From 9b0e89a966d70553a0ee58c5048048d31139125b Mon Sep 17 00:00:00 2001
From: Andreas Gal <gal@mozilla.com>
Date: Tue, 15 Feb 2011 11:17:14 -0800
Subject: [PATCH] Don't crash when reaching a non-wrapper along the proto chain
 of a wrapper (bug 634236, r=mrbkap).

---
 js/src/jscompartment.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 2076c2b7b619..aeeb0e2c9664 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -180,7 +180,8 @@ JSCompartment::arenaListsAreEmpty()
 static bool
 IsCrossCompartmentWrapper(JSObject *wrapper)
 {
-    return !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);
+    return wrapper->isWrapper() &&
+           !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);
 }
 
 bool