Fixing bug 313373. Pass *vp through untouched to the checkAccess hook when checking for write access. r=mrbkap@gmail.com, sr=brendan@mozilla.org

caps/src/nsScriptSecurityManager.cpp

@@ -466,6 +466,8 @@ nsScriptSecurityManager::CheckObjectAccess(JSContext *cx, JSObject *obj,
     // Pass the parent object's class name, as we have no class-info for it.
     nsresult rv =
         ssm->CheckPropertyAccess(cx, target, JS_GetClass(cx, obj)->name, id,
+                                 (mode & JSACC_WRITE) ?
+                                 nsIXPCSecurityManager::ACCESS_SET_PROPERTY :
                                  nsIXPCSecurityManager::ACCESS_GET_PROPERTY);
 
     if (NS_FAILED(rv))

js/src/jsobj.c

@@ -3549,13 +3549,15 @@ js_CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
         return OBJ_CHECK_ACCESS(cx, pobj, id, mode, vp, attrsp);
     }
     sprop = (JSScopeProperty *)prop;
-    *vp = (SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(pobj)))
-          ? LOCKED_OBJ_GET_SLOT(pobj, sprop->slot)
-          : ((mode & JSACC_WATCH) == JSACC_PROTO)
-          ? LOCKED_OBJ_GET_SLOT(obj, JSSLOT_PROTO)
-          : (mode == JSACC_PARENT)
-          ? LOCKED_OBJ_GET_SLOT(obj, JSSLOT_PARENT)
-          : JSVAL_VOID;
+    if (!(mode & JSACC_WRITE)) {
+        *vp = (SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(pobj)))
+            ? LOCKED_OBJ_GET_SLOT(pobj, sprop->slot)
+            : ((mode & JSACC_WATCH) == JSACC_PROTO)
+            ? LOCKED_OBJ_GET_SLOT(obj, JSSLOT_PROTO)
+            : (mode == JSACC_PARENT)
+            ? LOCKED_OBJ_GET_SLOT(obj, JSSLOT_PARENT)
+            : JSVAL_VOID;
+    }
     *attrsp = sprop->attrs;
 
     /*
@@ -3856,13 +3858,12 @@ static JSBool
 CheckCtorSetAccess(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
 {
     JSAtom *atom;
-    jsval oldval;
     uintN attrs;
 
     atom = cx->runtime->atomState.constructorAtom;
     JS_ASSERT(id == ATOM_KEY(atom));
     return OBJ_CHECK_ACCESS(cx, obj, ATOM_TO_JSID(atom), JSACC_WRITE,
-                            &oldval, &attrs);
+                            vp, &attrs);
 }
 
 JSBool