diff --git a/js/src/builtin/ModuleObject.cpp b/js/src/builtin/ModuleObject.cpp index f227728f98040..080a596615f72 100644 --- a/js/src/builtin/ModuleObject.cpp +++ b/js/src/builtin/ModuleObject.cpp @@ -2493,7 +2493,7 @@ bool FinishDynamicModuleImport_impl(JSContext* cx, HandleObject moduleRequest, HandleObject promiseArg) { Rooted resolutionArgs(cx, ListObject::create(cx)); - if (!resolutionArgs->append(cx, referencingPrivate)) { + if (!resolutionArgs || !resolutionArgs->append(cx, referencingPrivate)) { return false; } Rooted stringValue( diff --git a/js/src/jit-test/tests/modules/bug1846247.js b/js/src/jit-test/tests/modules/bug1846247.js new file mode 100644 index 0000000000000..4d63f0cfb3c0e --- /dev/null +++ b/js/src/jit-test/tests/modules/bug1846247.js @@ -0,0 +1,7 @@ +// |jit-test| skip-if: !('oomTest' in this); allow-unhandlable-oom +ignoreUnhandledRejections(); +oomTest(() => { + gc(); + import("javascript:0"); + drainJobQueue(); +});