Bug 455971 - Clear Function and Object (and any other properties) off of the outer object so that Function always refers to the inner window's function. This ensures that the implict Function and explicit window.Function forms refer to the same object. r+sr=brendan

--HG--
extra : transplant_source : %83%9C%81E%A3%95%A5%1D%5DzO%13%85%9B%9A0v%21i%E0

dom/src/base/nsJSEnvironment.cpp

@@ -2313,9 +2313,10 @@ nsJSContext::ConnectToInner(nsIScriptGlobalObject *aNewInner, void *aOuterGlobal
   JSObject *newInnerJSObject = (JSObject *)aNewInner->GetScriptGlobal(JAVASCRIPT);
   JSObject *myobject = (JSObject *)aOuterGlobal;
 
-  // *Don't* call JS_ClearScope here since it's unnecessary
-  // and it confuses the JS engine as to which Function is
-  // on which window. See bug 343966.
+  // Call ClearScope to nuke any properties (e.g. Function and Object) on the
+  // outer object. From now on, anybody asking the outer object for these
+  // properties will be forwarded to the inner window.
+  ::JS_ClearScope(mContext, myobject);
 
   // Make the inner and outer window both share the same
   // prototype. The prototype we share is the outer window's

js/src/xpconnect/src/nsXPConnect.cpp

@@ -1067,7 +1067,7 @@ TempGlobalResolve(JSContext *aJSContext, JSObject *obj, jsval id)
 }
 
 static JSClass xpcTempGlobalClass = {
-    "xpcTempGlobalClass", 0,
+    "xpcTempGlobalClass", JSCLASS_GLOBAL_FLAGS,
     JS_PropertyStub,  JS_PropertyStub,  JS_PropertyStub,  JS_PropertyStub,
     JS_EnumerateStub, TempGlobalResolve, JS_ConvertStub,   JS_FinalizeStub,
     JSCLASS_NO_OPTIONAL_MEMBERS