Bug 1150858 - Unwrap the correct object in ArrayBuffer.transfer (r=sfink)

--HG--
extra : rebase_source : 29cd797c9194ff80bf2686f64c9a63230f07c63a

js/src/jit-test/tests/basic/testArrayBufferTransfer.js

@@ -55,6 +55,12 @@ assertEq(buf1.byteLength, 0);
 assertEq(buf2.byteLength, 9);
 assertThrowsInstanceOf(()=>XF(buf1), TypeError);
 
+// cross-compartment wrapper
+var buf3 = newGlobal().eval("new ArrayBuffer(10)");
+var buf4 = XF(buf3, 20);
+assertEq(buf4.byteLength, 20);
+assertThrowsInstanceOf(()=>XF(buf3), TypeError);
+
 // test going to from various sizes
 function test(N1, N2) {
     var buf1 = new ArrayBuffer(N1);

js/src/vm/ArrayBufferObject.cpp

@@ -360,8 +360,8 @@ ArrayBufferObject::fun_transfer(JSContext* cx, unsigned argc, Value* vp)
     if (oldBufferObj->is<ArrayBufferObject>()) {
         oldBuffer = &oldBufferObj->as<ArrayBufferObject>();
     } else {
-        JSObject* unwrapped = CheckedUnwrap(oldBuffer);
-        if (!unwrapped->is<ArrayBufferObject>()) {
+        JSObject* unwrapped = CheckedUnwrap(oldBufferObj);
+        if (!unwrapped || !unwrapped->is<ArrayBufferObject>()) {
             JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_BAD_ARGS);
             return false;
         }