diff --git a/mozilla/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp b/mozilla/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp index 0d9e45bdc70..f53fde3b7da 100644 --- a/mozilla/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp +++ b/mozilla/js/src/xpconnect/src/XPCCrossOriginWrapper.cpp @@ -273,9 +273,18 @@ XPC_XOW_FunctionWrapper(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, { JSObject *wrappedObj, *outerObj = obj; - obj = GetWrapper(cx, obj); - if (!obj || (wrappedObj = GetWrappedObject(cx, obj)) == nsnull) { - return ThrowException(NS_ERROR_ILLEGAL_VALUE, cx); + // Allow 'this' to be either an XOW, in which case we unwrap it. + // We disallow invalid XOWs that have no wrapped object. Otherwise, + // if it isn't an XOW, then pass it through as-is. + + wrappedObj = GetWrapper(cx, obj); + if (wrappedObj) { + wrappedObj = GetWrappedObject(cx, wrappedObj); + if (!wrappedObj) { + return ThrowException(NS_ERROR_ILLEGAL_VALUE, cx); + } + } else { + wrappedObj = obj; } JSObject *funObj = JSVAL_TO_OBJECT(argv[-2]);