From 046cfa050e74206137faf9d460d8baeb6b3fc894 Mon Sep 17 00:00:00 2001
From: Andreas Gal <gal@mozilla.com>
Date: Sun, 10 Oct 2010 15:39:29 -0700
Subject: [PATCH] bug 580128 - Fix compartment mistakes around document.domain
 stuff. r=mrbkap

---
 js/src/xpconnect/wrappers/AccessCheck.cpp | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/js/src/xpconnect/wrappers/AccessCheck.cpp b/js/src/xpconnect/wrappers/AccessCheck.cpp
index acb608a04cb9..faa12d9d7702 100644
--- a/js/src/xpconnect/wrappers/AccessCheck.cpp
+++ b/js/src/xpconnect/wrappers/AccessCheck.cpp
@@ -233,6 +233,7 @@ AccessCheck::isCrossOriginAccessPermitted(JSContext *cx, JSObject *wrapper, jsid
         scope = JS_GetScopeChain(cx);
 
     nsIPrincipal *subject;
+    nsIPrincipal *object;
 
     {
         JSAutoEnterCompartment ac;
@@ -243,11 +244,17 @@ AccessCheck::isCrossOriginAccessPermitted(JSContext *cx, JSObject *wrapper, jsid
         subject = xpc->GetPrincipal(JS_GetGlobalForObject(cx, scope), PR_TRUE);
     }
 
-    nsIPrincipal *objprin =
-        xpc->GetPrincipal(JS_GetGlobalForObject(cx, obj), PR_TRUE);
+    {
+        JSAutoEnterCompartment ac;
+
+        if (!ac.enter(cx, obj))
+            return false;
+
+        object = xpc->GetPrincipal(JS_GetGlobalForObject(cx, obj), PR_TRUE);
+    }
 
     PRBool subsumes;
-    if (NS_SUCCEEDED(subject->Subsumes(objprin, &subsumes)) && subsumes)
+    if (NS_SUCCEEDED(subject->Subsumes(object, &subsumes)) && subsumes)
         return true;
 
     return (act == JSWrapper::SET)