Bug 1846247: Check for OOM in FinishDynamicModuleImport_impl r=jonco

I'm not including the fuzz testcase here because it's slow and didn't reduce well, and I don't think these OOM testcases add much value. Differential Revision: https://phabricator.services.mozilla.com/D184955
Brli · Aug 1, 2023 · 3c86fa0 · 3c86fa0
1 parent a882aff
commit 3c86fa0
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/js/src/builtin/ModuleObject.cpp b/js/src/builtin/ModuleObject.cpp
@@ -2493,7 +2493,7 @@ bool FinishDynamicModuleImport_impl(JSContext* cx,
                                     HandleObject moduleRequest,
                                     HandleObject promiseArg) {
   Rooted<ListObject*> resolutionArgs(cx, ListObject::create(cx));
-  if (!resolutionArgs->append(cx, referencingPrivate)) {
+  if (!resolutionArgs || !resolutionArgs->append(cx, referencingPrivate)) {
     return false;
   }
   Rooted<Value> stringValue(

diff --git a/js/src/jit-test/tests/modules/bug1846247.js b/js/src/jit-test/tests/modules/bug1846247.js
@@ -0,0 +1,7 @@
+// |jit-test| skip-if: !('oomTest' in this); allow-unhandlable-oom
+ignoreUnhandledRejections();
+oomTest(() => {
+  gc();
+  import("javascript:0");
+  drainJobQueue();
+});