diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp index 25e9e93b3b..79f2d23d96 100644 --- a/js/src/vm/StructuredClone.cpp +++ b/js/src/vm/StructuredClone.cpp @@ -1700,6 +1700,8 @@ JSStructuredCloneWriter::write(HandleValue v) return false; if (cls == ESClass::Map) { + if (!counts.back()) + return false; counts.back()--; RootedValue val(context(), entries.back()); entries.popBack();