Bug 586152 - The outer window is not a true global object, but it represents one; therefore, we need to innerize before checking for its global-ness. r=jorendorff

This commit is contained in:
Blake Kaplan 2010-08-10 15:00:26 -07:00
parent b16ad5ed0a
commit 3d8cd8d4ae

View File

@ -1024,10 +1024,13 @@ obj_eval(JSContext *cx, uintN argc, Value *vp)
return JS_FALSE;
obj = obj->wrappedObject(cx);
OBJ_TO_INNER_OBJECT(cx, obj);
if (!obj)
return JS_FALSE;
/*
* Ban all indirect uses of eval (global.foo = eval; global.foo(...)) and
* calls that attempt to use a non-global object as the "with" object in
* the former indirect case.
* Ban indirect uses of eval (nonglobal.eval = eval; nonglobal.eval(....))
* that attempt to use a non-global object as the scope object.
*/
{
JSObject *parent = obj->getParent();
@ -1086,10 +1089,6 @@ obj_eval(JSContext *cx, uintN argc, Value *vp)
/* Pretend that we're top level. */
staticLevel = 0;
OBJ_TO_INNER_OBJECT(cx, obj);
if (!obj)
return JS_FALSE;
if (!js_CheckPrincipalsAccess(cx, obj,
JS_StackFramePrincipals(cx, caller),
cx->runtime->atomState.evalAtom)) {