1052096 - Hoist CPOWs into the junk scopes of each process

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Right now, if a CPOW is created in a given compartment, it lives there forever. Whoever else wants it gets a wrapper around it. Bobby pointed out that this is a problem for cross-domain content compartments, where the second compartment won't be able to use the CPOW at all.

We really need to have a separate CPOW in each compartment. This is how other kinds of wrappers work.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: per-comp-cpows

I wrote a patch for this and then tried to test it. However, I can't figure out how to get the test to fail without the patch, so I'm not sure how necessary this is.

Basically, we always receive the "initial" CPOW in some chrome compartment. And, whenever we operate on that CPOW, we'll always enter that chrome compartment to do it. Consequently, any new CPOWs derived from the original one will also be created in the same chrome compartment. So I think the "visibility" problem we were worried about, where a CPOW is created in a content compartment and then unusable by other content compartments, can't happen. Maybe I'm missing something though.

Despite all that, it seems better to have this than not to have it, so we might as well do it.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Oh, one thing this patch doesn't do is to have the PrepareForWrapping hook just make a new CPOW in the new compartment. Let me know if you want that Bobby.

Comment 3

[Bobby Holley (:bholley)]

Comment on attachment 8475566 [details] [diff] [review]
per-comp-cpows

Bill and I decided that we should just require and assert that all CPOWs and all CPOW targets live in the junk scopes (privileged in the child, unprivileged in the parent).

Comment 4

[Bobby Holley (:bholley)]

More specifically:

* Parent->Child CPOWs and their targets should live in the privileged junk scope.
* Child->Parent CPOWs should live in the privileged junk scope, and their target should live in the unprivileged junk scope.

Comment 5

[Bobby Holley (:bholley)]

Taking this, per IRC discussion with billm.

Comment 6

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=a55125234ab0

Comment 7

[Bobby Holley (:bholley)]

Attachment: Part 1 - Move CPOWs into the privileged junk scope. v1

Comment 8

[Bobby Holley (:bholley)]

Attachment: Part 2 - Move CPOW targets into the privileged/unprivileged junk scope of the child/parent. v1

Comment 9

[Bobby Holley (:bholley)]

Attachment: Part 3 - Add an API to access the 'Location' string (used by memory reporters) of a compartment. v1

Comment 10

[Bobby Holley (:bholley)]

Attachment: Part 4 - Tests. v1

Comment 11

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 8488446 [details] [diff] [review]
Part 4 - Tests. v1

Review of attachment 8488446 [details] [diff] [review]:
-----------------------------------------------------------------

Looks great! Thanks again.

Comment 12

[Bobby Holley (:bholley)]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/91520b12f0dc
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/71c10a155c9c
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/cdf9ce8f6228
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/727ee6032c7a

Comment 13

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/91520b12f0dc
https://hg.mozilla.org/mozilla-central/rev/71c10a155c9c
https://hg.mozilla.org/mozilla-central/rev/cdf9ce8f6228
https://hg.mozilla.org/mozilla-central/rev/727ee6032c7a