Backed out changeset ff1ffc083571 (bug 1287334) for spidermonkey bustage
authorWes Kocher <wkocher@mozilla.com>
Wed, 20 Jul 2016 18:01:13 -0700
changeset 345998 8ccb505a1cfcfb688ec6f038db50211b43640cfe
parent 345997 f2cf760a466829efa2b6182fa2243211f73429eb
child 345999 440f999f965f4578e23a602b6cddfdf2ce0812ff
push id6389
push userraliiev@mozilla.com
push dateMon, 19 Sep 2016 13:38:22 +0000
treeherdermozilla-beta@01d67bfe6c81 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1287334
milestone50.0a1
backs outff1ffc0835711a1ab930ad1477e0ad5635cf7099
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset ff1ffc083571 (bug 1287334) for spidermonkey bustage
js/src/builtin/Promise.cpp
js/src/tests/ecma_6/Promise/bug-1287334.js
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -626,32 +626,22 @@ EnqueuePromiseReactionJob(JSContext* cx,
         return false;
 
     // Store the handler and the data array on the reaction job.
     job->setExtendedSlot(ReactionJobSlot_Handler, handler);
     job->setExtendedSlot(ReactionJobSlot_JobData, dataVal);
 
     // When using JS::AddPromiseReactions, no actual promise is created, so we
     // might not have one here.
-    // Additionally, we might have an object here that isn't an instance of
-    // Promise. This can happen if content overrides the value of
-    // Promise[@@species] (or invokes Promise#then on a Promise subclass
-    // instance with a non-default @@species value on the constructor) with a
-    // function that returns objects that're not Promise (subclass) instances.
-    // In that case, we just pretend we didn't have an object in the first
-    // place.
-    // If after all this we do have an object, wrap it in case we entered the
-    // handler's compartment above, because we should pass objects from a
-    // single compartment to the enqueuePromiseJob callback.
-    RootedObject promise(cx);
-    if (promise_->is<PromiseObject>()) {
-      promise = promise_;
-      if (!cx->compartment()->wrap(cx, &promise))
-          return false;
-    }
+    // If we do, Wrap it in case we entered the handler's compartment above,
+    // because we should pass objects from a single compartment to the
+    // enqueuePromiseJob callback.
+    RootedObject promise(cx, promise_);
+    if (!cx->compartment()->wrap(cx, &promise))
+        return false;
 
     // Using objectFromIncumbentGlobal, we can derive the incumbent global by
     // unwrapping and then getting the global. This is very convoluted, but
     // much better than having to store the original global as a private value
     // because we couldn't wrap it to store it as a normal JS value.
     RootedObject global(cx);
     RootedObject objectFromIncumbentGlobal(cx, objectFromIncumbentGlobal_);
     if (objectFromIncumbentGlobal) {
deleted file mode 100644
--- a/js/src/tests/ecma_6/Promise/bug-1287334.js
+++ /dev/null
@@ -1,7 +0,0 @@
-var promise = Promise.resolve(1);
-var FakeCtor = function(exec){ exec(function(){}, function(){}); };
-Object.defineProperty(Promise, Symbol.species, {value: FakeCtor});
-// This just shouldn't crash. It does without bug 1287334 fixed.
-promise.then(function(){});
-
-this.reportCompare && reportCompare(true, true);