Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-29 15:52:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 911216 - Fix crashes caused by not properly handling not having an object at all as the target promise in EnqueuePromiseReactionJob, on a CLOSED TREE. r=bustage

Browse Source
This commit is contained in:
Till Schneidereit 2016-07-21 13:36:33 +02:00
parent 0b68c0c6df
commit 98a17b460b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/builtin/Promise.cpp
View File

@ -642,7 +642,7 @@ EnqueuePromiseReactionJob(JSContext* cx, HandleValue handler_, HandleValue handl
// handler's compartment above, because we should pass objects from a
// single compartment to the enqueuePromiseJob callback.
RootedObject promise(cx);
if (promise_->is<PromiseObject>()) {
if (promise_ && promise_->is<PromiseObject>()) {
promise = promise_;
if (!cx->compartment()->wrap(cx, &promise))
return false;