Bug 857417. Trigger a fatal assertion when wrapping a wrappercached and nsISupports WebIDL object which has the wrapper cache before the nsISupports in its object layout. r=khuey

content/xslt/src/xpath/nsXPathEvaluator.h

@@ -77,6 +77,12 @@ private:
     nsRefPtr<txResultRecycler> mRecycler;
 };
 
+inline nsISupports*
+ToSupports(nsXPathEvaluator* e)
+{
+    return static_cast<nsIDOMXPathEvaluator*>(e);
+}
+
 /* d0a75e02-b5e7-11d5-a7f2-df109fb8a1fc */
 #define TRANSFORMIIX_XPATH_EVALUATOR_CID   \
 { 0xd0a75e02, 0xb5e7, 0x11d5, { 0xa7, 0xf2, 0xdf, 0x10, 0x9f, 0xb8, 0xa1, 0xfc } }

dom/bindings/Codegen.py

@@ -1910,6 +1910,10 @@ def AssertInheritanceChain(descriptor):
             "             reinterpret_cast<%s*>(aObject));\n" %
             (desc.nativeType, desc.nativeType))
         iface = iface.parent
+    if descriptor.nativeOwnership == 'nsisupports':
+        asserts += (
+            "  MOZ_ASSERT(ToSupports(aObject) == \n"
+            "             reinterpret_cast<nsISupports*>(aObject));\n")
     return asserts
 
 class CGWrapWithCacheMethod(CGAbstractMethod):
@@ -1930,8 +1934,14 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
         if self.descriptor.workers:
             return """  return aObject->GetJSObject();"""
 
+        if self.descriptor.nativeOwnership == 'nsisupports':
+            assertISupportsInheritance = (
+                '  MOZ_ASSERT(reinterpret_cast<nsWrapperCache*>(aObject) != aCache,\n'
+                '             "nsISupports must be on our primary inheritance chain");\n')
+        else:
+            assertISupportsInheritance = ""
         return """%s
-
+%s
   JSObject* parent = WrapNativeParent(aCx, aScope, aObject->GetParentObject());
   if (!parent) {
     return NULL;
@@ -1959,6 +1969,7 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
   aCache->SetWrapper(obj);
 
   return obj;""" % (AssertInheritanceChain(self.descriptor),
+                    assertISupportsInheritance,
                     CreateBindingJSObject(self.descriptor, "parent"),
                     InitUnforgeableProperties(self.descriptor, self.properties))