Don't use the global object as the scope object when setting up the class for

the proto functions on the a binding.  Patch arises from discussion in bug
258832, r+sr=brendan

content/xbl/src/nsXBLBinding.cpp

@@ -1081,26 +1081,29 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
   JSObject* proto;
 
   nsCAutoString className(aClassName);
-  // Retrieve the current prototype of obj.
-  JSObject* parent_proto = ::JS_GetPrototype(cx, obj);
-  if (parent_proto) {
-    // We need to create a unique classname based on aClassName and
-    // parent_proto.  Append a space (an invalid URI character) to ensure that
-    // we don't have accidental collisions with the case when parent_proto is
-    // null and aClassName ends in some bizarre numbers (yeah, it's unlikely).
-    jsid parent_proto_id;
-    if (!::JS_GetObjectId(cx, parent_proto, &parent_proto_id)) {
-      // Probably OOM
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
+  JSObject* parent_proto = nsnull;  // If we have an "obj" we can set this
+  if (obj) {
+    // Retrieve the current prototype of obj.
+    parent_proto = ::JS_GetPrototype(cx, obj);
+    if (parent_proto) {
+      // We need to create a unique classname based on aClassName and
+      // parent_proto.  Append a space (an invalid URI character) to ensure that
+      // we don't have accidental collisions with the case when parent_proto is
+      // null and aClassName ends in some bizarre numbers (yeah, it's unlikely).
+      jsid parent_proto_id;
+      if (!::JS_GetObjectId(cx, parent_proto, &parent_proto_id)) {
+        // Probably OOM
+        return NS_ERROR_OUT_OF_MEMORY;
+      }
 
-    // One space, maybe "0x", at most 16 chars (on a 64-bit system) of long,
-    // and a null-terminator (which PR_snprintf ensures is there even if the
-    // string representation of what we're printing does not fit in the buffer
-    // provided).
-    char buf[20];
-    PR_snprintf(buf, sizeof(buf), " %lx", parent_proto_id);
-    className.Append(buf);
+      // One space, maybe "0x", at most 16 chars (on a 64-bit system) of long,
+      // and a null-terminator (which PR_snprintf ensures is there even if the
+      // string representation of what we're printing does not fit in the buffer
+      // provided).
+      char buf[20];
+      PR_snprintf(buf, sizeof(buf), " %lx", parent_proto_id);
+      className.Append(buf);
+    }
   }
 
   if ((!::JS_LookupPropertyWithFlags(cx, global, className.get(),
@@ -1181,9 +1184,11 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JSObject *global, JSObject *obj,
     proto = JSVAL_TO_OBJECT(val);
   }
 
-  // Set the prototype of our object to be the new class.
-  if (!::JS_SetPrototype(cx, obj, proto)) {
-    return NS_ERROR_FAILURE;
+  if (obj) {
+    // Set the prototype of our object to be the new class.
+    if (!::JS_SetPrototype(cx, obj, proto)) {
+      return NS_ERROR_FAILURE;
+    }
   }
 
   return NS_OK;

content/xbl/src/nsXBLProtoImpl.cpp

@@ -152,8 +152,7 @@ nsXBLProtoImpl::CompilePrototypeMembers(nsXBLPrototypeBinding* aBinding)
   nsIScriptContext *context = globalObject->GetContext();
 
   void* classObject;
-  JSObject* scopeObject = globalObject->GetGlobalJSObject();
-  nsresult rv = aBinding->InitClass(mClassName, context, scopeObject, &classObject);
+  nsresult rv = aBinding->InitClass(mClassName, context, nsnull, &classObject);
   if (NS_FAILED(rv))
     return rv;