Bug 1285927: Set wasm objects prototype only in the success path; r=luke
MozReview-Commit-ID: Il8v0XPLgoL
--- a/js/src/asmjs/WasmJS.cpp
+++ b/js/src/asmjs/WasmJS.cpp
@@ -638,33 +638,35 @@ InitConstructor(JSContext* cx, HandleObj
{
RootedObject proto(cx, NewBuiltinClassInstance<PlainObject>(cx, SingletonObject));
if (!proto)
return false;
if (!JS_DefineProperties(cx, proto, Class::properties))
return false;
- MOZ_ASSERT(global->as<GlobalObject>().getPrototype(Class::KEY).isUndefined());
- global->as<GlobalObject>().setPrototype(Class::KEY, ObjectValue(*proto));
-
RootedAtom className(cx, Atomize(cx, name, strlen(name)));
if (!className)
return false;
RootedFunction ctor(cx, NewNativeConstructor(cx, native, 1, className));
if (!ctor)
return false;
if (!LinkConstructorAndPrototype(cx, ctor, proto))
return false;
RootedId id(cx, AtomToId(className));
RootedValue ctorValue(cx, ObjectValue(*ctor));
- return DefineProperty(cx, wasm, id, ctorValue, nullptr, nullptr, 0);
+ if (!DefineProperty(cx, wasm, id, ctorValue, nullptr, nullptr, 0))
+ return false;
+
+ MOZ_ASSERT(global->as<GlobalObject>().getPrototype(Class::KEY).isUndefined());
+ global->as<GlobalObject>().setPrototype(Class::KEY, ObjectValue(*proto));
+ return true;
}
JSObject*
js::InitWebAssemblyClass(JSContext* cx, HandleObject global)
{
MOZ_ASSERT(cx->options().wasm());
RootedObject proto(cx, global->as<GlobalObject>().getOrCreateObjectPrototype(cx));