mozilla-central: changeset 213248:49ac8f33ab70633088ef1121f9646d5dac9294a6

☠☠ backed out by a37fedd51b7d ☠ ☠
author	Boris Zbarsky <bzbarsky@mit.edu>
	Thu, 30 Oct 2014 17:40:13 -0400
changeset 213248	49ac8f33ab70633088ef1121f9646d5dac9294a6
parent 213247	920d50e84a17f9198e05b559314751da78b1bcf5
child 213249	2d449a2b4e1cc684f316f2ad116e352497f6798e
push id	27745
push user	cbook@mozilla.com
push date	Fri, 31 Oct 2014 13:09:12 +0000
treeherder	mozilla-central@6bd2071b373f [default view] [failures only]
perfherder	[talos] [build metrics] [platform microbench] (compared to previous push)
reviewers	peterv
bugs	1088228
milestone	36.0a1
first release with	nightly linux32 6bd2071b373f / 36.0a1 / 20141031061804 / files nightly linux64 6bd2071b373f / 36.0a1 / 20141031061804 / files nightly mac 6bd2071b373f / 36.0a1 / 20141031061804 / files nightly win32 6bd2071b373f / 36.0a1 / 20141031061804 / files nightly win64 6bd2071b373f / 36.0a1 / 20141031061804 / files
last release without	nightly linux32 e0b505a37b1c / 36.0a1 / 20141031030201 / files nightly linux64 e0b505a37b1c / 36.0a1 / 20141031030201 / files nightly mac e0b505a37b1c / 36.0a1 / 20141031030201 / files nightly win32 e0b505a37b1c / 36.0a1 / 20141031030201 / files nightly win64 e0b505a37b1c / 36.0a1 / 20141031030201 / files

--- a/dom/events/EventListenerManager.cpp
+++ b/dom/events/EventListenerManager.cpp
@@ -858,50 +858,43 @@ EventListenerManager::CompileEventHandle
     JSAutoCompartment ac(cx, wrapScope);
     nsresult rv = nsContentUtils::WrapNative(cx, mTarget, &v,
                                              /* aAllowWrapping = */ false);
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
   }
 
-  JS::AutoObjectVector scopeChain(cx);
-  { // scope for curScope
-    // We append all the non-globals on our desired scope chain.
-    JS::Rooted<JSObject*> curScope(cx, &v.toObject());
-    while (curScope && !JS_IsGlobalObject(curScope)) {
-      if (!scopeChain.append(curScope)) {
-        return NS_ERROR_OUT_OF_MEMORY;
-      }
-      curScope = JS_GetParent(curScope);
-    }
-  }
-
   if (addonId) {
     JS::Rooted<JSObject*> vObj(cx, &v.toObject());
     JS::Rooted<JSObject*> addonScope(cx, xpc::GetAddonScope(cx, vObj, addonId));
     if (!addonScope) {
       return NS_ERROR_FAILURE;
     }
     JSAutoCompartment ac(cx, addonScope);
-    for (size_t i = 0; i < scopeChain.length(); ++i) {
-      if (!JS_WrapObject(cx, scopeChain[i])) {
-        return NS_ERROR_FAILURE;
-      }
-    }
 
-    // And wrap v as well, since scopeChain might be empty so we can't
-    // reliably use it to enter a compartment.
+    // Wrap our event target into the addon scope, since that's where we want to
+    // do all our work.
     if (!JS_WrapValue(cx, &v)) {
       return NS_ERROR_FAILURE;
     }
   }
   JS::Rooted<JSObject*> target(cx, &v.toObject());
   JSAutoCompartment ac(cx, target);
 
+  // Now that we've entered the compartment we actually care about, create our
+  // scope chain.  Note that we start with |element|, not aElement, because
+  // mTarget is different from aElement in the <body> case, where mTarget is a
+  // Window, and in that case we do not want the scope chain to include the body
+  // or the document.
+  JS::AutoObjectVector scopeChain(cx);
+  if (!nsJSUtils::GetScopeChainForElement(cx, element, scopeChain)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
   nsDependentAtomString str(attrName);
   // Most of our names are short enough that we don't even have to malloc
   // the JS string stuff, so don't worry about playing games with
   // refcounting XPCOM stringbuffers.
   JS::Rooted<JSString*> jsStr(cx, JS_NewUCStringCopyN(cx,
                                                       str.BeginReading(),
                                                       str.Length()));
   NS_ENSURE_TRUE(jsStr, NS_ERROR_OUT_OF_MEMORY);