tor-browser

commit cb66b5da9ff90c616e9d1b4e015af09be199154d
parent 4ac08d706ab9cba291c523107c2a43481e31d34b
Author: Julien Pages <jpages@mozilla.com>
Date:   Tue, 21 Oct 2025 12:16:25 +0000

Bug 1994058 - Missing ReportOutOfMemory in wasm AsyncInstantiate function. r=rhunt

Differential Revision: https://phabricator.services.mozilla.com/D269209

Diffstat:
A
js/src/jit-test/tests/wasm/bug1994058.js
 | 
3
+++
M
js/src/wasm/WasmJS.cpp
 | 
14
+++++++-------

2 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/js/src/jit-test/tests/wasm/bug1994058.js b/js/src/jit-test/tests/wasm/bug1994058.js
@@ -0,0 +1,3 @@
+oomTest(function() {
+   WebAssembly.instantiate(new WebAssembly.Module(wasmTextToBinary("(module)")));
+});
diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
@@ -4372,6 +4372,12 @@ static bool Reject(JSContext* cx, const CompileArgs& args,
   return PromiseObject::reject(cx, promise, rejectionValue);
 }
 
+static bool RejectWithOutOfMemory(JSContext* cx,
+                                  Handle<PromiseObject*> promise) {
+  ReportOutOfMemory(cx);
+  return RejectWithPendingException(cx, promise);
+}
+
 static void LogAsync(JSContext* cx, const char* funcName,
                      const Module& module) {
   Log(cx, "async %s succeeded%s", funcName,
@@ -4450,7 +4456,7 @@ static bool AsyncInstantiate(JSContext* cx, const Module& module,
                              Handle<PromiseObject*> promise) {
   auto task = js::MakeUnique<AsyncInstantiateTask>(cx, module, ret, promise);
   if (!task || !task->init(cx)) {
-    return false;
+    return RejectWithOutOfMemory(cx, promise);
   }
 
   if (!GetImports(cx, module, importObj, &task->imports())) {
@@ -5177,12 +5183,6 @@ static bool RejectWithErrorNumber(JSContext* cx, uint32_t errorNumber,
   return RejectWithPendingException(cx, promise);
 }
 
-static bool RejectWithOutOfMemory(JSContext* cx,
-                                  Handle<PromiseObject*> promise) {
-  ReportOutOfMemory(cx);
-  return RejectWithPendingException(cx, promise);
-}
-
 static bool ResolveResponse_OnFulfilled(JSContext* cx, unsigned argc,
                                         Value* vp) {
   CallArgs callArgs = CallArgsFromVp(argc, vp);