Give WindowProxy objects an innerObject hook.

This ensures that UncheckedUnwrap(obj, /* stopAtOuter = */ true) will indeed
stop at the WindowProxy ("outer window", in older SpiderMonkey jargon), which
is necessary to prevent raw Window ("inner window") objects becoming visible
to JavaScript code, or tripping assertions that we don't do that.

1 files changed, 2 insertions, 6 deletions

diff --git a/components/script/dom/browsingcontext.rs b/components/script/dom/browsingcontext.rs
index b63fbaa6fc5..d9b75153a1f 100644
--- a/components/script/dom/browsingcontext.rs
+++ b/components/script/dom/browsingcontext.rs
@@ -12,7 +12,7 @@ use dom::document::Document;
 use dom::element::Element;
 use dom::window::Window;
 use js::JSCLASS_IS_GLOBAL;
-use js::glue::{CreateWrapperProxyHandler, ProxyTraps, WrapperNew};
+use js::glue::{CreateWrapperProxyHandler, ProxyTraps, NewWindowProxy};
 use js::glue::{GetProxyPrivate, SetProxyExtra};
 use js::jsapi::{Handle, JS_ForwardSetPropertyTo, ObjectOpResult, RootedObject, RootedValue};
 use js::jsapi::{HandleId, HandleObject, MutableHandle, MutableHandleValue};
@@ -56,11 +56,7 @@ impl BrowsingContext {
             assert!(((*JS_GetClass(parent.get())).flags & JSCLASS_IS_GLOBAL) != 0);
             let _ac = JSAutoCompartment::new(cx, parent.get());
             let window_proxy = RootedObject::new(cx,
-                                                 WrapperNew(cx,
-                                                            parent,
-                                                            handler,
-                                                            ptr::null(),
-                                                            true));
+                NewWindowProxy(cx, parent, handler));
             assert!(!window_proxy.ptr.is_null());
 
             let object = box BrowsingContext::new_inherited(document, frame_element);