From cfb102dafcd6837d184aff8ef97e7d3f10492d1d Mon Sep 17 00:00:00 2001
From: Andrew McCreight <amccreight@mozilla.com>
Date: Wed, 6 Feb 2013 12:18:54 +0000
Subject: [PATCH] Bug 784730 - Crash in ReparentWrapperIfFound if wrapper
 already in scope. r=bholley

---
 js/xpconnect/src/XPCMaps.h            | 1 +
 js/xpconnect/src/XPCWrappedNative.cpp | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/js/xpconnect/src/XPCMaps.h b/js/xpconnect/src/XPCMaps.h
index 6cae45a60601..cf7d65c5a304 100644
--- a/js/xpconnect/src/XPCMaps.h
+++ b/js/xpconnect/src/XPCMaps.h
@@ -107,6 +107,7 @@ public:
     {
         NS_PRECONDITION(wrapper,"bad param");
         nsISupports* obj = wrapper->GetIdentityObject();
+        MOZ_ASSERT(!Find(obj), "wrapper already in new scope!");
         Entry* entry = (Entry*)
             JS_DHashTableOperate(mTable, obj, JS_DHASH_ADD);
         if (!entry)
diff --git a/js/xpconnect/src/XPCWrappedNative.cpp b/js/xpconnect/src/XPCWrappedNative.cpp
index 6dea440c1d44..f7ed2cec557d 100644
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -1582,8 +1582,8 @@ XPCWrappedNative::ReparentWrapperIfFound(XPCCallContext& ccx,
                     wrapper->UpdateScriptableInfo(newProto->GetScriptableInfo());
                 }
 
-                NS_ASSERTION(!newMap->Find(wrapper->GetIdentityObject()),
-                             "wrapper already in new scope!");
+                if (newMap->Find(wrapper->GetIdentityObject()))
+                    MOZ_CRASH();
 
                 if (!newMap->Add(wrapper))
                     MOZ_CRASH();