Bug 1407414 - Crash in js::GetOwnPropertyDescriptor. r=bz
authorJason Orendorff <jorendorff@mozilla.com>
Tue, 17 Oct 2017 16:25:40 +0100
changeset 386891 0181d804e8bf9babc3e91f4fcd7d2cf6491372ab
parent 386890 facba2d0369909bf717c88c2c8f10ba19e880f7f
child 386892 5c8d4905c2bdbb3cfa0db5e07a3cd6ba4eb23fdd
push id96323
push userjorendorff@mozilla.com
push dateWed, 18 Oct 2017 14:51:27 +0000
treeherdermozilla-inbound@0181d804e8bf [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs1407414
milestone58.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1407414 - Crash in js::GetOwnPropertyDescriptor. r=bz
js/xpconnect/wrappers/XrayWrapper.cpp
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -2159,16 +2159,18 @@ bool
 XrayWrapper<Base, Traits>::getOwnPropertyDescriptor(JSContext* cx, HandleObject wrapper, HandleId id,
                                                     JS::MutableHandle<PropertyDescriptor> desc)
                                                     const
 {
     assertEnteredPolicy(cx, wrapper, id, BaseProxyHandler::GET | BaseProxyHandler::SET |
                                          BaseProxyHandler::GET_PROPERTY_DESCRIPTOR);
     RootedObject target(cx, XrayTraits::getTargetObject(wrapper));
     RootedObject holder(cx, Traits::singleton.ensureHolder(cx, wrapper));
+    if (!holder)
+        return false;
 
     if (!Traits::singleton.resolveOwnProperty(cx, wrapper, target, holder, id, desc))
         return false;
     if (desc.object())
         desc.object().set(wrapper);
     return true;
 }