Auto merge of #11511 - Ms2ger:jsurl-crash, r=nox

Add a missing JSAutoCompartment to javascript url handling.

- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] There are tests for these changes OR

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/11511)
<!-- Reviewable:end -->

2 files changed, 7 insertions, 2 deletions

diff --git a/components/script/script_thread.rs b/components/script/script_thread.rs
index 9ee604ba2e7..a1e563d23d1 100644
--- a/components/script/script_thread.rs
+++ b/components/script/script_thread.rs
@@ -30,6 +30,7 @@ use dom::bindings::inheritance::Castable;
 use dom::bindings::js::{JS, MutNullableHeap, Root, RootCollection};
 use dom::bindings::js::{RootCollectionPtr, RootedReference};
 use dom::bindings::refcounted::{LiveDOMReferences, Trusted};
+use dom::bindings::reflector::Reflectable;
 use dom::bindings::str::DOMString;
 use dom::bindings::trace::JSTraceable;
 use dom::bindings::utils::WRAP_CALLBACKS;
@@ -54,7 +55,8 @@ use ipc_channel::ipc::{self, IpcSender};
 use ipc_channel::router::ROUTER;
 use js::glue::GetWindowProxyClass;
 use js::jsapi::{DOMProxyShadowsResult, HandleId, HandleObject, RootedValue};
-use js::jsapi::{JSContext, JS_SetWrapObjectCallbacks, JSTracer, SetWindowProxyClass};
+use js::jsapi::{JSAutoCompartment, JSContext, JS_SetWrapObjectCallbacks};
+use js::jsapi::{JSTracer, SetWindowProxyClass};
 use js::jsval::UndefinedValue;
 use js::rust::Runtime;
 use layout_interface::{self, NewLayoutThreadInfo, ReflowQueryType};
@@ -1599,6 +1601,7 @@ impl ScriptThread {
 
             // Script source is ready to be evaluated (11.)
             unsafe {
+                let _ac = JSAutoCompartment::new(self.get_cx(), window.reflector().get_jsobject().get());
                 let mut jsval = RootedValue::new(self.get_cx(), UndefinedValue());
                 window.evaluate_js_on_global_with_result(&script_source, jsval.handle_mut());
                 let strval = DOMString::from_jsval(self.get_cx(),
diff --git a/tests/wpt/metadata/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling.html.ini b/tests/wpt/metadata/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling.html.ini
index 0231fdf6cad..9320b509b99 100644
--- a/tests/wpt/metadata/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling.html.ini
+++ b/tests/wpt/metadata/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling.html.ini
@@ -1,3 +1,5 @@
 [javascript-url-return-value-handling.html]
   type: testharness
-  expected: CRASH
+  [Test that javascript: evaluation only performs a navigation to the\n  result when the result is a string value.]
+    expected: FAIL
+