Bug 1645358 - Handle DeadObjectProxy in js::CopyErrorObject. r=evilpie

Differential Revision: https://phabricator.services.mozilla.com/D159590

js/src/jit-test/tests/debug/bug1645358.js

@@ -0,0 +1,6 @@
+// |jit-test| error:TypeError: can't redefine
+var g = newGlobal({newCompartment: true});
+var dbg = new Debugger();
+var gw = dbg.addDebuggee(g);
+nukeAllCCWs();
+gw.defineProperty("undefined", {value: -1});

js/src/jsexn.cpp

@@ -718,6 +718,11 @@ JSObject* js::CopyErrorObject(JSContext* cx, Handle<ErrorObject*> err) {
   if (!cx->compartment()->wrap(cx, &stack)) {
     return nullptr;
   }
+  if (stack && JS_IsDeadWrapper(stack)) {
+    // ErrorObject::create expects |stack| to be either nullptr or a (possibly
+    // wrapped) SavedFrame instance.
+    stack = nullptr;
+  }
   Rooted<mozilla::Maybe<Value>> cause(cx, mozilla::Nothing());
   if (auto maybeCause = err->getCause()) {
     RootedValue errorCause(cx, maybeCause.value());