Bug 990787, part 3 - Add an OOM check in js_InitArrayClass. r=njn.

--HG--
extra : rebase_source : 60cef5ef99809dbf2c9d19dde1dcaa81fd70ebea
This commit is contained in:
Jason Orendorff 2014-04-08 12:35:17 -05:00
parent b544f96b27
commit 23215018a5

View File

@ -3083,6 +3083,8 @@ js_InitArrayClass(JSContext *cx, HandleObject obj)
RootedShape shape(cx, EmptyShape::getInitialShape(cx, &ArrayObject::class_, TaggedProto(proto),
proto->getParent(), metadata,
gc::FINALIZE_OBJECT0));
if (!shape)
return nullptr;
RootedObject arrayProto(cx, JSObject::createArray(cx, gc::FINALIZE_OBJECT4, gc::TenuredHeap, shape, type, 0));
if (!arrayProto || !JSObject::setSingletonType(cx, arrayProto) || !AddLengthProperty(cx, arrayProto))