1151586 - [B2G][Add-ons] Multiple add-on scripts should share sandbox

Status: RESOLVED WORKSFORME

(Firefox OS Graveyard :: General, defect)

Description

[Justin D'Arcangelo [:justindarc]]

In a B2G add-on manifest, you can inject multiple scripts like so:

```
  "customizations": [{
    "filter": ".*",
    "scripts": [
      "js/script1.js",
      "js/script2.js",
      "js/script3.js"
    ]
  }],
```

However, the scripts listed in the manifest do not currently share the same sandbox. This makes it impossible to share a global variable between scripts.

Comment 1

[[:fabrice] Fabrice Desré]

So, looking at the current code again and modifying the existing tests, we are doing the right thing currently, ie. one sandbox per (add-on, window) tuple.

I changed https://mxr.mozilla.org/mozilla-central/source/dom/apps/tests/addons/script.js to declare a global variable and it's correctly accessible in script2.js

The only difference with what Justin is using is that the current code does a synchronous loadSubscript. Justin, I think you may experience a race condition during script loading. Can you test with super simple scripts?

Comment 2

[Adrian Aichner [:anaran]]

Does this bug mean that basic script injection works now in b2g nightly build?

Comment 3

[Justin D'Arcangelo [:justindarc]]

(In reply to Fabrice Desré [:fabrice] from comment #1)
> So, looking at the current code again and modifying the existing tests, we
> are doing the right thing currently, ie. one sandbox per (add-on, window)
> tuple.
> 
> I changed
> https://mxr.mozilla.org/mozilla-central/source/dom/apps/tests/addons/script.
> js to declare a global variable and it's correctly accessible in script2.js
> 
> The only difference with what Justin is using is that the current code does
> a synchronous loadSubscript. Justin, I think you may experience a race
> condition during script loading. Can you test with super simple scripts?

Fabrice, it appears that the sandboxing is working properly. I think I've narrowed my issue down to the fact that some AMD wrappers were doing something like: (function(window){ ... })(this);

I've confirmed using super-simple scripts that `window` !== `this` in the outer-most scope:

script1.js
==========
window.a = 'foo';

console.log('[script1.js] window', window);
console.log('[script1.js] window.a', window.a);
console.log('[script1.js] window.b', window.b);
console.log('[script1.js] this', this);
console.log('[script1.js] this.a', this.a);
console.log('[script1.js] this.b', this.b);
console.log('[script1.js] window === this', window === this);

script2.js
==========
window.b = 'bar';

console.log('[script2.js] window', window);
console.log('[script2.js] window.a', window.a);
console.log('[script2.js] window.b', window.b);
console.log('[script2.js] this', this);
console.log('[script2.js] this.a', this.a);
console.log('[script2.js] this.b', this.b);
console.log('[script2.js] window === this', window === this);

RESULT:
I/GeckoConsole( 4669): Content JS LOG: [script1.js] window [object Window] 
I/GeckoConsole( 4669): Content JS LOG: [script1.js] window.a foo 
I/GeckoConsole( 4669): Content JS LOG: [script1.js] window.b  
I/GeckoConsole( 4669): Content JS LOG: [script1.js] this [object Window] 
I/GeckoConsole( 4669): Content JS LOG: [script1.js] this.a foo 
I/GeckoConsole( 4669): Content JS LOG: [script1.js] this.b  
I/GeckoConsole( 4669): Content JS LOG: [script1.js] window === this false 
I/GeckoConsole( 4669): Content JS LOG: [script2.js] window [object Window] 
I/GeckoConsole( 4669): Content JS LOG: [script2.js] window.a foo 
I/GeckoConsole( 4669): Content JS LOG: [script2.js] window.b bar 
I/GeckoConsole( 4669): Content JS LOG: [script2.js] this [object Window] 
I/GeckoConsole( 4669): Content JS LOG: [script2.js] this.a foo 
I/GeckoConsole( 4669): Content JS LOG: [script2.js] this.b bar 
I/GeckoConsole( 4669): Content JS LOG: [script2.js] window === this false

As you can see above, `window.a` defined in script1.js is accessible to script2.js.

Comment 4

[Justin D'Arcangelo [:justindarc]]

(In reply to adrian.aichner from comment #2)
> Does this bug mean that basic script injection works now in b2g nightly
> build?

No, this is on the cypress branch.