Created attachment 8396653 [details] [diff] [review] patch Simple fix. Not SS.
Testcase from decoder (js__types__TypeScript__FreezeTypeSets.txt).
https://hg.mozilla.org/integration/mozilla-inbound/rev/bf2800ef6d34 Probably runs into something from jorendorff, but this is the last of the OOM bugs that I looked into, and the rest can probably be fixed in one fell swoop. I won't touch any more.