Bug 1263558 - Part 4: Call initBuiltinConstructor after defining properties in InitStringClass. r=till
authorTooru Fujisawa <arai_a@mac.com>
Fri, 15 Apr 2016 12:32:37 +0900
changeset 332209 b1e8dbf2f4c92666991b0a026dfbc8fa0fa26826
parent 332208 7b1ce08126bf35127d0e338cd2a21883ae87fcbe
child 332210 cdcf362a0234ad70425b14c4d58568d7bd66381b
push id6048
push userkmoir@mozilla.com
push dateMon, 06 Jun 2016 19:02:08 +0000
treeherdermozilla-beta@46d72a56c57d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstill
bugs1263558
milestone48.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1263558 - Part 4: Call initBuiltinConstructor after defining properties in InitStringClass. r=till
js/src/jit-test/tests/auto-regress/bug1263558.js
js/src/jsstr.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1263558.js
@@ -0,0 +1,16 @@
+if (!('oomTest' in this))
+    quit();
+
+evalcx(`
+    eval('\
+        var appendToActual = function(s) {};\
+        gczeal = function() {};\
+        gcslice = function() {};\
+        selectforgc = function() {};\
+        if (!("verifyprebarriers" in this)) {\
+            verifyprebarriers = function() {};\
+        }\
+    ');
+    oomTest(() => eval('Array(..."")'));
+    Intl.NumberFormat.prototype.format(0);
+`, newGlobal());
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -2762,35 +2762,35 @@ js::InitStringClass(JSContext* cx, Handl
 
     /* Now create the String function. */
     RootedFunction ctor(cx);
     ctor = global->createConstructor(cx, StringConstructor, cx->names().String, 1,
                                      AllocKind::FUNCTION, &jit::JitInfo_String);
     if (!ctor)
         return nullptr;
 
-    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_String, ctor, proto))
-        return nullptr;
-
     if (!LinkConstructorAndPrototype(cx, ctor, proto))
         return nullptr;
 
     if (!DefinePropertiesAndFunctions(cx, proto, nullptr, string_methods) ||
         !DefinePropertiesAndFunctions(cx, ctor, nullptr, string_static_methods))
     {
         return nullptr;
     }
 
     /*
      * Define escape/unescape, the URI encode/decode functions, and maybe
      * uneval on the global object.
      */
     if (!JS_DefineFunctions(cx, global, string_functions))
         return nullptr;
 
+    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_String, ctor, proto))
+        return nullptr;
+
     return proto;
 }
 
 const char*
 js::ValueToPrintable(JSContext* cx, const Value& vArg, JSAutoByteString* bytes, bool asSource)
 {
     RootedValue v(cx, vArg);
     JSString* str;