bug 321522: The sandbox object needs to come from a new context, not the old

context. r=shaver sr=brendan

js/src/xpconnect/src/xpccomponents.cpp

@@ -2246,7 +2246,11 @@ nsXPCComponents_utils_Sandbox::CallOrConstruct(nsIXPConnectWrappedNative *wrappe
     if(NS_FAILED(rv))
         return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
 
-    JSObject *sandbox = JS_NewObject(cx, &SandboxClass, nsnull, nsnull);
+    XPCAutoJSContext tempcx(JS_NewContext(JS_GetRuntime(cx), 1024), PR_FALSE);
+    if (!tempcx)
+        return ThrowAndFail(NS_ERROR_OUT_OF_MEMORY, cx, _retval);
+
+    JSObject *sandbox = JS_NewObject(tempcx, &SandboxClass, nsnull, nsnull);
     if (!sandbox)
         return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
 

js/src/xpconnect/src/xpcprivate.h

@@ -388,6 +388,34 @@ private:
     static void operator delete(void* /*memory*/) {}
 };
 
+// A helper class to deal with temporary JS contexts. It destroys the context
+// when it goes out of scope.
+class XPCAutoJSContext
+{
+public:
+    XPCAutoJSContext(JSContext *aContext, PRBool aGCOnDestroy)
+        : mContext(aContext), mGCOnDestroy(aGCOnDestroy)
+    {
+    }
+
+    ~XPCAutoJSContext()
+    {
+        if(!mContext)
+            return;
+
+        if(mGCOnDestroy)
+            JS_DestroyContext(mContext);
+        else
+            JS_DestroyContextNoGC(mContext);
+    }
+
+    operator JSContext * () {return mContext;}
+
+private:
+    JSContext *mContext;
+    PRBool mGCOnDestroy;
+};
+
 /***************************************************************************
 ****************************************************************************
 *