12957 - Setting cookie in www.netscape.com would get security error

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Norris Boyd]

Change mozilla/modules/libpref/src/win/winprefs.js so that security is enabled
by changing the line
/* DISABLE FOR NOW
to
///* DISABLE FOR NOW
and similarly for the comment close. Rebuild so the changed file is copied to
dist.

Start apprunner. Place a breakpoint on the line
    if (NS_FAILED(globalData->GetPrincipal(result))) {
in method
    nsScriptSecurityManager::GetObjectPrincipal
in file mozilla/caps/src/nsScriptSecurityManager.cpp.

Load http://www.netscape.com. You should hit the breakpoint. Continue until you
see SetHTMLDocumentProperty in the call stack.

Examine
{,,NECKO.DLL}*(nsStdURL*){,,RDF.DLL}(((*(XULDocumentImpl*){,,JSDOM.DLL}((*(Globa
lWindowImpl*){*}((globalData).mRawPtr)).mDocument)).mDocumentURL).mRawPtr)

You'll see that the document's url is the navigator.xul file. This causes a
security error because it looks like a script from www.netscape.com is trying to
modify an object in chrome.

Comment 1

[Norris Boyd]

Marking M11 since needed for beta.

Comment 2

[Norris Boyd]

This bug is likely related to 13192, which is a small test case.

Comment 3

[Norris Boyd]

Vidur's changes to fix document parenting have fixed this problem.