Bug 1652148: Handle allocation failure in AggregateError constructor. r=jorendorff

Differential Revision: https://phabricator.services.mozilla.com/D83236

js/src/jit-test/tests/auto-regress/bug1652148.js

@@ -0,0 +1,5 @@
+// |jit-test| skip-if: !('oomTest' in this)
+
+oomTest(() => {
+  new AggregateError([]);
+});

js/src/vm/ErrorObject.cpp

@@ -287,6 +287,9 @@ static ArrayObject* IterableToArray(JSContext* cx, HandleValue iterable) {
   }
 
   RootedArrayObject array(cx, NewDenseEmptyArray(cx));
+  if (!array) {
+    return nullptr;
+  }
 
   RootedValue nextValue(cx);
   while (true) {