Bug 874158 - Crash in GetNativeForGlobal. r=bholley

content/base/src/nsDOMFileReader.cpp

@@ -132,9 +132,11 @@ nsDOMFileReader::Init()
   mPrincipal.swap(principal);
 
   // Instead of grabbing some random global from the context stack,
-  // let's use the default one (junk drawer) for now.
+  // let's use the default one (junk scope) for now.
   // We should move away from this Init...
-  BindToOwner(xpc::GetNativeForGlobal(xpc::GetJunkScope()));
+  nsCOMPtr<nsIGlobalObject> global = xpc::GetJunkScopeGlobal();
+  NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
+  BindToOwner(global);
   return NS_OK;
 }
 

content/base/src/nsDocument.cpp

@@ -1954,7 +1954,9 @@ nsDocument::Init()
   // we use the default compartment for this document, instead of creating
   // wrapper in some random compartment when the document is exposed to js
   // via some events.
-  mScopeObject = do_GetWeakReference(xpc::GetNativeForGlobal(xpc::GetJunkScope()));
+  nsCOMPtr<nsIGlobalObject> global = xpc::GetJunkScopeGlobal();
+  NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
+  mScopeObject = do_GetWeakReference(global);
   MOZ_ASSERT(mScopeObject);
 
   // Force initialization.

content/base/src/nsXMLHttpRequest.cpp

@@ -356,9 +356,11 @@ nsXMLHttpRequest::Init()
   NS_ENSURE_STATE(subjectPrincipal);
 
   // Instead of grabbing some random global from the context stack,
-  // let's use the default one (junk drawer) for now.
+  // let's use the default one (junk scope) for now.
   // We should move away from this Init...
-  Construct(subjectPrincipal, xpc::GetNativeForGlobal(xpc::GetJunkScope()));
+  nsCOMPtr<nsIGlobalObject> global = xpc::GetJunkScopeGlobal();
+  NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
+  Construct(subjectPrincipal, global);
   return NS_OK;
 }
 

js/xpconnect/src/XPCJSRuntime.cpp

@@ -396,6 +396,17 @@ GetJunkScope()
     return self->GetJunkScope();
 }
 
+nsIGlobalObject *
+GetJunkScopeGlobal()
+{
+    JSObject *junkScope = GetJunkScope();
+    // GetJunkScope would ideally never fail, currently it is not yet the case
+    // unfortunately...(see Bug 874158)
+    if (!junkScope)
+        return nullptr;
+    return GetNativeForGlobal(junkScope);
+}
+
 }
 
 static void

js/xpconnect/src/xpcpublic.h

@@ -413,6 +413,13 @@ GetNativeForGlobal(JSObject *global);
  */
 JSObject *
 GetJunkScope();
+
+/**
+ * Returns the native global of the junk scope. See comment of GetJunkScope
+ * about the conditions of using it.
+ */
+nsIGlobalObject *
+GetJunkScopeGlobal();
 } // namespace xpc
 
 namespace mozilla {