From 9a309c9c2ac2967dcdd93bdab77f90023118b2b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Bargull?= <andre.bargull@gmail.com>
Date: Mon, 21 Aug 2023 08:32:10 +0000
Subject: [PATCH] Bug 1843824: Handle dead wrappers. r=iain

Differential Revision: https://phabricator.services.mozilla.com/D183714
---
 js/src/builtin/Promise.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
index 01f8090d62a3..c38e0bea36fb 100644
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -568,7 +568,11 @@ JSObject* PromiseObject::allocationSite() {
 JSObject* PromiseObject::resolutionSite() {
   auto debugInfo = PromiseDebugInfo::FromPromise(this);
   if (debugInfo) {
-    return debugInfo->resolutionSite();
+    JSObject* site = debugInfo->resolutionSite();
+    if (site && !JS_IsDeadWrapper(site)) {
+      MOZ_ASSERT(UncheckedUnwrap(site)->is<SavedFrame>());
+      return site;
+    }
   }
   return nullptr;
 }