Bug 1294241 - Fix compartment mismatch tracking promise rejections in the shell r=till
authorJon Coppeard <jcoppeard@mozilla.com>
Mon, 15 Aug 2016 11:17:34 +0100
changeset 309391 9e7be56f14ea48ed302d03db135064fb548be86a
parent 309390 ebadba7031f64885f04cb2b61d93ecb96959d695
child 309392 fe562e66e9b9235bc77ba5f982e0fa3206522e90
push id30561
push userkwierso@gmail.com
push dateMon, 15 Aug 2016 21:20:49 +0000
treeherdermozilla-central@91a319101587 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstill
bugs1294241
milestone51.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1294241 - Fix compartment mismatch tracking promise rejections in the shell r=till
js/src/jit-test/tests/gc/bug-1294241.js
js/src/shell/js.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1294241.js
@@ -0,0 +1,10 @@
+if (helperThreadCount() == 0)
+    quit();
+
+gczeal(9);
+function rejectionTracker(state) {}
+setPromiseRejectionTrackerCallback(rejectionTracker)
+  lfGlobal = newGlobal();
+offThreadCompileScript(`new Promise(()=>rej)`);
+lfGlobal.runOffThreadScript();
+for (lfLocal in this);
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -694,16 +694,19 @@ ForwardingPromiseRejectionTrackerCallbac
     }
 
     AutoCompartment ac(cx, &callback.toObject());
 
     FixedInvokeArgs<2> args(cx);
     args[0].setObject(*promise);
     args[1].setInt32(static_cast<int32_t>(state));
 
+    if (!JS_WrapValue(cx, args[0]))
+        return;
+
     RootedValue rval(cx);
     if (!Call(cx, callback, UndefinedHandleValue, args, &rval))
         JS_ClearPendingException(cx);
 }
 #endif // SPIDERMONKEY_PROMISE
 
 static bool
 SetPromiseRejectionTrackerCallback(JSContext* cx, unsigned argc, Value* vp)