Bug 1252912 - Ensure that we wrap the results of the shortestPaths JS shell testing function. r=jimb

--HG--
extra : rebase_source : 997441c17bb884a7edaf17e5ee83c17f15112253

js/src/builtin/TestingFunctions.cpp

@@ -2776,8 +2776,11 @@ ShortestPaths(JSContext* cx, unsigned argc, Value* vp)
                     return false;
 
                 RootedValue predecessor(cx, values[i][j][k]);
-                if (!JS_DefineProperty(cx, part, "predecessor", predecessor, JSPROP_ENUMERATE))
+                if (!cx->compartment()->wrap(cx, &predecessor) ||
+                    !JS_DefineProperty(cx, part, "predecessor", predecessor, JSPROP_ENUMERATE))
+                {
                     return false;
+                }
 
                 if (names[i][j][k]) {
                     RootedString edge(cx, NewStringCopyZ<CanGC>(cx, names[i][j][k].get()));

js/src/jit-test/tests/heap-analysis/bug-1252912.js

@@ -0,0 +1,6 @@
+try {
+  x = evalcx('')
+  toSource = (function() {
+  })
+} catch (foo) {}
+shortestPaths(this, ["$4"], 5)