diff --git a/js/src/jit-test/tests/gc/bug1191756.js b/js/src/jit-test/tests/gc/bug1191756.js
new file mode 100644
index 000000000000..8de7bbb4dcb7
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug1191756.js
@@ -0,0 +1,18 @@
+// |jit-test| exitstatus: 3
+
+if (typeof 'oomAtAllocation' === 'undefined')
+    quit(3);
+
+function fn(i) {
+    if (i == 3)
+      return ["isFinite"].map(function (i) {});
+    return [];
+}
+
+fn(0);
+fn(1);
+fn(2);
+oomAtAllocation(50);
+fn(3);
+
+quit(3);
diff --git a/js/src/jit-test/tests/ion/scalar-replacement-oom.js b/js/src/jit-test/tests/ion/scalar-replacement-oom.js
index 3aad2e133760..2ca1fa12f63f 100644
--- a/js/src/jit-test/tests/ion/scalar-replacement-oom.js
+++ b/js/src/jit-test/tests/ion/scalar-replacement-oom.js
@@ -1,5 +1,6 @@
+// |jit-test| exitstatus: 3
 if (typeof oomAtAllocation !== 'function')
-    quit();
+    quit(3);
 
 var lfcode = new Array();
 function k(a, f_arg, b, c) {
@@ -12,8 +13,10 @@ function t() {
     k(50, function(i) {
         x = i;
     }, 100, 200);
-    oomAtAllocation(100);
+    oomAtAllocation(101);
 }
 
 t();
 t();
+
+quit(3);
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 31348b003a6f..735a61dc40a5 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3838,7 +3838,7 @@ IonBuilder::improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test)
         type = TypeSet::intersectSets(&base, oldType, alloc_->lifoAlloc());
     }
 
-    return replaceTypeSet(ins, type, test);
+    return type && replaceTypeSet(ins, type, test);
 }
 
 bool