Bug 1218437 - Need to check that the value is an object before we try to UNWRAP_OBJECT it to check whether it's an Exception. r=qdot, a=jcristau
authorBoris Zbarsky <bzbarsky@mit.edu>
Mon, 27 Mar 2017 14:50:41 -0400
changeset 395495 3e5bbabd52797b8e7a3c2e6fb5e1b279a3dcf7bf
parent 395494 42a43de3d64f0c8176809b922530af2e098dd0cc
child 395496 6ea48bfb090196752dbbcb1d8707080e51623f19
push id1468
push userasasaki@mozilla.com
push dateMon, 05 Jun 2017 19:31:07 +0000
treeherdermozilla-release@0641fc6ee9d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersqdot, jcristau
bugs1218437
milestone54.0a2
Bug 1218437 - Need to check that the value is an object before we try to UNWRAP_OBJECT it to check whether it's an Exception. r=qdot, a=jcristau MozReview-Commit-ID: 8lwCoilRz49
js/xpconnect/src/XPCComponents.cpp
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -1705,17 +1705,18 @@ nsXPCComponents_Exception::HasInstance(n
                                        HandleValue val, bool* bp,
                                        bool* _retval)
 {
     using namespace mozilla::dom;
 
     RootedValue v(cx, val);
     if (bp) {
         Exception* e;
-        *bp = NS_SUCCEEDED(UNWRAP_OBJECT(Exception, v.toObjectOrNull(), e)) ||
+        *bp = (v.isObject() &&
+               NS_SUCCEEDED(UNWRAP_OBJECT(Exception, &v.toObject(), e))) ||
               JSValIsInterfaceOfType(cx, v, NS_GET_IID(nsIException));
     }
     return NS_OK;
 }
 
 /***************************************************************************/
 // This class is for the thing returned by "new Component.Constructor".