Bug 731804 - nsXPCWrappedJSClass::GetNamedPropertyAsVariant should jsvalify strings _after_ changing compartments. r=peterv

js/xpconnect/src/XPCWrappedJS.cpp

@@ -668,15 +668,8 @@ nsXPCWrappedJS::GetProperty(const nsAString & name, nsIVariant **_retval)
     if (!ccx.IsValid())
         return NS_ERROR_UNEXPECTED;
 
-    nsStringBuffer* buf;
-    jsval jsstr = XPCStringConvert::ReadableToJSVal(ccx, name, &buf);
-    if (JSVAL_IS_NULL(jsstr))
-        return NS_ERROR_OUT_OF_MEMORY;
-    if (buf)
-        buf->AddRef();
-
     return nsXPCWrappedJSClass::
-        GetNamedPropertyAsVariant(ccx, GetJSObject(), jsstr, _retval);
+        GetNamedPropertyAsVariant(ccx, GetJSObject(), name, _retval);
 }
 
 /***************************************************************************/

js/xpconnect/src/XPCWrappedJSClass.cpp

@@ -375,7 +375,7 @@ GetNamedPropertyAsVariantRaw(XPCCallContext& ccx,
 nsresult
 nsXPCWrappedJSClass::GetNamedPropertyAsVariant(XPCCallContext& ccx,
                                                JSObject* aJSObj,
-                                               jsval aName,
+                                               const nsAString& aName,
                                                nsIVariant** aResult)
 {
     JSContext* cx = ccx.GetJSContext();
@@ -387,7 +387,16 @@ nsXPCWrappedJSClass::GetNamedPropertyAsVariant(XPCCallContext& ccx,
     if (!scriptEval.StartEvaluating(aJSObj))
         return NS_ERROR_FAILURE;
 
-    ok = JS_ValueToId(cx, aName, &id) &&
+    // Wrap the string in a jsval after the AutoScriptEvaluate, so that the
+    // resulting value ends up in the correct compartment.
+    nsStringBuffer* buf;
+    jsval jsstr = XPCStringConvert::ReadableToJSVal(ccx, aName, &buf);
+    if (JSVAL_IS_NULL(jsstr))
+        return NS_ERROR_OUT_OF_MEMORY;
+    if (buf)
+        buf->AddRef();
+
+    ok = JS_ValueToId(cx, jsstr, &id) &&
          GetNamedPropertyAsVariantRaw(ccx, aJSObj, id, aResult, &rv);
 
     return ok ? NS_OK : NS_FAILED(rv) ? rv : NS_ERROR_FAILURE;

js/xpconnect/src/xpcprivate.h

@@ -2898,7 +2898,7 @@ public:
 
     static nsresult GetNamedPropertyAsVariant(XPCCallContext& ccx,
                                               JSObject* aJSObj,
-                                              jsval aName,
+                                              const nsAString& aName,
                                               nsIVariant** aResult);
 
     virtual ~nsXPCWrappedJSClass();