Bug 641342 - Treat chrome DOM objects like DOM objects. r=gal/jst

--HG--
extra : rebase_source : 6df8538f4f06a6cbe2b56943937a0f9430ee80ec

js/src/xpconnect/wrappers/WrapperFactory.cpp

@@ -279,8 +279,23 @@ WrapperFactory::Rewrap(JSContext *cx, JSObject *obj, JSObject *wrappedProto, JSO
                 return nsnull;
             }
         }
-        wrapper = &FilteringWrapper<JSCrossCompartmentWrapper,
-                                    ExposedPropertiesOnly>::singleton;
+
+        JSObject *inner = obj;
+        OBJ_TO_INNER_OBJECT(cx, inner);
+        XPCWrappedNative *wn;
+        if (IS_WN_WRAPPER(inner) &&
+            (wn = static_cast<XPCWrappedNative *>(inner->getPrivate()))->HasProto() &&
+            wn->GetProto()->ClassIsDOMObject()) {
+            typedef XrayWrapper<JSCrossCompartmentWrapper> Xray;
+            wrapper = &FilteringWrapper<Xray,
+                                        CrossOriginAccessiblePropertiesOnly>::singleton;
+            xrayHolder = Xray::createHolder(cx, obj, parent);
+            if (!xrayHolder)
+                return nsnull;
+        } else {
+            wrapper = &FilteringWrapper<JSCrossCompartmentWrapper,
+                                        ExposedPropertiesOnly>::singleton;
+        }
     } else if (AccessCheck::isSameOrigin(origin, target)) {
         // Same origin we use a transparent wrapper, unless the compartment asks
         // for an Xray or the wrapper needs a SOW.
@@ -317,7 +332,7 @@ WrapperFactory::Rewrap(JSContext *cx, JSObject *obj, JSObject *wrappedProto, JSO
                 wrapper = &FilteringWrapper<Xray,
                     SameOriginOrCrossOriginAccessiblePropertiesOnly>::singleton;
             } else {
-                wrapper= &FilteringWrapper<Xray,
+                wrapper = &FilteringWrapper<Xray,
                     CrossOriginAccessiblePropertiesOnly>::singleton;
             }