Bug 1107443 part 3. Stop defining non-configurable properties on the window in xpconnect sandbox code. r=peterv,jorendorff

js/src/jsobj.cpp

@@ -1639,7 +1639,8 @@ JSObject::nonNativeSetElement(JSContext *cx, HandleObject obj, HandleObject rece
 
 JS_FRIEND_API(bool)
 JS_CopyPropertyFrom(JSContext *cx, HandleId id, HandleObject target,
-                    HandleObject obj)
+                    HandleObject obj,
+                    PropertyCopyBehavior copyBehavior)
 {
     // |obj| and |cx| are generally not same-compartment with |target| here.
     assertSameCompartment(cx, obj, id);
@@ -1655,6 +1656,11 @@ JS_CopyPropertyFrom(JSContext *cx, HandleId id, HandleObject target,
     if (desc.setter() && !desc.hasSetterObject())
         return true;
 
+    if (copyBehavior == MakeNonConfigurableIntoConfigurable) {
+        // Mask off the JSPROP_PERMANENT bit.
+        desc.attributesRef() &= ~JSPROP_PERMANENT;
+    }
+
     JSAutoCompartment ac(cx, target);
     RootedId wrappedId(cx, id);
     if (!cx->compartment()->wrap(cx, &desc))