Unwrap before applying waiver wrapper (bug 626290, r=mrbkap).

js/src/xpconnect/wrappers/WrapperFactory.cpp

@@ -83,6 +83,8 @@ GetCurrentOuter(JSContext *cx, JSObject *obj)
 JSObject *
 WrapperFactory::WaiveXray(JSContext *cx, JSObject *obj)
 {
+    obj = obj->unwrap();
+
     // We have to make sure that if we're wrapping an outer window, that
     // the .wrappedJSObject also wraps the outer window.
     obj = GetCurrentOuter(cx, obj);
@@ -130,7 +132,10 @@ JSObject *
 WrapperFactory::DoubleWrap(JSContext *cx, JSObject *obj, uintN flags)
 {
     if (flags & WrapperFactory::WAIVE_XRAY_WRAPPER_FLAG) {
-        js::SwitchToCompartment sc(cx, obj->compartment());
+        JSAutoEnterCompartment ac;
+        if (!ac.enter(cx, obj))
+            return nsnull;
+
         return WaiveXray(cx, obj);
     }
     return obj;
@@ -347,7 +352,7 @@ WrapperFactory::WaiveXrayAndWrap(JSContext *cx, jsval *vp)
     if (JSVAL_IS_PRIMITIVE(*vp))
         return JS_WrapValue(cx, vp);
 
-    JSObject *obj = JSVAL_TO_OBJECT(*vp)->unwrap();
+    JSObject *obj = JSVAL_TO_OBJECT(*vp);
 
     obj = WaiveXray(cx, obj);
     if (!obj)