Bug 911195 - Properly compartment scroll event object. r=bz

--HG--
extra : rebase_source : 512a70ed17889808f0a6add6b4da7403fb3d4947

dom/browser-element/BrowserElementParent.cpp

@@ -302,6 +302,10 @@ private:
 NS_IMETHODIMP DispatchAsyncScrollEventRunnable::Run()
 {
   nsCOMPtr<Element> frameElement = mTabParent->GetOwnerElement();
+  nsIDocument *doc = frameElement->OwnerDoc();
+  nsCOMPtr<nsIGlobalObject> globalObject = doc->GetScopeObject();
+  NS_ENSURE_TRUE(globalObject, NS_ERROR_UNEXPECTED);
+
   // Create the event's detail object.
   AsyncScrollEventDetailInitializer detail;
   detail.mLeft = mContentRect.x;
@@ -310,7 +314,12 @@ NS_IMETHODIMP DispatchAsyncScrollEventRunnable::Run()
   detail.mHeight = mContentRect.height;
   detail.mScrollWidth = mContentRect.width;
   detail.mScrollHeight = mContentRect.height;
+
   AutoSafeJSContext cx;
+  JS::Rooted<JSObject*> globalJSObject(cx, globalObject->GetGlobalJSObject());
+  NS_ENSURE_TRUE(globalJSObject, NS_ERROR_UNEXPECTED);
+
+  JSAutoCompartment ac(cx, globalJSObject);
   JS::Rooted<JS::Value> val(cx);
 
   // We can get away with a null global here because