>(cx, &js_ArrayClass, proto, NULL, kind);
+    if (!obj)
+        return NULL;

    obj->setArrayLength(length);

@@ -3027,6 +3029,9 @@ JSObject *
 NewDenseCopiedArray(JSContext *cx, uintN length, Value *vp, JSObject *proto)
 {
    JSObject* obj = NewArray<true>(cx, length, proto);
+    if (!obj)
+        return NULL;
+
    JS_ASSERT(obj->getDenseArrayCapacity() >= length);

    if (vp)