Bug 1151385 - Fail early for cross-origin sandboxPrototype. r=gabor

js/xpconnect/src/Sandbox.cpp

@@ -945,7 +945,11 @@ xpc::CreateSandboxObject(JSContext* cx, MutableHandleValue vp, nsISupports* prin
                 return NS_ERROR_XPC_UNEXPECTED;
 
             // Now check what sort of thing we've got in |proto|
-            JSObject* unwrappedProto = js::UncheckedUnwrap(options.proto, false);
+            JSObject* unwrappedProto = js::CheckedUnwrap(options.proto, false);
+            if (!unwrappedProto) {
+                JS_ReportError(cx, "Sandbox must subsume sandboxPrototype");
+                return NS_ERROR_INVALID_ARG;
+            }
             const js::Class* unwrappedClass = js::GetObjectClass(unwrappedProto);
             if (IS_WN_CLASS(unwrappedClass) ||
                 mozilla::dom::IsDOMClass(Jsvalify(unwrappedClass))) {

js/xpconnect/tests/unit/test_bug1151385.js

@@ -0,0 +1,9 @@
+function run_test()
+{
+  try {
+    var sandbox = new Components.utils.Sandbox(null, {"sandboxPrototype" : {}});
+    do_check_true(false);
+  } catch (e) {
+    do_check_true(/must subsume sandboxPrototype/.test(e));
+  }
+}

js/xpconnect/tests/unit/xpcshell.ini

@@ -55,6 +55,7 @@ support-files =
 [test_bug1081990.js]
 [test_bug1110546.js]
 [test_bug1150771.js]
+[test_bug1151385.js]
 [test_bug_442086.js]
 [test_callFunctionWithAsyncStack.js]
 [test_file.js]