From 97cfe7e60e07d8c899f2bbdc0977f679442a7077 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Mon, 15 Sep 2014 19:26:20 +0300
Subject: [PATCH] Bug 1067344 - content process crash in
 nsXPCWrappedJS::CanSkip(), r=mccr8

--HG--
extra : rebase_source : 687813170d30e3763de9917bccdb4c58df576d61
---
 js/xpconnect/src/XPCWrappedJS.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/js/xpconnect/src/XPCWrappedJS.cpp b/js/xpconnect/src/XPCWrappedJS.cpp
index 997bbf4dc54..95716c7fe64 100644
--- a/js/xpconnect/src/XPCWrappedJS.cpp
+++ b/js/xpconnect/src/XPCWrappedJS.cpp
@@ -70,8 +70,11 @@ nsXPCWrappedJS::CanSkip()
 
     // For non-root wrappers, check if the root wrapper will be
     // added to the CC graph.
-    if (!IsRootWrapper())
+    if (!IsRootWrapper()) {
+        // mRoot points to null after unlinking.
+        NS_ENSURE_TRUE(mRoot, false);
         return mRoot->CanSkip();
+    }
 
     // For the root wrapper, check if there is an aggregated
     // native object that will be added to the CC graph.