Bug 830389 - Switch to the right compartment before reporting an error. r=billm
authorBenjamin Peterson <benjamin@python.org>
Tue, 02 Apr 2013 21:36:38 -0400
changeset 127127 63453515a870
parent 127126 6af3167805da
child 127128 6c6ab0e54917
push id117
push usertomi.aarnio@nokia.com
push dateWed, 03 Apr 2013 12:07:07 +0000
reviewersbillm
bugs830389
milestone23.0a1
Bug 830389 - Switch to the right compartment before reporting an error. r=billm
js/src/jsapi.cpp
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4860,22 +4860,24 @@ JS_NewFunctionById(JSContext *cx, JSNati
 
 JS_PUBLIC_API(JSObject *)
 JS_CloneFunctionObject(JSContext *cx, JSObject *funobjArg, JSRawObject parentArg)
 {
     RootedObject funobj(cx, funobjArg);
     RootedObject parent(cx, parentArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
-    assertSameCompartment(cx, parent);  // XXX no funobj for now
+    assertSameCompartment(cx, parent);
+    // Note that funobj can be in a different compartment.
 
     if (!parent)
         parent = cx->global();
 
     if (!funobj->isFunction()) {
+        AutoCompartment ac(cx, funobj);
         ReportIsNotFunction(cx, ObjectValue(*funobj));
         return NULL;
     }
 
     /*
      * If a function was compiled to be lexically nested inside some other
      * script, we cannot clone it without breaking the compiler's assumptions.
      */