Better fix for 296397 (r=shaver, sr=jst).

js/src/jsfun.c

@@ -1081,21 +1081,6 @@ fun_finalize(JSContext *cx, JSObject *obj)
         js_DestroyScript(cx, fun->u.script);
 }
 
-/*
- * Functions are often shared, even across trust domains, in order to amortize
- * scripted function compilation costs across N sharing domains or contexts.
- * If there is a runtime-wide checkObjectAccess callback, invoke it for every
- * function object operation that might cross a trust domain boundary.
- */
-JSBool
-js_SharedCheckAccess(JSContext *cx, JSObject *obj, jsval id, JSAccessMode mode,
-                     jsval *vp)
-{
-    if (!cx->runtime->checkObjectAccess)
-        return JS_TRUE;
-    return cx->runtime->checkObjectAccess(cx, obj, id, mode, vp);
-}
-
 #if JS_HAS_XDR
 
 #include "jsxdrapi.h"

js/src/jsobj.c

@@ -105,7 +105,10 @@ JSClass js_ObjectClass = {
     0,
     JS_PropertyStub,  JS_PropertyStub,  JS_PropertyStub,  JS_PropertyStub,
     JS_EnumerateStub, JS_ResolveStub,   JS_ConvertStub,   JS_FinalizeStub,
-    JSCLASS_NO_OPTIONAL_MEMBERS
+    NULL,             js_SharedCheckAccess,
+    NULL,             NULL,
+    NULL,             NULL,
+    NULL,             NULL
 };
 
 #if JS_HAS_OBJ_PROTO_PROP
@@ -3413,6 +3416,10 @@ js_CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
     sprop = (JSScopeProperty *)prop;
     *vp = (SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(pobj)))
           ? LOCKED_OBJ_GET_SLOT(pobj, sprop->slot)
+          : (mode == JSACC_PROTO)
+          ? LOCKED_OBJ_GET_SLOT(obj, JSSLOT_PROTO)
+          : (mode == JSACC_PARENT)
+          ? LOCKED_OBJ_GET_SLOT(obj, JSSLOT_PARENT)
           : JSVAL_VOID;
     *attrsp = sprop->attrs;
     clasp = LOCKED_OBJ_GET_CLASS(obj);
@@ -3427,6 +3434,15 @@ js_CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
     return ok;
 }
 
+JSBool
+js_SharedCheckAccess(JSContext *cx, JSObject *obj, jsval id, JSAccessMode mode,
+                     jsval *vp)
+{
+    if (!cx->runtime->checkObjectAccess)
+        return JS_TRUE;
+    return cx->runtime->checkObjectAccess(cx, obj, id, mode, vp);
+}
+
 #ifdef JS_THREADSAFE
 void
 js_DropProperty(JSContext *cx, JSObject *obj, JSProperty *prop)

js/src/jsobj.h

@@ -423,6 +423,18 @@ extern JSBool
 js_CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
                jsval *vp, uintN *attrsp);
 
+/*
+ * Functions, their prototype properties, and regular expressions are often
+ * shared, even across trust domains, in order to amortize scripted function
+ * compilation costs across N sharing domains or contexts.  If there is a
+ * runtime-wide checkObjectAccess callback, this JSClass.checkAccess hook
+ * will invoke it for every such shared object operation that might cross a
+ * trust domain boundary.
+ */
+extern JSBool
+js_SharedCheckAccess(JSContext *cx, JSObject *obj, jsval id, JSAccessMode mode,
+                     jsval *vp);
+
 extern JSBool
 js_Call(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval);
 

js/src/jsregexp.c

@@ -3366,15 +3366,6 @@ regexp_finalize(JSContext *cx, JSObject *obj)
     js_DestroyRegExp(cx, re);
 }
 
-/*
- * RegExps are often shared, even across trust domains, in order to amortize
- * scripted regexp compilation costs across N sharing domains or contexts --
- * just as function objects are.  See jsfun.c for the definition of this hook.
- */
-extern JSBool
-js_SharedCheckAccess(JSContext *cx, JSObject *obj, jsval id, JSAccessMode mode,
-                     jsval *vp);
-
 /* Forward static prototype. */
 static JSBool
 regexp_exec(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,