From aefea38a989f5a28437e2c5ce1ba1b33974bc0b6 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Thu, 24 Mar 2016 15:09:41 +0100
Subject: [PATCH] Bug 1254622 - Relookup group->newScript in
 CreateThisForFunctionWithGroup. r=bhackett

---
 js/src/jsobj.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 9939d7745bc2..5e3209a66db3 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -932,8 +932,9 @@ CreateThisForFunctionWithGroup(JSContext* cx, HandleObjectGroup group,
         if (!res)
             return nullptr;
 
-        if (newKind != SingletonObject)
-            newScript->registerNewObject(res);
+        // Make sure group->newScript is still there.
+        if (newKind != SingletonObject && group->newScript())
+            group->newScript()->registerNewObject(res);
 
         return res;
     }