Don't resolve things on SJOW's prototype and make toString on it work again. bug 409298, r+sr=jst a=beltzner

js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp

@@ -622,13 +622,6 @@ JS_STATIC_DLL_CALLBACK(JSBool)
 XPC_SJOW_NewResolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
                     JSObject **objp)
 {
-  // No need to resolve toString as it's a class method.
-  if (id == GetRTStringByIndex(cx, XPCJSRuntime::IDX_TO_STRING)) {
-    *objp = obj;
-    return JS_DefineFunction(cx, obj, "toString",
-                             XPC_SJOW_toString, 0, 0) != nsnull;
-  }
-
   obj = FindSafeObject(cx, obj);
   NS_ASSERTION(obj != nsnull, "FindSafeObject() returned null in class hook!");
 
@@ -645,6 +638,13 @@ XPC_SJOW_NewResolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
     return JS_FALSE;
   }
 
+  // Resolve toString specially.
+  if (id == GetRTStringByIndex(cx, XPCJSRuntime::IDX_TO_STRING)) {
+    *objp = obj;
+    return JS_DefineFunction(cx, obj, "toString",
+                             XPC_SJOW_toString, 0, 0) != nsnull;
+  }
+
   return XPCWrapper::NewResolve(cx, obj, unsafeObj, id, flags, objp);
 }
 
@@ -1013,6 +1013,11 @@ XPC_SJOW_AttachNewConstructorObject(XPCCallContext &ccx,
     return PR_FALSE;
   }
 
+  if (!::JS_DefineFunction(ccx, class_obj, "toString", XPC_SJOW_toString,
+                           0, 0)) {
+    return PR_FALSE;
+  }
+
   // Null out the class object's parent to prevent code in this class
   // from thinking the class object is a wrapper for the global
   // object.