Bug 978226 - Don't leak the script's table when we OOM in LazyScript::CreateRaw; r=till

--HG--
extra : rebase_source : d1a4d6c9cbe09a8956893f8810c75fdb2f8d7ccb

js/src/jsscript.cpp

@@ -36,6 +36,7 @@
 #include "jit/BaselineJIT.h"
 #include "jit/IonCode.h"
 #include "js/OldDebugAPI.h"
+#include "js/Utility.h"
 #include "vm/ArgumentsObject.h"
 #include "vm/Compression.h"
 #include "vm/Debugger.h"
@@ -3582,12 +3583,9 @@ LazyScript::CreateRaw(ExclusiveContext *cx, HandleFunction fun,
     size_t bytes = (p.numFreeVariables * sizeof(HeapPtrAtom))
                  + (p.numInnerFunctions * sizeof(HeapPtrFunction));
 
-    void *table = nullptr;
+    ScopedJSFreePtr<void> table(bytes ? cx->malloc_(bytes) : nullptr);
-    if (bytes) {
+    if (bytes && !table)
-        table = cx->malloc_(bytes);
+        return nullptr;
-        if (!table)
-            return nullptr;
-    }
 
     LazyScript *res = js_NewGCLazyScript(cx);
     if (!res)
@@ -3595,7 +3593,7 @@ LazyScript::CreateRaw(ExclusiveContext *cx, HandleFunction fun,
 
     cx->compartment()->scheduleDelazificationForDebugMode();
 
-    return new (res) LazyScript(fun, table, packed, begin, end, lineno, column);
+    return new (res) LazyScript(fun, table.forget(), packed, begin, end, lineno, column);
 }
 
 /* static */ LazyScript *