From 4a5ed79c6c5b73ac010a80c2fa5c3d6545278243 Mon Sep 17 00:00:00 2001
From: Gaming4JC <g4jc@hyperbola.info>
Date: Sat, 14 Dec 2019 10:32:39 -0500
Subject: Bug 1379525 - Part 2: Properly handle rejection in async-from-sync
 iteration.

Tag #1287
---
 js/src/builtin/Promise.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
index 62c5eb429..4900a91cb 100644
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -2295,6 +2295,9 @@ static MOZ_MUST_USE bool
 InternalAwait(JSContext* cx, HandleValue value, HandleObject resultPromise,
               HandleValue onFulfilled, HandleValue onRejected, T extraStep)
 {
+    MOZ_ASSERT(onFulfilled.isNumber() || onFulfilled.isObject());
+    MOZ_ASSERT(onRejected.isNumber() || onRejected.isObject());
+
     // Step 2.
     Rooted<PromiseObject*> promise(cx, CreatePromiseObjectWithoutResolutionFunctions(cx));
     if (!promise)
@@ -2483,11 +2486,12 @@ js::AsyncFromSyncIteratorMethod(JSContext* cx, CallArgs& args, CompletionKind co
     RootedValue onFulfilled(cx, Int32Value(done
                                            ? PromiseHandlerAsyncFromSyncIteratorValueUnwrapDone
                                            : PromiseHandlerAsyncFromSyncIteratorValueUnwrapNotDone));
+    RootedValue onRejected(cx, Int32Value(PromiseHandlerThrower));
 
     // Steps 11-12, 15.
     auto extra = [](Handle<PromiseReactionRecord*> reaction) {
     };
-    if (!InternalAwait(cx, value, resultPromise, onFulfilled, UndefinedHandleValue, extra))
+    if (!InternalAwait(cx, value, resultPromise, onFulfilled, onRejected, extra))
         return false;
 
     // Step 16.
-- 
cgit v1.2.3