Use right compartment when resolving prototypes (bug 620028, r=jst).
authorAndreas Gal <gal@mozilla.com>
Thu, 06 Jan 2011 22:31:14 -0800
changeset 60209 05cbcfe5d6944208550a6a523faf0967d53de3b3
parent 60208 8d7836a659e8f0cc32996a1453e17e540d945024
child 60210 5e189ae2adc1b0d80660b16b4343f39eb8bb5794
push id17881
push usercleary@mozilla.com
push dateFri, 07 Jan 2011 19:57:21 +0000
treeherdermozilla-central@54576be62860 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjst
bugs620028
milestone2.0b9pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Use right compartment when resolving prototypes (bug 620028, r=jst).
dom/base/nsDOMClassInfo.cpp
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -6261,27 +6261,37 @@ ResolvePrototype(nsIXPConnect *aXPConnec
 
         if (JSVAL_IS_OBJECT(val)) {
           proto = JSVAL_TO_OBJECT(val);
         }
       }
     }
 
     if (dot_prototype) {
+      JSAutoEnterCompartment ac;
+      if (!ac.enter(cx, dot_prototype)) {
+        return NS_ERROR_UNEXPECTED;
+      }
+
       JSObject *xpc_proto_proto = ::JS_GetPrototype(cx, dot_prototype);
 
       if (proto &&
           (!xpc_proto_proto ||
            JS_GET_CLASS(cx, xpc_proto_proto) == sObjectClass)) {
         if (!JS_WrapObject(cx, &proto) ||
             !JS_SetPrototype(cx, dot_prototype, proto)) {
           return NS_ERROR_UNEXPECTED;
         }
       }
     } else {
+      JSAutoEnterCompartment ac;
+      if (!ac.enter(cx, winobj)) {
+        return NS_ERROR_UNEXPECTED;
+      }
+
       dot_prototype = ::JS_NewObject(cx, &sDOMConstructorProtoClass, proto,
                                      winobj);
       NS_ENSURE_TRUE(dot_prototype, NS_ERROR_OUT_OF_MEMORY);
     }
   }
 
   v = OBJECT_TO_JSVAL(dot_prototype);