Bug 1407414 - Crash in js::GetOwnPropertyDescriptor. r=bz, a=lizzard
authorJason Orendorff <jorendorff@mozilla.com>
Tue, 17 Oct 2017 16:25:40 +0100
changeset 432779 7d28b5b2217d909d2ea1b820f23112531d1cdf83
parent 432778 c11525bd0ab2150a9f9ea82d851a4208d66f5ca5
child 432780 ce6aa85a6c1167f412ed202df163cd2959cc1fdb
push id8056
push userryanvm@gmail.com
push dateThu, 26 Oct 2017 15:24:01 +0000
treeherdermozilla-beta@5f5a87b79586 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz, lizzard
bugs1407414
milestone57.0
Bug 1407414 - Crash in js::GetOwnPropertyDescriptor. r=bz, a=lizzard
js/xpconnect/wrappers/XrayWrapper.cpp
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -2162,16 +2162,18 @@ bool
 XrayWrapper<Base, Traits>::getOwnPropertyDescriptor(JSContext* cx, HandleObject wrapper, HandleId id,
                                                     JS::MutableHandle<PropertyDescriptor> desc)
                                                     const
 {
     assertEnteredPolicy(cx, wrapper, id, BaseProxyHandler::GET | BaseProxyHandler::SET |
                                          BaseProxyHandler::GET_PROPERTY_DESCRIPTOR);
     RootedObject target(cx, XrayTraits::getTargetObject(wrapper));
     RootedObject holder(cx, Traits::singleton.ensureHolder(cx, wrapper));
+    if (!holder)
+        return false;
 
     if (!Traits::singleton.resolveOwnProperty(cx, wrapper, target, holder, id, desc))
         return false;
     if (desc.object())
         desc.object().set(wrapper);
     return true;
 }