Bug 1263558 - Part 4: Call initBuiltinConstructor after defining properties in InitStringClass. r=till

js/src/jit-test/tests/auto-regress/bug1263558.js

@@ -0,0 +1,16 @@
+if (!('oomTest' in this))
+    quit();
+
+evalcx(`
+    eval('\
+        var appendToActual = function(s) {};\
+        gczeal = function() {};\
+        gcslice = function() {};\
+        selectforgc = function() {};\
+        if (!("verifyprebarriers" in this)) {\
+            verifyprebarriers = function() {};\
+        }\
+    ');
+    oomTest(() => eval('Array(..."")'));
+    Intl.NumberFormat.prototype.format(0);
+`, newGlobal());

js/src/jsstr.cpp

@@ -2767,9 +2767,6 @@ js::InitStringClass(JSContext* cx, HandleObject obj)
     if (!ctor)
         return nullptr;
 
-    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_String, ctor, proto))
-        return nullptr;
-
     if (!LinkConstructorAndPrototype(cx, ctor, proto))
         return nullptr;
 
@@ -2786,6 +2783,9 @@ js::InitStringClass(JSContext* cx, HandleObject obj)
     if (!JS_DefineFunctions(cx, global, string_functions))
         return nullptr;
 
+    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_String, ctor, proto))
+        return nullptr;
+
     return proto;
 }