Bug 468552 - Enforce 'funobj' conditions in the XPCNativeWrapper case. r+sr=jst

--HG--
extra : rebase_source : 6023cc8a797167551461fe6f8fb003d98b4f5b9b

js/src/xpconnect/src/xpcwrappednative.cpp

@@ -1444,10 +1444,10 @@ return_tearoff:
 
         if(XPCNativeWrapper::IsNativeWrapperClass(clazz))
         {
-            if(pobj2)
-                *pobj2 = cur;
-
-            return XPCNativeWrapper::GetWrappedNative(cur);
+            unsafeObj =
+                XPCNativeWrapper::GetWrappedNative(cur)->GetFlatJSObject();
+            return GetWrappedNativeOfJSObject(cx, unsafeObj, funobj, pobj2,
+                                              pTearOff);
         }
 
         if(IsXPCSafeJSObjectWrapperClass(clazz) &&