Bug 673503 - Make sure the prototype here is in the right compartment. r=wmccloskey

js/src/jsproxy.cpp

@@ -1175,6 +1175,8 @@ JS_FRIEND_API(JSObject *)
 NewProxyObject(JSContext *cx, JSProxyHandler *handler, const Value &priv, JSObject *proto,
                JSObject *parent, JSObject *call, JSObject *construct)
 {
+    JS_ASSERT_IF(proto, cx->compartment == proto->compartment());
+    JS_ASSERT_IF(parent, cx->compartment == parent->compartment());
     bool fun = call || construct;
     Class *clasp;
     if (fun)

js/src/xpconnect/wrappers/WrapperFactory.cpp

@@ -111,7 +111,7 @@ WrapperFactory::WaiveXray(JSContext *cx, JSObject *obj)
                 return nsnull;
 
             JSAutoEnterCompartment ac;
-            if (!ac.enter(cx, obj))
+            if (!ac.enter(cx, obj) || !JS_WrapObject(cx, &proto))
                 return nsnull;
             wobj = JSWrapper::New(cx, obj, proto, JS_GetGlobalForObject(cx, obj),
                                   &WaiveXrayWrapperWrapper);