From 485f64c28c50dbdbe2f3b6f4812a1d71eebe9af9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Bargull?= <andre.bargull@gmail.com>
Date: Mon, 9 Jan 2017 06:58:17 -0800
Subject: [PATCH] Bug 1317376 - Part 2: Detect Promise self-resolution when
 resolving through the Promise resolving fast path. r=till

--HG--
extra : rebase_source : 3748ed4c013de6e52fa767d29e56a32ddcdddd71
---
 js/src/builtin/Promise.cpp                  | 32 +++++++++------------
 js/src/tests/ecma_6/Promise/self-resolve.js | 22 ++++++++++++++
 2 files changed, 36 insertions(+), 18 deletions(-)

diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
index 193cf7067918..187bcb3986c3 100644
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -336,16 +336,28 @@ static MOZ_MUST_USE bool EnqueuePromiseResolveThenableJob(JSContext* cx,
                                                           HandleValue thenable,
                                                           HandleValue thenVal);
 
-// ES2016, 25.4.1.3.2, steps 7-13.
+// ES2016, 25.4.1.3.2, steps 6-13.
 static MOZ_MUST_USE bool
 ResolvePromiseInternal(JSContext* cx, HandleObject promise, HandleValue resolutionVal)
 {
-    // Step 7.
+    // Step 7 (reordered).
     if (!resolutionVal.isObject())
         return FulfillMaybeWrappedPromise(cx, promise, resolutionVal);
 
     RootedObject resolution(cx, &resolutionVal.toObject());
 
+    // Step 6.
+    if (resolution == promise) {
+        // Step 6.a.
+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                                  JSMSG_CANNOT_RESOLVE_PROMISE_WITH_ITSELF);
+        RootedValue selfResolutionError(cx);
+        MOZ_ALWAYS_TRUE(GetAndClearException(cx, &selfResolutionError));
+
+        // Step 6.b.
+        return RejectMaybeWrappedPromise(cx, promise, selfResolutionError);
+    }
+
     // Step 8.
     RootedValue thenVal(cx);
     bool status = GetProperty(cx, resolution, resolution, cx->names().then, &thenVal);
@@ -411,22 +423,6 @@ ResolvePromiseFunction(JSContext* cx, unsigned argc, Value* vp)
     // functions. Actually marking it as fulfilled/rejected happens later.
     ClearResolutionFunctionSlots(resolve);
 
-    // Step 6.
-    if (resolutionVal == promiseVal) {
-        // Step 6.a.
-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
-                                  JSMSG_CANNOT_RESOLVE_PROMISE_WITH_ITSELF);
-        RootedValue selfResolutionError(cx);
-        bool status = GetAndClearException(cx, &selfResolutionError);
-        MOZ_ASSERT(status);
-
-        // Step 6.b.
-        status = RejectMaybeWrappedPromise(cx, promise, selfResolutionError);
-        if (status)
-            args.rval().setUndefined();
-        return status;
-    }
-
     bool status = ResolvePromiseInternal(cx, promise, resolutionVal);
     if (status)
         args.rval().setUndefined();
diff --git a/js/src/tests/ecma_6/Promise/self-resolve.js b/js/src/tests/ecma_6/Promise/self-resolve.js
index e16a2ceb3d0c..9f9cdfe83304 100644
--- a/js/src/tests/ecma_6/Promise/self-resolve.js
+++ b/js/src/tests/ecma_6/Promise/self-resolve.js
@@ -5,6 +5,7 @@ if (!this.Promise) {
     quit(0);
 }
 
+// Resolve Promise with itself by directly calling the "Promise Resolve Function".
 let resolve;
 let promise = new Promise(function(x) { resolve = x; });
 resolve(promise)
@@ -20,4 +21,25 @@ drainJobQueue()
 assertEq(results.length, 1);
 assertEq(results[0], "rejected");
 
+
+// Resolve Promise with itself when the "Promise Resolve Function" is called
+// from (the fast path in) PromiseReactionJob.
+results = [];
+
+promise = new Promise(x => { resolve = x; });
+let promise2 = promise.then(() => promise2);
+
+promise2.then(() => assertEq(true, false, "not reached"), res => {
+    assertEq(res instanceof TypeError, true);
+    results.push("rejected");
+});
+
+resolve();
+
+drainJobQueue();
+
+assertEq(results.length, 1);
+assertEq(results[0], "rejected");
+
+
 this.reportCompare && reportCompare(0, 0, "ok");