Bug 1263865 - Check the return value of GetSelfHostedFunction in ArraySpeciesCreate. r=efaust

js/src/jit-test/tests/auto-regress/bug1263865.js

@@ -0,0 +1,12 @@
+if (!('oomTest' in this))
+    quit();
+
+loadFile("");
+loadFile("");
+loadFile("Array.prototype.splice.call(1)");
+function loadFile(lfVarx) {
+    parseInt("1");
+    oomTest(function() {
+        eval(lfVarx);
+    });
+}

js/src/jsarray.cpp

@@ -931,6 +931,8 @@ ArraySpeciesCreate(JSContext* cx, HandleObject origArray, uint32_t length, Mutab
 {
     RootedId createId(cx, NameToId(cx->names().ArraySpeciesCreate));
     RootedFunction create(cx, JS::GetSelfHostedFunction(cx, "ArraySpeciesCreate", createId, 2));
+    if (!create)
+        return false;
 
     FixedInvokeArgs<2> args(cx);