Fix: fix crash when add property maybe failed on build arguments

openwebf · Nov 25, 2024 · 5c33cb9 · 5c33cb9
1 parent 97c34d9
commit 5c33cb9
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/bridge/third_party/quickjs/src/core/builtins/js-function.c b/bridge/third_party/quickjs/src/core/builtins/js-function.c
@@ -502,6 +502,10 @@ JSValue js_build_arguments(JSContext* ctx, int argc, JSValueConst* argv) {
 
   /* add the length field (cannot fail) */
   pr = add_property(ctx, p, JS_ATOM_length, JS_PROP_WRITABLE | JS_PROP_CONFIGURABLE);
+  if (!pr) {
+    JS_FreeValue(ctx, val);
+    return JS_EXCEPTION;
+  }
   pr->u.value = JS_NewInt32(ctx, argc);
 
   /* initialize the fast array part */
@@ -545,6 +549,8 @@ JSValue js_build_mapped_arguments(JSContext* ctx,
 
   /* add the length field (cannot fail) */
   pr = add_property(ctx, p, JS_ATOM_length, JS_PROP_WRITABLE | JS_PROP_CONFIGURABLE);
+  if (!pr)
+    goto fail;
   pr->u.value = JS_NewInt32(ctx, argc);
 
   for (i = 0; i < arg_count; i++) {