Bug 642022 - Deal with the return value being in a different compartment. r=gal

--HG-- extra : rebase_source : b924c99e830cdafd7e1471cf087e69cfc7e33e23
2011-04-08 14:28:24 -07:00 · 2011-04-08 14:28:24 -07:00 · 14fc761f75
--- a/content/base/crashtests/642022-1.html
+++ b/content/base/crashtests/642022-1.html
@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+InstallTrigger.constructor.create(window).setTimeout(Array, 0);
+</script>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -86,5 +86,6 @@ load 593302-2.html
 load 610571-1.html
 load 604262-1.html
 load 628599-1.html
+load 642022-1.html
 load 637214-1.svg
 load 637214-2.svg
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@ -1925,10 +1925,16 @@ nsJSContext::CallEventHandler(nsISupports* aTarget, void *aScope, void *aHandler
  // Convert to variant before calling ScriptEvaluated, as it may GC, meaning
  // we would need to root rval.
  if (NS_SUCCEEDED(rv)) {
-    if (rval == JSVAL_NULL)
+    if (rval == JSVAL_NULL) {
      *arv = nsnull;
-    else
-      rv = nsContentUtils::XPConnect()->JSToVariant(mContext, rval, arv);
+    } else {
+      if (!JS_WrapValue(mContext, &rval)) {
+        ReportPendingException();
+        rv = NS_ERROR_FAILURE;
+      } else {
+        rv = nsContentUtils::XPConnect()->JSToVariant(mContext, rval, arv);
+      }
+    }
  }

  // ScriptEvaluated needs to come after we pop the stack