From 83c4bfeea2d2203f726e3bfcb7ee6fe56b4d9703 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Thu, 29 Jan 2015 10:31:25 -0500
Subject: [PATCH] Bug 1111248. r=Waldo, a=sledru

---
 js/src/jsbool.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/js/src/jsbool.cpp b/js/src/jsbool.cpp
index 5d88bd5..8d5d672 100644
--- a/js/src/jsbool.cpp
+++ b/js/src/jsbool.cpp
@@ -198,7 +198,8 @@ js::ToBooleanSlow(HandleValue v)
 bool
 js::BooleanGetPrimitiveValueSlow(HandleObject wrappedBool)
 {
-    JSObject *obj = wrappedBool->as<ProxyObject>().target();
-    JS_ASSERT(obj);
+    JSObject *obj = CheckedUnwrap(wrappedBool);
+    if (!obj || !obj->is<BooleanObject>())
+        return false;
     return obj->as<BooleanObject>().unbox();
 }
-- 
2.2.1