Bug 1027131 - Innerize before reflector detection. r=gabor

js/xpconnect/src/ExportHelpers.cpp

@@ -98,10 +98,15 @@ bool IsBlobOrFileList(JSObject *obj)
 
 static bool
 StackScopedCloneWrite(JSContext *cx, JSStructuredCloneWriter *writer,
-                      Handle<JSObject *> obj, void *closure)
+                      Handle<JSObject *> objArg, void *closure)
 {
     MOZ_ASSERT(closure, "Null pointer!");
     StackScopedCloneData *cloneData = static_cast<StackScopedCloneData *>(closure);
+
+    // The SpiderMonkey structured clone machinery does a CheckedUnwrap, but
+    // doesn't strip off outer windows. Do that to avoid confusing the reflector
+    // detection.
+    RootedObject obj(cx, JS_ObjectToInnerObject(cx, objArg));
     if ((cloneData->mOptions->wrapReflectors && IsReflector(obj)) ||
         IsBlobOrFileList(obj))
     {