303420 - global scope polluter (element by id in global scope) is missing

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[shutdown]

I see no global scope polluter (bug 256932) in recent trunk builds.
This seems to be a regression from bug 296639.

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b4) Gecko/20050803 Firefox/1.0+
data:text/html,<script id=x>alert(x);</script>
  => "Error: x is not defined" in JS console
javascript: alert(window.__proto__.__proto__);
  => alerts "[object Object]"

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b4) Gecko/20050730 Firefox/1.0+
data:text/html,<script id=x>alert(x);</script>
  => alerts "[object HTMLScriptElement]"
javascript: alert(window.__proto__.__proto__);
  => alerts "[object Global Scope Polluter]"

Comment 1

[Brian Ryner (not reading)]

confirmed, the creation of the GlobalScopePolluter is failing.  js_NewObject fails because 
GetClassPrototype returns false.  I think this may be impacting fastback as well.

Comment 2

[Johnny Stenback (:jst)]

Yup, the gsp is busted. I made it work on the splitwindow branch, but I might
have broken it again before it landed on the trunk. Investigating.

Comment 3

[Johnny Stenback (:jst)]

Attachment: Fix.

This was failing because we end up doing a security check in the middle of
installing the global scope polluter, and becasue we do that while setting up a
new inner window we end up doing the security check before the new inner window
has any principals, so the security check fails. This makes us not do security
checks while we're in the middle of the window inintialization by ensuring that
mIsInitialized set set to false during the whole window init function, and also
makes sure that we don't ever use a context that hasn't been fully initalized
(since we won't do security checks in some cases if a context is not
initialized).

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 192039 [details] [diff] [review]
Fix.

r=me

Comment 5

[Brian Ryner (not reading)]

Comment on attachment 192039 [details] [diff] [review]
Fix.

oops, I think I messed up the review flags earlier. sr=me.

Comment 6

[Johnny Stenback (:jst)]

Comment on attachment 192039 [details] [diff] [review]
Fix.

Requesting approval for this regression fix.

Comment 7

[Johnny Stenback (:jst)]

Fixed.

Comment 8

[Johnny Stenback (:jst)]

Fixed on the trunk before we branched for 1.8.