Fix for 568148 (a=dveditz).
authorBrendan Eich <brendan@mozilla.org>
Mon, 21 Jun 2010 12:53:11 -0700
changeset 26959 d4b2224cf458
parent 26958 a1e407b24260
child 26960 cfb571fbc5f5
push id2394
push userbrendan@mozilla.com
push date2010-06-21 19:53 +0000
reviewersdveditz
bugs568148
milestone1.9.1.11pre
Fix for 568148 (a=dveditz).
js/src/jsparse.cpp
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -911,17 +911,17 @@ JSCompiler::compileScript(JSContext *cx,
 
 #if JS_HAS_XML_SUPPORT
     /*
      * Prevent XML data theft via <script src="http://victim.com/foo.xml">.
      * For background, see:
      *
      * https://bugzilla.mozilla.org/show_bug.cgi?id=336551
      */
-    if (pn && onlyXML && (tcflags & TCF_NO_SCRIPT_RVAL)) {
+    if (pn && onlyXML && !callerFrame) {
         js_ReportCompileErrorNumber(cx, &jsc.tokenStream, NULL, JSREPORT_ERROR,
                                     JSMSG_XML_WHOLE_PROGRAM);
         goto out;
     }
 #endif
 
     /*
      * Global variables and regexps share the index space with locals. Due to