Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-02 18:08:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1525673. Don't assume that same-compartment means same-realm in WrapNewBindingNonWrapperCache. r=peterv

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D18863

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Boris Zbarsky 2019-02-11 13:33:23 +00:00
parent f888b4bd3d
commit afcd9842ec
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
dom/bindings/BindingUtils.h
View File

@ -1171,8 +1171,14 @@ inline bool WrapNewBindingNonWrapperCachedObject(
if (!JS_WrapObject(cx, &proto)) {
return false;
}
} else {
// cx and scope are same-compartment, but they might still be
// different-Realm. Enter the Realm of scope, since that's
// where we want to create our object.
ar.emplace(cx, scope);
}
MOZ_ASSERT_IF(proto, js::IsObjectInContextCompartment(proto, cx));
MOZ_ASSERT(js::IsObjectInContextCompartment(scope, cx));
if (!value->WrapObject(cx, proto, &obj)) {
return false;
@ -1223,8 +1229,14 @@ inline bool WrapNewBindingNonWrapperCachedObject(
if (!JS_WrapObject(cx, &proto)) {
return false;
}
} else {
// cx and scope are same-compartment, but they might still be
// different-Realm. Enter the Realm of scope, since that's
// where we want to create our object.
ar.emplace(cx, scope);
}
MOZ_ASSERT_IF(proto, js::IsObjectInContextCompartment(proto, cx));
MOZ_ASSERT(js::IsObjectInContextCompartment(scope, cx));
if (!value->WrapObject(cx, proto, &obj)) {
return false;