Backed out changeset ff1ffc083571 (bug 1287334) for spidermonkey bustage
authorWes Kocher <wkocher@mozilla.com>
Wed, 20 Jul 2016 18:01:13 -0700
changeset 331032 8ccb505a1cfcfb688ec6f038db50211b43640cfe
parent 331031 f2cf760a466829efa2b6182fa2243211f73429eb
child 331033 440f999f965f4578e23a602b6cddfdf2ce0812ff
push id9858
push userjlund@mozilla.com
push dateMon, 01 Aug 2016 14:37:10 +0000
treeherdermozilla-aurora@203106ef6cb6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1287334
milestone50.0a1
backs outff1ffc0835711a1ab930ad1477e0ad5635cf7099
Backed out changeset ff1ffc083571 (bug 1287334) for spidermonkey bustage
js/src/builtin/Promise.cpp
js/src/tests/ecma_6/Promise/bug-1287334.js
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -626,32 +626,22 @@ EnqueuePromiseReactionJob(JSContext* cx,
         return false;
 
     // Store the handler and the data array on the reaction job.
     job->setExtendedSlot(ReactionJobSlot_Handler, handler);
     job->setExtendedSlot(ReactionJobSlot_JobData, dataVal);
 
     // When using JS::AddPromiseReactions, no actual promise is created, so we
     // might not have one here.
-    // Additionally, we might have an object here that isn't an instance of
-    // Promise. This can happen if content overrides the value of
-    // Promise[@@species] (or invokes Promise#then on a Promise subclass
-    // instance with a non-default @@species value on the constructor) with a
-    // function that returns objects that're not Promise (subclass) instances.
-    // In that case, we just pretend we didn't have an object in the first
-    // place.
-    // If after all this we do have an object, wrap it in case we entered the
-    // handler's compartment above, because we should pass objects from a
-    // single compartment to the enqueuePromiseJob callback.
-    RootedObject promise(cx);
-    if (promise_->is<PromiseObject>()) {
-      promise = promise_;
-      if (!cx->compartment()->wrap(cx, &promise))
-          return false;
-    }
+    // If we do, Wrap it in case we entered the handler's compartment above,
+    // because we should pass objects from a single compartment to the
+    // enqueuePromiseJob callback.
+    RootedObject promise(cx, promise_);
+    if (!cx->compartment()->wrap(cx, &promise))
+        return false;
 
     // Using objectFromIncumbentGlobal, we can derive the incumbent global by
     // unwrapping and then getting the global. This is very convoluted, but
     // much better than having to store the original global as a private value
     // because we couldn't wrap it to store it as a normal JS value.
     RootedObject global(cx);
     RootedObject objectFromIncumbentGlobal(cx, objectFromIncumbentGlobal_);
     if (objectFromIncumbentGlobal) {
deleted file mode 100644
--- a/js/src/tests/ecma_6/Promise/bug-1287334.js
+++ /dev/null
@@ -1,7 +0,0 @@
-var promise = Promise.resolve(1);
-var FakeCtor = function(exec){ exec(function(){}, function(){}); };
-Object.defineProperty(Promise, Symbol.species, {value: FakeCtor});
-// This just shouldn't crash. It does without bug 1287334 fixed.
-promise.then(function(){});
-
-this.reportCompare && reportCompare(true, true);