Bug 1315751 - Check OOM after NewReactionRecord. r=till
authorTooru Fujisawa <arai_a@mac.com>
Tue, 08 Nov 2016 05:49:13 +0900
changeset 321578 9ec71a14e87f1eb29ae4b04d01ef5ce78379eba5
parent 321577 564ab238f96d7d64c8100e0b7b234fb71d21a19e
child 321579 39aebea1fbb85c40d098208e742021e23c95375b
push id30931
push userkwierso@gmail.com
push dateTue, 08 Nov 2016 21:58:36 +0000
treeherdermozilla-central@783356f1476e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstill
bugs1315751
milestone52.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1315751 - Check OOM after NewReactionRecord. r=till
js/src/builtin/Promise.cpp
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -2125,16 +2125,18 @@ PerformPromiseThen(JSContext* cx, Handle
     if (!GetObjectFromIncumbentGlobal(cx, &incumbentGlobal))
         return false;
 
     // Step 7.
     Rooted<PromiseReactionRecord*> reaction(cx, NewReactionRecord(cx, resultPromise,
                                                                   onFulfilled, onRejected,
                                                                   resolve, reject,
                                                                   incumbentGlobal));
+    if (!reaction)
+        return false;
 
     JS::PromiseState state = promise->state();
     int32_t flags = promise->getFixedSlot(PromiseSlot_Flags).toInt32();
     if (state == JS::PromiseState::Pending) {
         // Steps 5,6 (reordered).
         // Instead of creating separate reaction records for fulfillment and
         // rejection, we create a combined record. All places we use the record
         // can handle that.