Bug 625251 - nsJSEnvironment should enter the compartment before converting arguments to jsvals (r=mrbkap)

--HG--
extra : rebase_source : 3ae0fd2b96fcdc072a75ecb025417723b9f0702b
This commit is contained in:
Luke Wagner 2011-01-21 15:25:04 -08:00
parent e907f1a224
commit 8ebed13ec8

View File

@ -1969,18 +1969,6 @@ nsJSContext::CallEventHandler(nsISupports* aTarget, void *aScope, void *aHandler
PRUint32 argc = 0;
jsval *argv = nsnull;
js::LazilyConstructed<nsAutoPoolRelease> poolRelease;
js::LazilyConstructed<js::AutoArrayRooter> tvr;
// Use |target| as the scope for wrapping the arguments, since aScope is
// the safe scope in many cases, which isn't very useful. Wrapping aTarget
// was OK because those typically have PreCreate methods that give them the
// right scope anyway, and we want to make sure that the arguments end up
// in the same scope as aTarget.
rv = ConvertSupportsTojsvals(aargv, target, &argc,
&argv, poolRelease, tvr);
NS_ENSURE_SUCCESS(rv, rv);
JSObject *funobj = static_cast<JSObject *>(aHandler);
nsCOMPtr<nsIPrincipal> principal;
rv = sSecurityManager->GetObjectPrincipal(mContext, funobj,
@ -2000,6 +1988,18 @@ nsJSContext::CallEventHandler(nsISupports* aTarget, void *aScope, void *aHandler
return NS_ERROR_FAILURE;
}
js::LazilyConstructed<nsAutoPoolRelease> poolRelease;
js::LazilyConstructed<js::AutoArrayRooter> tvr;
// Use |target| as the scope for wrapping the arguments, since aScope is
// the safe scope in many cases, which isn't very useful. Wrapping aTarget
// was OK because those typically have PreCreate methods that give them the
// right scope anyway, and we want to make sure that the arguments end up
// in the same scope as aTarget.
rv = ConvertSupportsTojsvals(aargv, target, &argc,
&argv, poolRelease, tvr);
NS_ENSURE_SUCCESS(rv, rv);
++mExecuteDepth;
PRBool ok = ::JS_CallFunctionValue(mContext, target,
funval, argc, argv, &rval);