Bug 1214006 - Take account of the fact that JSScript::atoms may be null while tracing r=terrence

--HG--
extra : rebase_source : 6dea26039415d8b48b46d4f0998811a89a670c59

js/src/jit-test/tests/gc/bug-1214006.js

@@ -0,0 +1,17 @@
+if (!('oomAtAllocation' in this && 'resetOOMFailure' in this))
+    quit();
+
+function f() {
+    var i = 1;
+    do {
+        try {
+            oomAtAllocation(i);
+            (function() y)();
+        } catch (e) {
+            x = resetOOMFailure();
+        }
+        i++;
+    } while (x);
+}
+f();
+fullcompartmentchecks(true);

js/src/jsscript.cpp

@@ -3772,9 +3772,11 @@ JSScript::traceChildren(JSTracer* trc)
                   static_cast<GCMarker*>(trc)->shouldCheckCompartments(),
                   zone()->isCollecting());
 
-    for (uint32_t i = 0; i < natoms(); ++i) {
-        if (atoms[i])
-            TraceEdge(trc, &atoms[i], "atom");
+    if (atoms) {
+        for (uint32_t i = 0; i < natoms(); ++i) {
+            if (atoms[i])
+                TraceEdge(trc, &atoms[i], "atom");
+        }
     }
 
     if (hasObjects()) {