Bug 1134969. Make DeepCloneObjectLiteral correctly handle setLastProperty failures. r=waldo

2015-02-24 16:04:22 -05:00
parent d8d38e06f2
commit 36b39012f8
1 changed files with 2 additions and 1 deletions
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1869,7 +1869,8 @@ js::DeepCloneObjectLiteral(JSContext *cx, HandleNativeObject obj, NewObjectKind
    MOZ_ASSERT(!obj->hasPrivate());
    RootedShape shape(cx, obj->lastProperty());
    size_t span = shape->slotSpan();
-    clone->setLastProperty(cx, shape);
+    if (!clone->setLastProperty(cx, shape))
+        return nullptr;
    for (size_t i = 0; i < span; i++) {
        v = obj->getSlot(i);
        if (v.isObject()) {