Bug 1515590 part 4 - Don't call FixWaiverAfterTransplant if JS_TransplantObject didn't change object identity. r=bholley

Depends on D15093

Differential Revision: https://phabricator.services.mozilla.com/D15094

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Jan de Mooij 2018-12-21 18:33:08 +00:00
Родитель 9190590e09
Коммит ecaf5bdea0
1 изменённых файлов: 5 добавлений и 0 удалений

Просмотреть файл

@ -639,6 +639,11 @@ JSObject* TransplantObject(JSContext* cx, JS::HandleObject origobj,
return newIdentity;
}
// If we transplanted within a compartment, oldWaiver is still valid.
if (newIdentity == origobj) {
return newIdentity;
}
if (!FixWaiverAfterTransplant(cx, oldWaiver, newIdentity)) {
return nullptr;
}