Bug 1062024 - Allow CPOWs to be passed to COWs (r=bholley)

js/xpconnect/wrappers/ChromeObjectWrapper.cpp

@@ -7,9 +7,11 @@
 #include "ChromeObjectWrapper.h"
 #include "WrapperFactory.h"
 #include "AccessCheck.h"
+#include "JavaScriptParent.h"
 #include "xpcprivate.h"
 #include "jsapi.h"
 #include "jswrapper.h"
+#include "nsXULAppAPI.h"
 
 using namespace JS;
 
@@ -116,6 +118,16 @@ CheckPassToChrome(JSContext *cx, HandleObject wrapper, HandleValue v)
     if (!js::IsWrapper(obj))
         return true;
 
+    // CPOWs use COWs (in the unprivileged junk scope) for all child->parent
+    // references. Without this test, the child process wouldn't be able to
+    // pass any objects at all to CPOWs.
+    if (mozilla::jsipc::IsWrappedCPOW(obj) &&
+        js::GetObjectCompartment(wrapper) == js::GetObjectCompartment(xpc::UnprivilegedJunkScope()) &&
+        XRE_GetProcessType() == GeckoProcessType_Default)
+    {
+        return true;
+    }
+
     // COWs are fine to pass back if and only if they have __exposedProps__,
     // since presumably content should never have a reason to pass an opaque
     // object back to chrome.

js/xpconnect/wrappers/moz.build

@@ -32,10 +32,13 @@ FAIL_ON_WARNINGS = True
 
 MSVC_ENABLE_PGO = True
 
+include('/ipc/chromium/chromium-config.mozbuild')
+
 FINAL_LIBRARY = 'xul'
 
 LOCAL_INCLUDES += [
     '../../../dom/base',
     '../src',
+    '/js/ipc',
 ]