Bug 535703 - JS_SealObject crash with deep=true. r=mrbkap.

--HG--
extra : rebase_source : 7760d40bb23ab439c030943ab781ab5b10259da8

js/src/jsapi-tests/Makefile.in

@@ -57,6 +57,7 @@ CPPSRCS = \
   testPropCache.cpp \
   testTrap.cpp \
   testSameValue.cpp \
+  testSeal.cpp \
   testXDR.cpp \
   $(NULL)
 

js/src/jsapi-tests/testSeal.cpp

@@ -0,0 +1,10 @@
+#include "tests.h"
+
+BEGIN_TEST(testSeal_bug535703)
+{
+    JSObject *obj = JS_NewObject(cx, NULL, NULL, NULL);
+    CHECK(obj);
+    JS_SealObject(cx, obj, JS_TRUE);  // don't crash
+    return true;
+}
+END_TEST(testSeal_bug535703)

js/src/jsapi.cpp

@@ -2947,6 +2947,8 @@ JS_SealObject(JSContext *cx, JSObject *obj, JSBool deep)
     nslots = scope->freeslot;
     for (i = 0; i != nslots; ++i) {
         v = STOBJ_GET_SLOT(obj, i);
+        if (i == JSSLOT_PRIVATE && (obj->getClass()->flags & JSCLASS_HAS_PRIVATE))
+            continue;
         if (JSVAL_IS_PRIMITIVE(v))
             continue;
         if (!JS_SealObject(cx, JSVAL_TO_OBJECT(v), deep))