Re: [PATCH 0/4] MR8781: jscript: Misc array and toString fixes.

[Jacek Caban (＠jacek)]

Jacek Caban (@jacek) commented about dlls/jscript/function.c:
> -
>        hres = JS_E_JSCRIPT_EXPECTED;
> -
>    goto fail;
> - }
> -
> - if(FAILED(VariantChangeType(&var, &var, 0, VT_UI4))) {
> -
>    VariantClear(&var);
> -
>    hres = JS_E_JSCRIPT_EXPECTED;
> -
>    goto fail;
> - }
> - length = V_UI4(&var);
> -
> - argv = malloc(length * sizeof(*argv));
> - if(!argv) {
> -
>    hres = E_OUTOFMEMORY;
> -
>    goto fail;
> - }

Tests hang on 64-bit build when trying to apply -1 length. I didn't look deeper, but I suspect you're depending on allocation failure to handle that case.