Bug 1057587 - Crash [@ JSString::ensureLinear] with Symbol and environment object.

--HG--
extra : rebase_source : af77bb098aefe1191c5ea26e5dfcf1d775fa3c84
extra : amend_source : 07dc0c27907e76748fcc34dc74e97fc914ab4ac7

js/src/shell/js.cpp

@@ -4955,8 +4955,11 @@ env_setProperty(JSContext *cx, HandleObject obj, HandleId id, bool strict, Mutab
 #if !defined SOLARIS
     int rv;
 
-    RootedValue idvalue(cx, IdToValue(id));
-    RootedString idstring(cx, ToString(cx, idvalue));
+    if (JSID_IS_SYMBOL(id))
+        return true;
+    RootedString idstring(cx, IdToString(cx, id));
+    if (!idstring)
+        return false;
     JSAutoByteString idstr;
     if (!idstr.encodeLatin1(cx, idstring))
         return false;