diff --git a/js/src/jit-test/tests/debug/bug-1270278.js b/js/src/jit-test/tests/debug/bug-1270278.js new file mode 100644 index 000000000000..984dd8927f18 --- /dev/null +++ b/js/src/jit-test/tests/debug/bug-1270278.js @@ -0,0 +1,18 @@ +// |jit-test| allow-oom; --fuzzing-safe +// Adapted from randomly chosen test: js/src/jit-test/tests/modules/bug-1233915.js +var i = 100; +g = newGlobal(); +g.parent = this; +g.eval("(" + function() { + Debugger(parent).onExceptionUnwind = function(frame) frame.eval(""); +} + ")()"); +// Adapted from randomly chosen test: js/src/jit-test/tests/profiler/bug1242840.js +oomTest(function() { + if (--i < 0) + return; + try { + for (x of y); + } catch (e) { + x + } +}) diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp index e8a446f83f23..95bbdea942b3 100644 --- a/js/src/vm/ScopeObject.cpp +++ b/js/src/vm/ScopeObject.cpp @@ -2736,8 +2736,10 @@ DebugScopes::onPopCall(AbstractFramePtr frame, JSContext* cx) * but it simplifies later indexing logic. */ Rooted> vec(cx, GCVector(cx)); - if (!frame.copyRawFrameSlots(&vec) || vec.length() == 0) + if (!frame.copyRawFrameSlots(&vec) || vec.length() == 0) { + cx->recoverFromOutOfMemory(); return; + } /* * Copy in formals that are not aliased via the scope chain @@ -2757,7 +2759,7 @@ DebugScopes::onPopCall(AbstractFramePtr frame, JSContext* cx) */ RootedArrayObject snapshot(cx, NewDenseCopiedArray(cx, vec.length(), vec.begin())); if (!snapshot) { - cx->clearPendingException(); + cx->recoverFromOutOfMemory(); return; }