diff options
| author | Gaming4JC <g4jc@hyperbola.info> | 2020-01-20 19:50:19 -0500 |
|---|---|---|
| committer | Gaming4JC <g4jc@hyperbola.info> | 2020-01-26 15:50:48 -0500 |
| commit | 4083a9abf76058d35f0277dd6857478fc6715137 (patch) | |
| tree | fcc1ee67458fa48d14aa8cb0f3e47f24e9c3517b /dom | |
| parent | f576d8f0fe2a2203e6ad5fdd1a319b8991322756 (diff) | |
| download | UXP-4083a9abf76058d35f0277dd6857478fc6715137.tar UXP-4083a9abf76058d35f0277dd6857478fc6715137.tar.gz UXP-4083a9abf76058d35f0277dd6857478fc6715137.tar.lz UXP-4083a9abf76058d35f0277dd6857478fc6715137.tar.xz UXP-4083a9abf76058d35f0277dd6857478fc6715137.zip | |
Bug 1396620 - Part 2: Fix compartment mismatch crash when doing old prototype swizzling for custom element
Tag UXP Issue #1344
Diffstat (limited to 'dom')
| -rw-r--r-- | dom/base/Element.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp index e77b43b86..c8467e036 100644 --- a/dom/base/Element.cpp +++ b/dom/base/Element.cpp @@ -482,6 +482,10 @@ Element::WrapObject(JSContext *aCx, JS::Handle<JSObject*> aGivenProto) data->GetCustomElementType(), &customProto); if (customProto && NodePrincipal()->SubsumesConsideringDomain(nsContentUtils::ObjectPrincipal(customProto))) { + // The custom element prototype could be in different compartment. + if (!JS_WrapObject(aCx, &customProto)) { + return nullptr; + } // Just go ahead and create with the right proto up front. Set // customProto to null to flag that we don't need to do any post-facto // proto fixups here. |