Bug 1396620 - Part 2: Fix compartment mismatch crash when doing old prototype swizzling for custom element; r=smaug

MozReview-Commit-ID: GMxikyKJ54A

--HG--
extra : rebase_source : 594ab2727e085e4b1e81d2ed5915b230b7c96365

dom/base/Element.cpp

@@ -527,6 +527,10 @@ Element::WrapObject(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
                                          data->GetCustomElementType(), &customProto);
       if (customProto &&
           NodePrincipal()->SubsumesConsideringDomain(nsContentUtils::ObjectPrincipal(customProto))) {
+        // The custom element prototype could be in different compartment.
+        if (!JS_WrapObject(aCx, &customProto)) {
+          return nullptr;
+        }
         // Just go ahead and create with the right proto up front.  Set
         // customProto to null to flag that we don't need to do any post-facto
         // proto fixups here.