Issue #1691 - Part 6d: Optimize handling of internally-created Promise objects.

https://bugzilla.mozilla.org/show_bug.cgi?id=1358879
The patch uses a different test: PROMISE_FLAG_DEFAULT_REJECT_FUNCTION which doesn't
exist in our codebase.  It was added in this bug, which appears to be partly complete:
https://bugzilla.mozilla.org/show_bug.cgi?id=1313049

(cherry picked from commit 97fc74b693813eaaa9ab833d9c51fc5868ff039f)

1 files changed, 6 insertions, 3 deletions

diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
index 4da00a8671..daeb2c3d68 100644
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -2478,8 +2478,11 @@ RunResolutionFunction(JSContext *cx, HandleObject resolutionFun, HandleValue res
 {
     // The absence of a resolve/reject function can mean that, as an
     // optimization, those weren't created. In that case, a flag is set on
-    // the Promise object. There are also reactions where the Promise
-    // itself is missing. For those, there's nothing left to do here.
+    // the Promise object. (It's also possible to not have a resolution
+    // function without that flag being set. This can occur if a Promise
+    // subclass constructor passes null/undefined to `super()`.)
+    // There are also reactions where the Promise itself is missing. For
+    // those, there's nothing left to do here.
     assertSameCompartment(cx, resolutionFun);
     assertSameCompartment(cx, result);
     assertSameCompartment(cx, promiseObj);
@@ -4826,7 +4829,7 @@ PromiseObject::reject(JSContext* cx, Handle<PromiseObject*> promise, HandleValue
         return true;
 
     if (PromiseHasAnyFlag(*promise, PROMISE_FLAG_DEFAULT_RESOLVING_FUNCTIONS))
-        return RejectMaybeWrappedPromise(cx, promise, rejectionValue);
+        return ResolvePromise(cx, promise, rejectionValue, JS::PromiseState::Rejected);
 
     RootedValue funVal(cx, promise->getFixedSlot(PromiseSlot_RejectFunction));
     MOZ_ASSERT(IsCallable(funVal));