From 4db10dcdc0e95612f4549db80cceb8d2f7e1dd12 Mon Sep 17 00:00:00 2001
From: David Mandelin <dmandelin@mozilla.com>
Date: Tue, 1 Feb 2011 14:54:50 -0800
Subject: [PATCH] Bug 630533: fix minor OOM crash involving shapes, r=brendan

---
 js/src/jsscope.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index 7996f5e4a14..4647f3889ef 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -570,11 +570,11 @@ JSObject::getChildProperty(JSContext *cx, Shape *parent, Shape &child)
             return NULL;
     } else {
         shape = JS_PROPERTY_TREE(cx).getChild(cx, parent, child);
-        if (shape) {
-            JS_ASSERT(shape->parent == parent);
-            JS_ASSERT_IF(parent != lastProp, parent == lastProp->parent);
-            setLastProperty(shape);
-        }
+        if (!shape)
+            return NULL;
+        JS_ASSERT(shape->parent == parent);
+        JS_ASSERT_IF(parent != lastProp, parent == lastProp->parent);
+        setLastProperty(shape);
     }
 
     updateFlags(shape);