Bug 1033920 - Handle null in XrayWrapper::setPrototypeOf. r=efaust, a=sledru
authorBobby Holley <bobbyholley@gmail.com>
Wed, 02 Jul 2014 21:06:28 -0700
changeset 200734 1854467b1311330d7b91abde2f5f8839f5550359
parent 200733 69c528dbed04d23691fa51bc7ef9c58770983a37
child 200735 635e32a71297e5634b9f40f86e9b5fa83d7d4a49
push id486
push userasasaki@mozilla.com
push dateMon, 14 Jul 2014 18:39:42 +0000
treeherdermozilla-release@d33428174ff1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersefaust, sledru
bugs1033920
milestone31.0
Bug 1033920 - Handle null in XrayWrapper::setPrototypeOf. r=efaust, a=sledru
js/xpconnect/tests/unit/test_bug1033920.js
js/xpconnect/tests/unit/xpcshell.ini
js/xpconnect/wrappers/XrayWrapper.cpp
new file mode 100644
--- /dev/null
+++ b/js/xpconnect/tests/unit/test_bug1033920.js
@@ -0,0 +1,7 @@
+const Cu = Components.utils;
+function run_test() {
+  var sb = Cu.Sandbox('http://www.example.com');
+  var o = new sb.Object();
+  o.__proto__ = null;
+  do_check_eq(Object.getPrototypeOf(o), null);
+}
--- a/js/xpconnect/tests/unit/xpcshell.ini
+++ b/js/xpconnect/tests/unit/xpcshell.ini
@@ -38,16 +38,17 @@ support-files =
 [test_bug868675.js]
 [test_bug867486.js]
 [test_bug872772.js]
 [test_bug885800.js]
 [test_bug961054.js]
 [test_bug976151.js]
 [test_bug1001094.js]
 [test_bug1021312.js]
+[test_bug1033920.js]
 [test_bug_442086.js]
 [test_file.js]
 [test_blob.js]
 [test_blob2.js]
 [test_file2.js]
 [test_import.js]
 [test_import_fail.js]
 [test_js_weak_references.js]
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -2217,17 +2217,17 @@ XrayWrapper<Base, Traits>::setPrototypeO
         return Base::setPrototypeOf(cx, wrapper, proto, bp);
 
     RootedObject target(cx, Traits::getTargetObject(wrapper));
     RootedObject expando(cx, Traits::singleton.ensureExpandoObject(cx, wrapper, target));
 
     // The expando lives in the target's compartment, so do our installation there.
     JSAutoCompartment ac(cx, target);
 
-    RootedValue v(cx, ObjectValue(*proto));
+    RootedValue v(cx, ObjectOrNullValue(proto));
     if (!JS_WrapValue(cx, &v))
         return false;
     JS_SetReservedSlot(expando, JSSLOT_EXPANDO_PROTOTYPE, v);
     *bp = true;
     return true;
 }