Bug 1379525 - Part 2: Properly handle rejection in async-from-sync iteration.

Tag #1287

1 files changed, 5 insertions, 1 deletions

diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
index 62c5eb429..4900a91cb 100644
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -2295,6 +2295,9 @@ static MOZ_MUST_USE bool
 InternalAwait(JSContext* cx, HandleValue value, HandleObject resultPromise,
               HandleValue onFulfilled, HandleValue onRejected, T extraStep)
 {
+    MOZ_ASSERT(onFulfilled.isNumber() || onFulfilled.isObject());
+    MOZ_ASSERT(onRejected.isNumber() || onRejected.isObject());
+
     // Step 2.
     Rooted<PromiseObject*> promise(cx, CreatePromiseObjectWithoutResolutionFunctions(cx));
     if (!promise)
@@ -2483,11 +2486,12 @@ js::AsyncFromSyncIteratorMethod(JSContext* cx, CallArgs& args, CompletionKind co
     RootedValue onFulfilled(cx, Int32Value(done
                                            ? PromiseHandlerAsyncFromSyncIteratorValueUnwrapDone
                                            : PromiseHandlerAsyncFromSyncIteratorValueUnwrapNotDone));
+    RootedValue onRejected(cx, Int32Value(PromiseHandlerThrower));
 
     // Steps 11-12, 15.
     auto extra = [](Handle<PromiseReactionRecord*> reaction) {
     };
-    if (!InternalAwait(cx, value, resultPromise, onFulfilled, UndefinedHandleValue, extra))
+    if (!InternalAwait(cx, value, resultPromise, onFulfilled, onRejected, extra))
         return false;
 
     // Step 16.