Bug 1300504 - prevent null pointer dereference in MWasmCall::NewBuiltinInstanceMethodCall. r?jandem draft
authorAndi-Bogdan Postelnicu <bpostelnicu@mozilla.com>
Mon, 05 Sep 2016 13:04:28 +0300
changeset 409861 f52e52c09961a3fddf60bd9793bb5d786840d9a4
parent 409737 dbe4b47941c7b3d6298a0ead5e40dd828096c808
child 530447 bfafcfa9814b1e16f8252f0b4651b61ca6b93e09
push id28584
push userbmo:bpostelnicu@mozilla.com
push dateMon, 05 Sep 2016 10:05:25 +0000
reviewersjandem
bugs1300504
milestone51.0a1
Bug 1300504 - prevent null pointer dereference in MWasmCall::NewBuiltinInstanceMethodCall. r?jandem MozReview-Commit-ID: 1oQVjnyJAMm
js/src/jit/MIR.cpp
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -5426,16 +5426,18 @@ MWasmCall::NewBuiltinInstanceMethodCall(
                                         const Args& args,
                                         MIRType resultType,
                                         uint32_t spIncrement)
 {
     auto callee = wasm::CalleeDesc::builtinInstanceMethod(builtin);
     MWasmCall* call = MWasmCall::New(alloc, desc, callee, args, resultType, spIncrement,
                                      MWasmCall::DontSaveTls, nullptr);
 
+    if (!call)
+        return nullptr;
     MOZ_ASSERT(instanceArg != ABIArg()); // instanceArg must be initialized.
     call->instanceArg_ = instanceArg;
     return call;
 }
 
 void
 MSqrt::trySpecializeFloat32(TempAllocator& alloc) {
     if (!input()->canProduceFloat32() || !CheckUsesAreFloat32Consumers(this)) {