Closed
Bug 987933
Opened 11 years ago
Closed 10 years ago
OOM: inlineScriptedCall() forgets to check TypeSet::clone() return
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: sstangl, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: sec-other)
Attachments
(1 file)
|
(deleted),
patch
|
Details | Diff | Splinter Review |
Simple thinko. Testcase from decoder (js__jit__MTypeBarrier__MTypeBarrier.txt). Probably not exploitable.
|
||
Comment 1•11 years ago
|
||
Setting to sec-other per comment 0. Feel free to adjust.
Keywords: sec-other
|
Reporter | |
Comment 2•10 years ago
|
||
Comment on attachment 8396640 [details] [diff] [review]
patch
Apparently I requested review from myself on this patch? It's been fixed in the meantime.
Attachment #8396640 -
Flags: review?
|
|
Reporter | |
Updated•10 years ago
|
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
|
||
Updated•9 years ago
|
Group: core-security → core-security-release
|
||
Updated•7 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•