1146556 - sdk/window/utils.js's getInnerId causes unsafe CPOW usage warnings

Status: RESOLVED INCOMPLETE

(Add-on SDK Graveyard :: General, defect, P1)

Description

[Mike Conley (:mconley) (:⚙️)]

/**
 * Returns the ID of the window's current inner window.
 */
function getInnerId(window) {
  return window.QueryInterface(Ci.nsIInterfaceRequestor).
                getInterface(Ci.nsIDOMWindowUtils).currentInnerWindowID; <-- causes unsafe CPOW usage
};

Comment 1

[Dave Townsend [:mossop]]

Again, it's the caller that is important here.

Comment 2

[Mike Conley (:mconley) (:⚙️)]

(In reply to Dave Townsend [:mossop] from comment #1)
> Again, it's the caller that is important here.

I don't think I understand. There are several callers to this function, all of which (in an e10s browser) will cause unsafe CPOW usage:

https://dxr.mozilla.org/mozilla-central/search?tree=mozilla-central&q=getInnerId&redirect=true

Is there something more specific you're looking for?

Comment 3

[Dave Townsend [:mossop]]

(In reply to Mike Conley (:mconley) - Needinfo me! from comment #2)
> (In reply to Dave Townsend [:mossop] from comment #1)
> > Again, it's the caller that is important here.
> 
> I don't think I understand. There are several callers to this function, all
> of which (in an e10s browser) will cause unsafe CPOW usage:
> 
> https://dxr.mozilla.org/mozilla-central/search?tree=mozilla-
> central&q=getInnerId&redirect=true

Most of these are in code that runs in the content process and so shouldn't be triggering warnings like this.

> Is there something more specific you're looking for?

Yes I'm looking for cases where this actually causes the unsafe CPOW warning. I have no doubt there are some and you've seen them but it would save me the time of searching for it.

Comment 4

[Mike Conley (:mconley) (:⚙️)]

Ah, I see - alright. That makes sense.

This flurry of bug filing you're seeing is the result of mining the test run logs of Holly, looking for the unsafe CPOW usage warning string.

I see this being triggered whenever the l10n/main.testHtmlLocalization test is running. So, assuming no log message ordering foul-ups, it should be reproducible by running that test.

Comment 5

[Mike Conley (:mconley) (:⚙️)]

This module and method can be called from the main browser process by SDK code or add-ons, and is not cpow-safe.

Comment 6

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1399562