1 files changed, 6 insertions, 0 deletions
diff --git a/src/third_party/mozjs-38/extract/js/src/vm/TypeInference.cpp b/src/third_party/mozjs-38/extract/js/src/vm/TypeInference.cpp
index f03c4b50798..5c4471378f1 100644
--- a/src/third_party/mozjs-38/extract/js/src/vm/TypeInference.cpp
+++ b/src/third_party/mozjs-38/extract/js/src/vm/TypeInference.cpp
@@ -3966,6 +3966,12 @@ JSScript::maybeSweepTypes(AutoClearTypeInferenceStateOnOOM* oom)
     for (unsigned i = 0; i < num; i++)
         typeArray[i].sweep(zone(), *oom);
 
+    if (oom->hadOOM()) {
+        // It's possible we OOM'd while copying freeze constraints, so they
+        // need to be regenerated.
+        hasFreezeConstraints_ = false;
+    }
+
     // Update the recompile indexes in any IonScripts still on the script.
     if (hasIonScript())
         ionScript()->recompileInfoRef().shouldSweep(types);