Don't crash when reaching a non-wrapper along the proto chain of a wrapper (bug 634236, r=mrbkap).
authorAndreas Gal <gal@mozilla.com>
Tue, 15 Feb 2011 11:17:14 -0800
changeset 62603 532ee628dc4fadf2a51b6c3ed77b47f024519d4c
parent 62602 1e38ca07f02f5a2ca7f3f4476c0e21fd284fe6e4
child 62604 d3bcd1655cc59a964b86b3646eb7c1161e1136e4
push id18793
push usercleary@mozilla.com
push dateTue, 15 Feb 2011 20:07:31 +0000
treeherdermozilla-central@cdde780d7503 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmrbkap
bugs634236
milestone2.0b12pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Don't crash when reaching a non-wrapper along the proto chain of a wrapper (bug 634236, r=mrbkap).
js/src/jscompartment.cpp
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -175,17 +175,18 @@ JSCompartment::arenaListsAreEmpty()
            return false;
   }
   return true;
 }
 
 static bool
 IsCrossCompartmentWrapper(JSObject *wrapper)
 {
-    return !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);
+    return wrapper->isWrapper() &&
+           !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);
 }
 
 bool
 JSCompartment::wrap(JSContext *cx, Value *vp)
 {
     JS_ASSERT(cx->compartment == this);
 
     uintN flags = 0;