--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
@@ -788,20 +788,26 @@ public:
       // work with pointers, only integer types.
       Arg<uintptr_t> new_limit(2);
       return If(AllOf(pid == 0, new_limit == 0), Allow())
         .Else(InvalidSyscall());
     }
 
     case __NR_umask:
     case __NR_kill:
+      return Allow();
+
     case __NR_wait4:
 #ifdef __NR_waitpid
     case __NR_waitpid:
 #endif
+      // NSPR will start a thread to wait for child processes even if
+      // fork() fails; see bug 227246 and bug 1299581.
+      return Error(ECHILD);
+
 #ifdef __NR_arch_prctl
     case __NR_arch_prctl:
 #endif
       return Allow();
 
     case __NR_eventfd2:
     case __NR_inotify_init:
     case __NR_inotify_init1: