From 95770344159bb19ee2c89f210218411b15619460 Mon Sep 17 00:00:00 2001
From: Gabor Krizsanits <gkrizsanits@mozilla.com>
Date: Mon, 2 Jan 2012 19:06:07 +0100
Subject: [PATCH] Bug 677294 - part 2: need a way to create new JS scopes and
 run scripts against them (same compartment); r=mrbkap

---
 js/xpconnect/src/XPCComponents.cpp | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index 182f1f172033..c8a90a5cd2e0 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -57,6 +57,7 @@
 #include "mozJSComponentLoader.h"
 #include "nsContentUtils.h"
 #include "jsgc.h"
+#include "jsfriendapi.h"
 
 using namespace js;
 /***************************************************************************/
@@ -3223,12 +3224,17 @@ nsXPCComponents_utils_Sandbox::CallOrConstruct(nsIXPConnectWrappedNative *wrappe
 
         if (found) {
             if (!JS_GetProperty(cx, optionsObject, "sameGroupAs", &option) ||
-                JSVAL_IS_PRIMITIVE(option)) {
-                    return ThrowAndFail(NS_ERROR_INVALID_ARG, cx, _retval);
-            }
+                JSVAL_IS_PRIMITIVE(option))
+                return ThrowAndFail(NS_ERROR_INVALID_ARG, cx, _retval);
+
+            JSObject* unwrapped = UnwrapObject(JSVAL_TO_OBJECT(option));
+            JSObject* global = GetGlobalForObjectCrossCompartment(unwrapped);
+            if (GetObjectJSClass(unwrapped) != &SandboxClass &&
+                GetObjectJSClass(global) != &SandboxClass)
+                return ThrowAndFail(NS_ERROR_INVALID_ARG, cx, _retval);
 
             void* privateValue =
-                JS_GetCompartmentPrivate(cx,GetObjectCompartment(JSVAL_TO_OBJECT(option)));
+                JS_GetCompartmentPrivate(cx, GetObjectCompartment(unwrapped));
             xpc::CompartmentPrivate *compartmentPrivate =
                 static_cast<xpc::CompartmentPrivate*>(privateValue);