Fix for bug 346362 (document.evaluate(.., contextNode, ...) should raise an exception if document != contextNode.ownerDocument). r/sr=sicking.

content/xslt/src/xpath/nsXPathEvaluator.cpp

@@ -151,8 +151,6 @@ nsXPathEvaluator::Evaluate(const nsAString & aExpression,
                            nsISupports *aInResult,
                            nsISupports **aResult)
 {
-    // XXX Need to check document of aContextNode if created by
-    //     QI'ing a document.
     nsCOMPtr<nsIDOMXPathExpression> expression;
     nsresult rv = CreateExpression(aExpression, aResolver,
                                    getter_AddRefs(expression));
@@ -239,7 +237,9 @@ nsXPathEvaluator::CreateExpression(const nsAString & aExpression,
         return NS_ERROR_DOM_INVALID_EXPRESSION_ERR;
     }
 
-    *aResult = new nsXPathExpression(expression, mRecycler);
+    nsCOMPtr<nsIDOMDocument> document = do_QueryReferent(mDocument);
+
+    *aResult = new nsXPathExpression(expression, mRecycler, document);
     if (!*aResult) {
         return NS_ERROR_OUT_OF_MEMORY;
     }

content/xslt/src/xpath/nsXPathExpression.cpp

@@ -59,9 +59,11 @@ NS_INTERFACE_MAP_BEGIN(nsXPathExpression)
 NS_INTERFACE_MAP_END
 
 nsXPathExpression::nsXPathExpression(nsAutoPtr<Expr>& aExpression,
-                                     txResultRecycler* aRecycler)
+                                     txResultRecycler* aRecycler,
+                                     nsIDOMDocument *aDocument)
     : mExpression(aExpression),
-      mRecycler(aRecycler)
+      mRecycler(aRecycler),
+      mDocument(aDocument)
 {
 }
 
@@ -94,6 +96,13 @@ nsXPathExpression::EvaluateWithContext(nsIDOMNode *aContextNode,
     if (!nsContentUtils::CanCallerAccess(aContextNode))
         return NS_ERROR_DOM_SECURITY_ERR;
 
+    nsCOMPtr<nsIDOMDocument> contextDocument;
+    aContextNode->GetOwnerDocument(getter_AddRefs(contextDocument));
+
+    if (mDocument && mDocument != contextDocument) {
+        return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
+    }
+
     nsresult rv;
     PRUint16 nodeType;
     rv = aContextNode->GetNodeType(&nodeType);

content/xslt/src/xpath/nsXPathExpression.h

@@ -55,8 +55,8 @@ class nsXPathExpression : public nsIDOMXPathExpression,
                           public nsIDOMNSXPathExpression
 {
 public:
-    nsXPathExpression(nsAutoPtr<Expr>& aExpression,
-                      txResultRecycler* aRecycler);
+    nsXPathExpression(nsAutoPtr<Expr>& aExpression, txResultRecycler* aRecycler,
+                      nsIDOMDocument *aDocument);
     virtual ~nsXPathExpression();
 
     // nsISupports interface
@@ -71,6 +71,7 @@ public:
 private:
     nsAutoPtr<Expr> mExpression;
     nsRefPtr<txResultRecycler> mRecycler;
+    nsCOMPtr<nsIDOMDocument> mDocument;
 
     class EvalContextImpl : public txIEvalContext
     {