Bug 718202. r=jst.

--HG--
extra : transplant_source : %1En%B7%8CN%F4kl%A8%3D%8C%8A%99%9A%10%F7%F4o%01l

dom/workers/EventTarget.cpp

@@ -42,6 +42,11 @@
 #include "jsfriendapi.h"
 #include "nsTraceRefcnt.h"
 
+// All the EventTarget subclasses have to be included here.
+#include "Worker.h"
+#include "WorkerScope.h"
+#include "XMLHttpRequest.h"
+
 #include "WorkerInlines.h"
 
 USING_WORKERS_NAMESPACE
@@ -63,6 +68,23 @@ DECL_EVENTTARGET_CLASS(gMainThreadClass, "WorkerEventTarget")
 
 #undef DECL_EVENTTARGET_CLASS
 
+inline
+bool
+EnsureObjectIsEventTarget(JSContext* aCx, JSObject* aObj, char* aFunctionName)
+{
+  JSClass* classPtr = JS_GET_CLASS(aCx, aObj);
+  if (classPtr &&
+      (ClassIsWorker(classPtr) || ClassIsWorkerGlobalScope(classPtr) ||
+       ClassIsXMLHttpRequest(classPtr))) {
+    return true;
+  }
+
+  JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_INCOMPATIBLE_PROTO,
+                       "EventTarget", aFunctionName,
+                        classPtr ? classPtr->name : "object");
+  return false;
+}
+
 inline
 EventTarget*
 GetPrivate(JSContext* aCx, JSObject* aObj)
@@ -143,6 +165,10 @@ EventTarget::AddEventListener(JSContext* aCx, uintN aArgc, jsval* aVp)
     return true;
   }
 
+  if (!EnsureObjectIsEventTarget(aCx, obj, "AddEventListener")) {
+    return false;
+  }
+
   EventTarget* self = GetPrivate(aCx, obj);
   if (!self) {
     return true;
@@ -174,6 +200,10 @@ EventTarget::RemoveEventListener(JSContext* aCx, uintN aArgc, jsval* aVp)
     return true;
   }
 
+  if (!EnsureObjectIsEventTarget(aCx, obj, "RemoveEventListener")) {
+    return false;
+  }
+
   EventTarget* self = GetPrivate(aCx, obj);
   if (!self) {
     return true;
@@ -205,6 +235,10 @@ EventTarget::DispatchEvent(JSContext* aCx, uintN aArgc, jsval* aVp)
     return true;
   }
 
+  if (!EnsureObjectIsEventTarget(aCx, obj, "DispatchEvent")) {
+    return false;
+  }
+
   EventTarget* self = GetPrivate(aCx, obj);
   if (!self) {
     return true;

dom/workers/EventTarget.h

@@ -47,6 +47,8 @@ BEGIN_WORKERS_NAMESPACE
 
 namespace events {
 
+// If you inherit this class then you need to add some way to compare the
+// JSClass for your subclass in EnsureObjectIsEventTarget().
 class EventTarget : public PrivatizableBase
 {
   ListenerManager mListenerManager;

dom/workers/Worker.cpp

@@ -499,4 +499,10 @@ InitClass(JSContext* aCx, JSObject* aGlobal, JSObject* aProto,
 
 } // namespace chromeworker
 
+bool
+ClassIsWorker(JSClass* aClass)
+{
+  return Worker::Class() == aClass || ChromeWorker::Class() == aClass;
+}
+
 END_WORKERS_NAMESPACE

dom/workers/Worker.h

@@ -64,6 +64,9 @@ InitClass(JSContext* aCx, JSObject* aGlobal, JSObject* aProto,
 
 } // namespace chromeworker
 
+bool
+ClassIsWorker(JSClass* aClass);
+
 END_WORKERS_NAMESPACE
 
 #endif /* mozilla_dom_workers_worker_h__ */

dom/workers/WorkerScope.cpp

@@ -937,4 +937,11 @@ CreateDedicatedWorkerGlobalScope(JSContext* aCx)
   return global;
 }
 
+bool
+ClassIsWorkerGlobalScope(JSClass* aClass)
+{
+  return WorkerGlobalScope::Class() == aClass ||
+         DedicatedWorkerGlobalScope::Class() == aClass;
+}
+
 END_WORKERS_NAMESPACE

dom/workers/WorkerScope.h

@@ -48,6 +48,9 @@ BEGIN_WORKERS_NAMESPACE
 JSObject*
 CreateDedicatedWorkerGlobalScope(JSContext* aCx);
 
+bool
+ClassIsWorkerGlobalScope(JSClass* aClass);
+
 END_WORKERS_NAMESPACE
 
 #endif /* mozilla_dom_workers_workerscope_h__ */

dom/workers/XMLHttpRequest.cpp

@@ -929,4 +929,11 @@ UpdateXHRState(JSContext* aCx, JSObject* aObj, bool aIsUpload,
 
 } // namespace xhr
 
+bool
+ClassIsXMLHttpRequest(JSClass* aClass)
+{
+  return XMLHttpRequest::Class() == aClass ||
+         XMLHttpRequestUpload::Class() == aClass;
+}
+
 END_WORKERS_NAMESPACE

dom/workers/XMLHttpRequest.h

@@ -70,6 +70,9 @@ UpdateXHRState(JSContext* aCx, JSObject* aObj, bool aIsUpload,
 
 } // namespace xhr
 
+bool
+ClassIsXMLHttpRequest(JSClass* aClass);
+
 END_WORKERS_NAMESPACE
 
 #endif /* mozilla_dom_workers_xmlhttprequest_h__ */