From a2890770eb28ce40f12ca3cf131dec802e8405db Mon Sep 17 00:00:00 2001
From: Blake Kaplan <mrbkap@gmail.com>
Date: Wed, 4 Jan 2012 17:45:02 +0100
Subject: [PATCH] Bug 689118 - Protect against JSVAL_IS_OBJECT(null) being
 true. r=luke

---
 js/jsd/jsd_val.c | 2 +-
 js/src/jsprvtd.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/js/jsd/jsd_val.c b/js/jsd/jsd_val.c
index 4fdfa993f50f..bd10708f74d2 100644
--- a/js/jsd/jsd_val.c
+++ b/js/jsd/jsd_val.c
@@ -228,7 +228,7 @@ jsd_GetValueString(JSDContext* jsdc, JSDValue* jsdval)
     JS_BeginRequest(cx);
 
     /* Objects call JS_ValueToString in their own compartment. */
-    scopeObj = JSVAL_IS_OBJECT(jsdval->val) ? JSVAL_TO_OBJECT(jsdval->val) : jsdc->glob;
+    scopeObj = !JSVAL_IS_PRIMITIVE(jsdval->val) ? JSVAL_TO_OBJECT(jsdval->val) : jsdc->glob;
     call = JS_EnterCrossCompartmentCall(cx, scopeObj);
     if(!call) {
         JS_EndRequest(cx);
diff --git a/js/src/jsprvtd.h b/js/src/jsprvtd.h
index 70d232621571..21c368ff3690 100644
--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -291,13 +291,13 @@ template <typename T>
 class Handle
 {
   public:
-    // Copy handles of different types, with implicit coercion.
+    /* Copy handles of different types, with implicit coercion. */
     template <typename S> Handle(Handle<S> handle) {
         testAssign<S>();
         ptr = reinterpret_cast<const T *>(handle.address());
     }
 
-    // Get a handle from a rooted stack location, with implicit coercion.
+    /* Get a handle from a rooted stack location, with implicit coercion. */
     template <typename S> inline Handle(const Root<S> &root);
     template <typename S> inline Handle(const RootedVar<S> &root);