From 992e9b35b62d9bb054ba6f2b902b0bc70d8f129d Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Fri, 1 Nov 2013 13:38:45 -0700
Subject: [PATCH] Bug 932530 - Handle getType failure in DenseAdd IC; r=djvj

--HG--
extra : rebase_source : 3629f728c46c2674c3c51ca90f9e328d1b837499
---
 js/src/jit/BaselineIC.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index b0af8af2916..014210705fb 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -9236,6 +9236,8 @@ ICUpdatedStub *
 ICSetElemDenseAddCompiler::getStubSpecific(ICStubSpace *space, const AutoShapeVector *shapes)
 {
     RootedTypeObject objType(cx, obj_->getType(cx));
+    if (!objType)
+        return nullptr;
     Rooted<IonCode *> stubCode(cx, getStubCode());
     return ICSetElem_DenseAddImpl<ProtoChainDepth>::New(space, stubCode, objType, shapes);
 }