Merge branch 'master' into core-updates

1 files changed, 27 insertions, 0 deletions

diff --git a/gnu/packages/patches/icecat-CVE-2015-0836-pt-02.patch b/gnu/packages/patches/icecat-CVE-2015-0836-pt-02.patch
new file mode 100644
index 0000000000..c95cf23a29
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-0836-pt-02.patch
@@ -0,0 +1,27 @@
+From 83c4bfeea2d2203f726e3bfcb7ee6fe56b4d9703 Mon Sep 17 00:00:00 2001
+From: Ryan VanderMeulen <ryanvm@gmail.com>
+Date: Thu, 29 Jan 2015 10:31:25 -0500
+Subject: [PATCH] Bug 1111248. r=Waldo, a=sledru
+
+---
+ js/src/jsbool.cpp | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/js/src/jsbool.cpp b/js/src/jsbool.cpp
+index 5d88bd5..8d5d672 100644
+--- a/js/src/jsbool.cpp
++++ b/js/src/jsbool.cpp
+@@ -198,7 +198,8 @@ js::ToBooleanSlow(HandleValue v)
+ bool
+ js::BooleanGetPrimitiveValueSlow(HandleObject wrappedBool)
+ {
+-    JSObject *obj = wrappedBool->as<ProxyObject>().target();
+-    JS_ASSERT(obj);
++    JSObject *obj = CheckedUnwrap(wrappedBool);
++    if (!obj || !obj->is<BooleanObject>())
++        return false;
+     return obj->as<BooleanObject>().unbox();
+ }
+-- 
+2.2.1
+