tor-browser

commit 142f61d2952f946f2b03b1a4999c577896d05ba3
parent 52c66446034d33a5b41671492d75d72c8c6b6a5f
Author: Hannes Verschore <hv1989@gmail.com>
Date:   Wed,  7 Jan 2026 17:31:27 +0000

Bug 2007770: Fix oom reporting around stubfolding, r=iain

Differential Revision: https://phabricator.services.mozilla.com/D277545

Diffstat:
A
js/src/jit-test/tests/cacheir/bug2007770.js
 | 
6
++++++
M
js/src/jit/StubFolding.cpp
 | 
2
--

2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/js/src/jit-test/tests/cacheir/bug2007770.js b/js/src/jit-test/tests/cacheir/bug2007770.js
@@ -0,0 +1,6 @@
+
+oomTest(function () {
+  Object.defineProperty([], 1, { function() {} });
+  for (var i of "month") {};
+  Object.defineProperty([], "", {});
+});
diff --git a/js/src/jit/StubFolding.cpp b/js/src/jit/StubFolding.cpp
@@ -279,13 +279,11 @@ static bool TryFoldingGuardShapes(JSContext* cx, ICFallbackStub* fallback,
 
     for (uint32_t i = 0; i < shapeList.length(); i++) {
       if (!shapeObj->append(cx, shapeList[i])) {
-        cx->recoverFromOutOfMemory();
         return false;
       }
 
       if (hasSlotOffsets) {
         if (!shapeObj->append(cx, offsetList[i])) {
-          cx->recoverFromOutOfMemory();
           return false;
         }
       }