Bug 1370752: Part 1 - Enter the correct target compartment when creating structured clone holder. r=aswan

MozReview-Commit-ID: AoDsocd3vPu

--HG--
extra : rebase_source : 6399ef08b2ba7bc4f8c2c0f7e7a26022a20e6e5f
extra : histedit_source : 6ff2d875ead72f0237edad8e96465ebf99333c58

dom/base/StructuredCloneBlob.cpp

@@ -27,8 +27,8 @@ StructuredCloneBlob::StructuredCloneBlob()
 
 /* static */ already_AddRefed<StructuredCloneBlob>
 StructuredCloneBlob::Constructor(GlobalObject& aGlobal, JS::HandleValue aValue,
-                                      JS::HandleObject aTargetGlobal,
-                                      ErrorResult& aRv)
+                                 JS::HandleObject aTargetGlobal,
+                                 ErrorResult& aRv)
 {
   JSContext* cx = aGlobal.Context();
 
@@ -38,7 +38,14 @@ StructuredCloneBlob::Constructor(GlobalObject& aGlobal, JS::HandleValue aValue,
   JS::RootedValue value(cx, aValue);
 
   if (aTargetGlobal) {
-    ac.emplace(cx, aTargetGlobal);
+    JS::RootedObject targetGlobal(cx, js::CheckedUnwrap(aTargetGlobal));
+    if (!targetGlobal) {
+      js::ReportAccessDenied(cx);
+      aRv.NoteJSContextException(cx);
+      return nullptr;
+    }
+
+    ac.emplace(cx, targetGlobal);
 
     if (!JS_WrapValue(cx, &value)) {
       aRv.NoteJSContextException(cx);