Bug 1177907 - Handle ObjectClassIs exception in date_toString. r=till

2015-06-30 04:36:00 -04:00
parent 7b433e4586
commit 1da4d5e992
2 changed files with 9 additions and 1 deletions
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -2883,9 +2883,13 @@ date_toString(JSContext* cx, unsigned argc, Value* vp)
        if (ObjectClassIs(obj, ESClass_Date, cx)) {
            // Step 3.a.
            RootedValue unboxed(cx);
-            Unbox(cx, obj, &unboxed);
+            if (!Unbox(cx, obj, &unboxed))
+                return false;
            tv = unboxed.toNumber();
        }
+        // ObjectClassIs can throw for objects from other compartments.
+        if (cx->isExceptionPending())
+            return false;
    }
    // Step 4.
    return date_format(cx, tv, FORMATSPEC_FULL, args.rval());