From 98a17b460b94396bf9a458e304f72cc47034450f Mon Sep 17 00:00:00 2001
From: Till Schneidereit <till@tillschneidereit.net>
Date: Thu, 21 Jul 2016 13:36:33 +0200
Subject: [PATCH] Bug 911216 - Fix crashes caused by not properly handling not
 having an object at all as the target promise in EnqueuePromiseReactionJob,
 on a CLOSED TREE. r=bustage

---
 js/src/builtin/Promise.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
index ea5e93b0d07f..2062a4873b9c 100644
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -642,7 +642,7 @@ EnqueuePromiseReactionJob(JSContext* cx, HandleValue handler_, HandleValue handl
     // handler's compartment above, because we should pass objects from a
     // single compartment to the enqueuePromiseJob callback.
     RootedObject promise(cx);
-    if (promise_->is<PromiseObject>()) {
+    if (promise_ && promise_->is<PromiseObject>()) {
       promise = promise_;
       if (!cx->compartment()->wrap(cx, &promise))
           return false;