Merging upstream version 127.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 15 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/sharedbuf/size-with-uninitialized.js b/js/src/jit-test/tests/sharedbuf/size-with-uninitialized.js
new file mode 100644
index 0000000000..14f6e038ce
--- /dev/null
+++ b/js/src/jit-test/tests/sharedbuf/size-with-uninitialized.js
@@ -0,0 +1,15 @@
+// OOM during SharedArrayBuffer initialization can expose partially initialized
+// object to metadata builder.
+// It shouldn't crash.
+
+newGlobal({ newCompartment: true }).Debugger(this).memory.trackingAllocationSites = true;
+for (let i = 0; i < 9; i++) {
+  oomTest(function () {
+    class C extends WebAssembly.Memory {}
+    new C({
+      initial: 0,
+      maximum: 1,
+      shared: 1,
+    });
+  });
+}