Bug 630533: fix minor OOM crash involving shapes, r=brendan

This commit is contained in:
David Mandelin 2011-02-01 14:54:50 -08:00
parent 3de322ba70
commit 4db10dcdc0

View File

@ -570,12 +570,12 @@ JSObject::getChildProperty(JSContext *cx, Shape *parent, Shape &child)
return NULL;
} else {
shape = JS_PROPERTY_TREE(cx).getChild(cx, parent, child);
if (shape) {
if (!shape)
return NULL;
JS_ASSERT(shape->parent == parent);
JS_ASSERT_IF(parent != lastProp, parent == lastProp->parent);
setLastProperty(shape);
}
}
updateFlags(shape);
updateShape(cx);