CVE-2005-1937

A remote attacker crafts a page that attempts a targeted load into a named frame of another site. Because the JS context is pushed onto the stack too early (due to the bug 289204 change), `nsDocShell::ValidateOrigin` obtains a non-null principal and `IsCapabilityEnabled` returns `PR_TRUE` when no stack frame exists, granting `UniversalBrowserWrite` permission. This bypasses the origin check and allows the attacker to inject arbitrary JavaScript into the victim site's frameset [ref_id=1].

The regression was introduced by bug 289204 and affects `nsGlobalWindow::OpenInternal()` and `nsWindowWatcher::OpenWindowJS()` in `mozilla/dom/src/base/nsGlobalWindow.cpp` and `mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp`. The fix moves the JS context pushing code from `nsGlobalWindow::OpenInternal()` into the windowwatcher code that does the actual opening, delaying the push until after the search for an existing named window completes [ref_id=1].

The patch moves the JS context pushing code from `nsGlobalWindow::OpenInternal()` into the windowwatcher code that does the actual opening. By delaying the push of the callee window's context onto the stack until after the search for an existing named window completes, `IsCapabilityEnabled` no longer sees a JSContext during the origin validation step and correctly returns `PR_FALSE`, restoring the intended security check [ref_id=1].