Bug 535746 - Make sure that the parent is the right object. r=jst sr=sicking

js/src/xpconnect/src/XPCCrossOriginWrapper.cpp

@@ -352,7 +352,7 @@ WrapObject(JSContext *cx, JSObject *parent, jsval *vp, XPCWrappedNative* wn)
   // Our argument should be a wrapped native object, but the caller may have
   // passed it in as an optimization.
   JSObject *wrappedObj;
-  if (!JSVAL_IS_OBJECT(*vp) ||
+  if (JSVAL_IS_PRIMITIVE(*vp) ||
       !(wrappedObj = JSVAL_TO_OBJECT(*vp)) ||
       STOBJ_GET_CLASS(wrappedObj) == &XOWClass.base) {
     return JS_TRUE;
@@ -558,6 +558,17 @@ XPC_XOW_AddProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     return JS_FALSE;
   }
 
+  if (JSVAL_IS_OBJECT(*vp)) {
+    JSObject *addedObj = JSVAL_TO_OBJECT(*vp);
+    if (STOBJ_GET_CLASS(addedObj) == &XOWClass.base &&
+        STOBJ_GET_PARENT(addedObj) != STOBJ_GET_PARENT(obj)) {
+      *vp = OBJECT_TO_JSVAL(GetWrappedObject(cx, addedObj));
+      if (!WrapObject(cx, STOBJ_GET_PARENT(obj), vp, nsnull)) {
+        return JS_FALSE;
+      }
+    }
+  }
+
   if (HAS_FLAGS(resolving, FLAG_RESOLVING)) {
     // Allow us to define a property on ourselves.
     return JS_TRUE;