Bug 991742 part 1. Enter the compartment of the current wrapper before we try to reparent objects. r=bholley

This lets us preserve some invariants about our current compartment matching the scope we want to wrap into.
This commit is contained in:
Boris Zbarsky 2014-04-08 18:27:15 -04:00
parent 683d08734c
commit 3b4c77d08b
5 changed files with 6 additions and 0 deletions

View File

@ -1428,6 +1428,7 @@ CheckForOutdatedParent(nsINode* aParent, nsINode* aNode)
if (js::GetGlobalForObjectCrossCompartment(existingObj) !=
global->GetGlobalJSObject()) {
JSAutoCompartment ac(cx, existingObj);
nsresult rv = ReparentWrapper(cx, existingObj);
NS_ENSURE_SUCCESS(rv, rv);
}

View File

@ -533,6 +533,7 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, bool aClone, bool aDeep,
JS::Rooted<JSObject*> wrapper(cx);
if ((wrapper = aNode->GetWrapper())) {
if (IsDOMObject(wrapper)) {
JSAutoCompartment ac(cx, wrapper);
rv = ReparentWrapper(cx, wrapper);
} else {
nsIXPConnect *xpc = nsContentUtils::XPConnect();

View File

@ -1593,6 +1593,7 @@ nsHTMLDocument::Open(JSContext* cx,
nsCOMPtr<nsIScriptGlobalObject> newScope(do_QueryReferent(mScopeObject));
JS::Rooted<JSObject*> wrapper(cx, GetWrapper());
if (oldScope && newScope != oldScope && wrapper) {
JSAutoCompartment ac(cx, wrapper);
rv = mozilla::dom::ReparentWrapper(cx, wrapper);
if (rv.Failed()) {
return nullptr;

View File

@ -1668,6 +1668,8 @@ private:
nsresult
ReparentWrapper(JSContext* aCx, JS::Handle<JSObject*> aObjArg)
{
js::AssertSameCompartment(aCx, aObjArg);
// Check if we're near the stack limit before we get anywhere near the
// transplanting code.
JS_CHECK_RECURSION(aCx, return NS_ERROR_FAILURE);

View File

@ -1323,6 +1323,7 @@ RescueOrphans(HandleObject obj)
realParent, wn->GetIdentityObject());
}
JSAutoCompartment ac(cx, obj);
return ReparentWrapper(cx, obj);
}