1 files changed, 15 insertions, 10 deletions
diff --git a/dom/bindings/WebIDLGlobalNameHash.cpp b/dom/bindings/WebIDLGlobalNameHash.cpp
index 3201f71ffd..24e48a343f 100644
--- a/dom/bindings/WebIDLGlobalNameHash.cpp
+++ b/dom/bindings/WebIDLGlobalNameHash.cpp
@@ -38,16 +38,21 @@ static JSObject* FindNamedConstructorForXray(
     return nullptr;
   }
 
-  // This is a call over Xrays, so we will actually use the return value
-  // (instead of just having it defined on the global now).  Check for named
-  // constructors with this id, in case that's what the caller is asking for.
-  for (unsigned slot = DOM_INTERFACE_SLOTS_BASE;
-       slot < JSCLASS_RESERVED_SLOTS(JS::GetClass(interfaceObject)); ++slot) {
-    JSObject* constructor =
-        &JS::GetReservedSlot(interfaceObject, slot).toObject();
-    if (JS_GetMaybePartialFunctionId(JS_GetObjectFunction(constructor)) ==
-        aId.toString()) {
-      return constructor;
+  if (IsInterfaceObject(interfaceObject)) {
+    // This is a call over Xrays, so we will actually use the return value
+    // (instead of just having it defined on the global now).  Check for named
+    // constructors with this id, in case that's what the caller is asking for.
+    for (unsigned slot = INTERFACE_OBJECT_FIRST_LEGACY_FACTORY_FUNCTION;
+         slot < INTERFACE_OBJECT_MAX_SLOTS; ++slot) {
+      const JS::Value& v = js::GetFunctionNativeReserved(interfaceObject, slot);
+      if (!v.isObject()) {
+        break;
+      }
+      JSObject* constructor = &v.toObject();
+      if (JS_GetMaybePartialFunctionId(JS_GetObjectFunction(constructor)) ==
+          aId.toString()) {
+        return constructor;
+      }
     }
   }