Don't try to create a RecyclableObject::FromVar without checking that the Var is in fact a RecyclableObject first.

dilijev · dilijev · commit c25389faded0 · 2016-05-02T14:48:46.000-07:00
diff --git a/lib/Runtime/Language/JavascriptOperators.cpp b/lib/Runtime/Language/JavascriptOperators.cpp
@@ -8823,8 +8823,9 @@ namespace Js
 
     BOOL JavascriptOperators::ToPropertyDescriptor(Var propertySpec, PropertyDescriptor* descriptor, ScriptContext* scriptContext)
     {
-        if (JavascriptProxy::Is(propertySpec) ||
-            JavascriptOperators::CheckIfPrototypeChainContainsProxyObject(RecyclableObject::FromVar(propertySpec)->GetPrototype()))
+        if (JavascriptProxy::Is(propertySpec) || (
+            RecyclableObject::Is(propertySpec) &&
+            JavascriptOperators::CheckIfPrototypeChainContainsProxyObject(RecyclableObject::FromVar(propertySpec)->GetPrototype())))
         {
             if (ToPropertyDescriptorForProxyObjects(propertySpec, descriptor, scriptContext) == FALSE)
             {

Original file line number	Diff line number	Diff line change
`@@ -8823,8 +8823,9 @@ namespace Js`
`8823`	`8823`
`8824`	`8824`	`BOOL JavascriptOperators::ToPropertyDescriptor(Var propertySpec, PropertyDescriptor* descriptor, ScriptContext* scriptContext)`
`8825`	`8825`	`{`
`8826`		`- if (JavascriptProxy::Is(propertySpec) \|\|`
`8827`		`- JavascriptOperators::CheckIfPrototypeChainContainsProxyObject(RecyclableObject::FromVar(propertySpec)->GetPrototype()))`
	`8826`	`+ if (JavascriptProxy::Is(propertySpec) \|\| (`
	`8827`	`+ RecyclableObject::Is(propertySpec) &&`
	`8828`	`+ JavascriptOperators::CheckIfPrototypeChainContainsProxyObject(RecyclableObject::FromVar(propertySpec)->GetPrototype())))`
`8828`	`8829`	`{`
`8829`	`8830`	`if (ToPropertyDescriptorForProxyObjects(propertySpec, descriptor, scriptContext) == FALSE)`
`8830`	`8831`	`{`