Bug 1450688. r=bz, a=RyanVM
authorKris Maglione <maglione.k@gmail.com>
Tue, 15 May 2018 16:01:36 -0700
changeset 802275 983ff6a90aae872383d52d5189396a47f3db7d17
parent 802274 7f9fbb6a71d25fd88202440ed96915f8df868a49
child 802276 fd7f1f6a44cd1005a5d4948438c20407d4eaebb6
push id111850
push userbmo:tom@mozilla.com
push dateThu, 31 May 2018 16:41:37 +0000
reviewersbz, RyanVM
bugs1450688
milestone60.0.2
Bug 1450688. r=bz, a=RyanVM MozReview-Commit-ID: 4KHNpxiziWd
dom/xbl/nsXBLBinding.cpp
--- a/dom/xbl/nsXBLBinding.cpp
+++ b/dom/xbl/nsXBLBinding.cpp
@@ -970,17 +970,27 @@ nsXBLBinding::DoInitJSClass(JSContext *c
   // prototype are same-compartment with the bound document.
   JS::Rooted<JSObject*> global(cx, js::GetGlobalForObjectCrossCompartment(obj));
 
   // We never store class objects in add-on scopes.
   JS::Rooted<JSObject*> xblScope(cx, xpc::GetXBLScopeOrGlobal(cx, global));
   NS_ENSURE_TRUE(xblScope, NS_ERROR_UNEXPECTED);
 
   JS::Rooted<JSObject*> parent_proto(cx);
-  if (!JS_GetPrototype(cx, obj, &parent_proto)) {
+  {
+    JS::RootedObject wrapped(cx, obj);
+    JSAutoCompartment ac(cx, xblScope);
+    if (!JS_WrapObject(cx, &wrapped)) {
+      return NS_ERROR_FAILURE;
+    }
+    if (!JS_GetPrototype(cx, wrapped, &parent_proto)) {
+      return NS_ERROR_FAILURE;
+    }
+  }
+  if (!JS_WrapObject(cx, &parent_proto)) {
     return NS_ERROR_FAILURE;
   }
 
   // Get the map entry for the parent prototype. In the one-off case that the
   // parent prototype is null, we somewhat hackily just use the WeakMap itself
   // as a property holder.
   JS::Rooted<JSObject*> holder(cx);
   if (parent_proto) {