3 files changed, 11 insertions, 1 deletions
diff --git a/js/ipc/JavaScriptShared.cpp b/js/ipc/JavaScriptShared.cpp
index 9786243f2..961a3f910 100644
--- a/js/ipc/JavaScriptShared.cpp
+++ b/js/ipc/JavaScriptShared.cpp
@@ -61,6 +61,15 @@ IdToObjectMap::find(ObjectId id)
     return p->value();
 }
 
+JSObject*
+IdToObjectMap::findPreserveColor(ObjectId id)
+{
+    Table::Ptr p = table_.lookup(id);
+    if (!p) 
+        return nullptr;
+    return p->value().unbarrieredGet();
+}
+
 bool
 IdToObjectMap::add(ObjectId id, JSObject* obj)
 {
diff --git a/js/ipc/JavaScriptShared.h b/js/ipc/JavaScriptShared.h
index 4de153826..5ecec7429 100644
--- a/js/ipc/JavaScriptShared.h
+++ b/js/ipc/JavaScriptShared.h
@@ -96,6 +96,7 @@ class IdToObjectMap
 
     bool add(ObjectId id, JSObject* obj);
     JSObject* find(ObjectId id);
+    JSObject* findPreserveColor(ObjectId id);
     void remove(ObjectId id);
 
     void clear();
diff --git a/js/ipc/WrapperAnswer.cpp b/js/ipc/WrapperAnswer.cpp
index fc342bbb6..563f8f90d 100644
--- a/js/ipc/WrapperAnswer.cpp
+++ b/js/ipc/WrapperAnswer.cpp
@@ -789,7 +789,7 @@ WrapperAnswer::RecvDOMInstanceOf(const ObjectId& objId, const int& prototypeID,
 bool
 WrapperAnswer::RecvDropObject(const ObjectId& objId)
 {
-    JSObject* obj = objects_.find(objId);
+    JSObject* obj = objects_.findPreserveColor(objId);
     if (obj) {
         objectIdMap(objId.hasXrayWaiver()).remove(obj);
         objects_.remove(objId);