Ticket #2241: Patch_Spidermonkey_1.8.5_clone_wrappers_v0.1.diff

js/src/jsclone.cpp

@@ -40 +40 @@
 #include "jsdate.h"
 #include "jsregexp.h"
 #include "jstypedarray.h"
+#include "jswrapper.h"
 
 #include "jsregexpinlines.h"
 
@@ -503 +504 @@
 bool
 JSStructuredCloneWriter::startWrite(const js::Value &v)
 {
+    assertSameCompartment(context(), v);
+
     if (v.isString()) {
         return writeString(SCTAG_STRING, v.toString());
     } else if (v.isNumber()) {
@@ -515 +518 @@
         return out.writePair(SCTAG_UNDEFINED, 0);
     } else if (v.isObject()) {
         JSObject *obj = &v.toObject();
+
+        // The object might be a security wrapper. See if we can clone what's
+        // behind it. If we can, unwrap the object.
+        obj = JS_UnwrapObject(context(), obj);
+        if (!obj)
+            return false;
+
+        // If we unwrapped above, we'll need to enter the underlying compartment.
+        // Let the AutoEnterCompartment do the right thing for us.
+        JSAutoEnterCompartment ac;
+        if (!ac.enter(context(), obj))
+            return false;
+
         if (obj->isRegExp()) {
             RegExp *re = RegExp::extractFrom(obj);
             return out.writePair(SCTAG_REGEXP_OBJECT, re->getFlags()) &&
@@ -554 +570 @@
 
     while (!counts.empty()) {
         JSObject *obj = &objs.back().toObject();
+
+        // The objects in |obj| can live in other compartments.
+        JSAutoEnterCompartment ac;
+        if (!ac.enter(context(), obj))
+            return false;
+
         if (counts.back()) {
             counts.back()--;
             jsid id = ids.back();