Bug 1396620 - Part 2: Fix compartment mismatch crash when doing old prototype swizzling for custom element

Tag UXP Issue #1344
This commit is contained in:
Gaming4JC 2020-01-20 19:50:19 -05:00 committed by Roy Tam
commit 3639f0e2bd

View file

@ -482,6 +482,10 @@ Element::WrapObject(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
data->GetCustomElementType(), &customProto);
if (customProto &&
NodePrincipal()->SubsumesConsideringDomain(nsContentUtils::ObjectPrincipal(customProto))) {
// The custom element prototype could be in different compartment.
if (!JS_WrapObject(aCx, &customProto)) {
return nullptr;
}
// Just go ahead and create with the right proto up front. Set
// customProto to null to flag that we don't need to do any post-facto
// proto fixups here.