diff --git a/js/src/jit-test/tests/gc/bug-1238582.js b/js/src/jit-test/tests/gc/bug-1238582.js new file mode 100644 index 000000000000..60286c8eee87 --- /dev/null +++ b/js/src/jit-test/tests/gc/bug-1238582.js @@ -0,0 +1,4 @@ +if (!('oomTest' in this)) + quit(); + +oomTest(() => { let a = [2147483651]; [a[0], a[undefined]].sort(); }); diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp index 40e6c8475072..0512b6923d13 100644 --- a/js/src/jsarray.cpp +++ b/js/src/jsarray.cpp @@ -1741,7 +1741,7 @@ SortLexicographically(JSContext* cx, AutoValueVector* vec, size_t len) Vector strElements(cx); /* MergeSort uses the upper half as scratch space. */ - if (!strElements.reserve(2 * len)) + if (!strElements.resize(2 * len)) return false; /* Convert Values to strings. */ @@ -1753,14 +1753,10 @@ SortLexicographically(JSContext* cx, AutoValueVector* vec, size_t len) if (!ValueToStringBuffer(cx, (*vec)[i], sb)) return false; - StringifiedElement el = { cursor, sb.length(), i }; - strElements.infallibleAppend(el); + strElements[i] = { cursor, sb.length(), i }; cursor = sb.length(); } - /* Resize strElements so we can perform MergeSort. */ - JS_ALWAYS_TRUE(strElements.resize(2 * len)); - /* Sort Values in vec alphabetically. */ return MergeSortByKey(strElements.begin(), len, strElements.begin() + len, SortComparatorStringifiedElements(cx, sb), vec); @@ -1780,7 +1776,7 @@ SortNumerically(JSContext* cx, AutoValueVector* vec, size_t len, ComparatorMatch Vector numElements(cx); /* MergeSort uses the upper half as scratch space. */ - if (!numElements.reserve(2 * len)) + if (!numElements.resize(2 * len)) return false; /* Convert Values to numerics. */ @@ -1792,13 +1788,9 @@ SortNumerically(JSContext* cx, AutoValueVector* vec, size_t len, ComparatorMatch if (!ToNumber(cx, (*vec)[i], &dv)) return false; - NumericElement el = { dv, i }; - numElements.infallibleAppend(el); + numElements[i] = { dv, i }; } - /* Resize strElements so we can perform MergeSort. */ - JS_ALWAYS_TRUE(numElements.resize(2 * len)); - /* Sort Values in vec numerically. */ return MergeSortByKey(numElements.begin(), len, numElements.begin() + len, SortComparatorNumerics[comp], vec);