Bug 1136806 - Fix assertion failure with Debugger and oomAfterAllocations. r=shu

js/src/jit-test/tests/debug/bug-1136806.js

@@ -0,0 +1,8 @@
+// |jit-test| allow-unhandlable-oom; allow-oom
+
+if (typeof oomAfterAllocations == "function") {
+  Debugger()
+  oomAfterAllocations(6)
+  Debugger()
+}
+

js/src/vm/Debugger.h

@@ -74,9 +74,20 @@ class DebuggerWeakMap : private WeakMap<PreBarriered<UnbarrieredKey>, Relocatabl
 
   public:
     typedef WeakMap<Key, Value, DefaultHasher<Key> > Base;
+
     explicit DebuggerWeakMap(JSContext *cx)
         : Base(cx), zoneCounts(cx->runtime()) { }
 
+    ~DebuggerWeakMap() {
+        // If our owning Debugger fails construction after already initializing
+        // this DebuggerWeakMap, we need to make sure that we aren't in the
+        // compartment's weak map list anymore. Normally, when we are destroyed
+        // because the GC finds us unreachable, the GC takes care of removing us
+        // from this list.
+        if (WeakMapBase::isInList())
+            WeakMapBase::removeWeakMapFromList(this);
+    }
+
   public:
     /* Expose those parts of HashMap public interface that are used by Debugger methods. */