Allow 'this' to not be a wrapped object. bug 390560, r+sr+a=jst

js/src/xpconnect/src/XPCCrossOriginWrapper.cpp

@@ -273,9 +273,18 @@ XPC_XOW_FunctionWrapper(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
 {
   JSObject *wrappedObj, *outerObj = obj;
 
-  obj = GetWrapper(cx, obj);
-  if (!obj || (wrappedObj = GetWrappedObject(cx, obj)) == nsnull) {
-    return ThrowException(NS_ERROR_ILLEGAL_VALUE, cx);
+  // Allow 'this' to be either an XOW, in which case we unwrap it.
+  // We disallow invalid XOWs that have no wrapped object. Otherwise,
+  // if it isn't an XOW, then pass it through as-is.
+
+  wrappedObj = GetWrapper(cx, obj);
+  if (wrappedObj) {
+    wrappedObj = GetWrappedObject(cx, wrappedObj);
+    if (!wrappedObj) {
+      return ThrowException(NS_ERROR_ILLEGAL_VALUE, cx);
+    }
+  } else {
+    wrappedObj = obj;
   }
 
   JSObject *funObj = JSVAL_TO_OBJECT(argv[-2]);