tor-browser

commit e68b7a956299aba559a385b565d51ca3cb68e5ba
parent 0e983e2c2febd470e53207a6bc0bc57d0c710423
Author: André Bargull <andre.bargull@gmail.com>
Date:   Mon, 20 Oct 2025 08:04:40 +0000

Bug 1994989: Add missing oom-check in TransformCase. r=spidermonkey-reviewers,iain

Differential Revision: https://phabricator.services.mozilla.com/D269101

Diffstat:
M
js/src/builtin/String.cpp
 | 
3
+++
A
js/src/jit-test/tests/strings/bug1994989.js
 | 
7
+++++++

2 files changed, 10 insertions(+), 0 deletions(-)
diff --git a/js/src/builtin/String.cpp b/js/src/builtin/String.cpp
@@ -1044,6 +1044,9 @@ static JSLinearString* TransformCase(JSContext* cx, Handle<JSString*> string,
     requestedLocale = requestedLocales[0];
   } else {
     requestedLocale = cx->global()->globalIntlData().defaultLocale(cx);
+    if (!requestedLocale) {
+      return nullptr;
+    }
   }
 
   // Steps 4-10.
diff --git a/js/src/jit-test/tests/strings/bug1994989.js b/js/src/jit-test/tests/strings/bug1994989.js
@@ -0,0 +1,7 @@
+oomTest(function() {
+  setRealmLocale("en");
+  "a".toLocaleLowerCase();
+
+  setRealmLocale("de");
+  "a".toLocaleLowerCase();
+}, {keepFailing: true});