Fix for bug 814821 (Dromaeo dom-traverse regression from bug 812333) - part 1: use qsObjectHelper instead of xpcObjectHelper in HandleNewBindingWrappingFailure. r=bz.

--HG--
extra : rebase_source : 748e0343d37e2b9a25b5b6644bebff428474310c

dom/bindings/BindingUtils.cpp

@@ -453,16 +453,17 @@ CreateInterfaceObjects(JSContext* cx, JSObject* global, JSObject* protoProto,
   }
 }
 
-static bool
-NativeInterface2JSObjectAndThrowIfFailed(XPCLazyCallContext& aLccx,
-                                         JSContext* aCx,
+bool
+NativeInterface2JSObjectAndThrowIfFailed(JSContext* aCx,
+                                         JSObject* aScope,
                                          JS::Value* aRetval,
                                          xpcObjectHelper& aHelper,
                                          const nsIID* aIID,
                                          bool aAllowNativeWrapper)
 {
   nsresult rv;
-  if (!XPCConvert::NativeInterface2JSObject(aLccx, aRetval, NULL, aHelper, aIID,
+  XPCLazyCallContext lccx(JS_CALLER, aCx, aScope);
+  if (!XPCConvert::NativeInterface2JSObject(lccx, aRetval, NULL, aHelper, aIID,
                                             NULL, aAllowNativeWrapper, &rv)) {
     // I can't tell if NativeInterface2JSObject throws JS exceptions
     // or not.  This is a sloppy stab at the right semantics; the
@@ -475,25 +476,6 @@ NativeInterface2JSObjectAndThrowIfFailed(XPCLazyCallContext& aLccx,
   return true;
 }
 
-bool
-DoHandleNewBindingWrappingFailure(JSContext* cx, JSObject* scope,
-                                  nsISupports* value, JS::Value* vp)
-{
-  if (JS_IsExceptionPending(cx)) {
-    return false;
-  }
-
-  XPCLazyCallContext lccx(JS_CALLER, cx, scope);
-
-  if (value) {
-    xpcObjectHelper helper(value);
-    return NativeInterface2JSObjectAndThrowIfFailed(lccx, cx, vp, helper, NULL,
-                                                    true);
-  }
-
-  return Throw<true>(cx, NS_ERROR_XPC_BAD_CONVERT_JS);
-}
-
 // Can only be called with the immediate prototype of the instance object. Can
 // only be called on the prototype of an object known to be a DOM instance.
 JSBool
@@ -511,9 +493,7 @@ bool
 XPCOMObjectToJsval(JSContext* cx, JSObject* scope, xpcObjectHelper &helper,
                    const nsIID* iid, bool allowNativeWrapper, JS::Value* rval)
 {
-  XPCLazyCallContext lccx(JS_CALLER, cx, scope);
-
-  if (!NativeInterface2JSObjectAndThrowIfFailed(lccx, cx, rval, helper, iid,
+  if (!NativeInterface2JSObjectAndThrowIfFailed(cx, scope, rval, helper, iid,
                                                 allowNativeWrapper)) {
     return false;
   }

dom/bindings/BindingUtils.h

@@ -594,26 +594,47 @@ WrapNewBindingNonWrapperCachedObject(JSContext* cx, JSObject* scope,
   return WrapNewBindingNonWrapperCachedObject(cx, scope, value.get(), vp);
 }
 
+// Only set allowNativeWrapper to false if you really know you need it, if in
+// doubt use true. Setting it to false disables security wrappers.
+bool
+NativeInterface2JSObjectAndThrowIfFailed(JSContext* aCx,
+                                         JSObject* aScope,
+                                         JS::Value* aRetval,
+                                         xpcObjectHelper& aHelper,
+                                         const nsIID* aIID,
+                                         bool aAllowNativeWrapper);
+
+inline nsWrapperCache*
+GetWrapperCache(nsWrapperCache* cache)
+{
+  return cache;
+}
+
+inline nsWrapperCache*
+GetWrapperCache(nsGlobalWindow* not_allowed);
+
+inline nsWrapperCache*
+GetWrapperCache(void* p)
+{
+  return NULL;
+}
+
 /**
  * A method to handle new-binding wrap failure, by possibly falling back to
  * wrapping as a non-new-binding object.
  */
-bool
-DoHandleNewBindingWrappingFailure(JSContext* cx, JSObject* scope,
-                                  nsISupports* value, JS::Value* vp);
-
-/**
- * An easy way to call the above when you have a value which
- * multiply-inherits from nsISupports.
- */
 template <class T>
-bool
+MOZ_ALWAYS_INLINE bool
 HandleNewBindingWrappingFailure(JSContext* cx, JSObject* scope, T* value,
                                 JS::Value* vp)
 {
-  nsCOMPtr<nsISupports> val;
-  CallQueryInterface(value, getter_AddRefs(val));
-  return DoHandleNewBindingWrappingFailure(cx, scope, val, vp);
+  if (JS_IsExceptionPending(cx)) {
+    return false;
+  }
+
+  qsObjectHelper helper(value, GetWrapperCache(value));
+  return NativeInterface2JSObjectAndThrowIfFailed(cx, scope, vp, helper,
+                                                  nullptr, true);
 }
 
 // Helper for smart pointers (nsAutoPtr/nsRefPtr/nsCOMPtr).
@@ -701,21 +722,6 @@ FindEnumStringIndex(JSContext* cx, JS::Value v, const EnumEntry* values,
   return -1;
 }
 
-inline nsWrapperCache*
-GetWrapperCache(nsWrapperCache* cache)
-{
-  return cache;
-}
-
-inline nsWrapperCache*
-GetWrapperCache(nsGlobalWindow* not_allowed);
-
-inline nsWrapperCache*
-GetWrapperCache(void* p)
-{
-  return NULL;
-}
-
 struct ParentObject {
   template<class T>
   ParentObject(T* aObject) :

dom/bindings/Bindings.conf

@@ -511,8 +511,7 @@ DOMInterfaces = {
 {
     'nativeType': 'nsXHREventTarget',
     'headerFile': 'nsXMLHttpRequest.h',
-    'concrete': False,
-    'prefable': True,
+    'concrete': False
 },
 {
     'workers': True,
@@ -522,8 +521,7 @@ DOMInterfaces = {
 'XMLHttpRequestUpload': [
 {
     'nativeType': 'nsXMLHttpRequestUpload',
-    'headerFile': 'nsXMLHttpRequest.h',
-    'prefable': True
+    'headerFile': 'nsXMLHttpRequest.h'
 },
 {
     'workers': True,