Bug 689118 - Protect against JSVAL_IS_OBJECT(null) being true. r=luke

js/jsd/jsd_val.c

@@ -228,7 +228,7 @@ jsd_GetValueString(JSDContext* jsdc, JSDValue* jsdval)
     JS_BeginRequest(cx);
 
     /* Objects call JS_ValueToString in their own compartment. */
-    scopeObj = JSVAL_IS_OBJECT(jsdval->val) ? JSVAL_TO_OBJECT(jsdval->val) : jsdc->glob;
+    scopeObj = !JSVAL_IS_PRIMITIVE(jsdval->val) ? JSVAL_TO_OBJECT(jsdval->val) : jsdc->glob;
     call = JS_EnterCrossCompartmentCall(cx, scopeObj);
     if(!call) {
         JS_EndRequest(cx);

js/src/jsprvtd.h

@@ -291,13 +291,13 @@ template <typename T>
 class Handle
 {
   public:
-    // Copy handles of different types, with implicit coercion.
+    /* Copy handles of different types, with implicit coercion. */
     template <typename S> Handle(Handle<S> handle) {
         testAssign<S>();
         ptr = reinterpret_cast<const T *>(handle.address());
     }
 
-    // Get a handle from a rooted stack location, with implicit coercion.
+    /* Get a handle from a rooted stack location, with implicit coercion. */
     template <typename S> inline Handle(const Root<S> &root);
     template <typename S> inline Handle(const RootedVar<S> &root);