138295 - XML Loading on Mac fails on .childNodes of non-root nodes

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Andy Edmonds]

Expected behavior:
Text box contains 4 rolodex nodes (works on windows)

Observed behavior on Mac OS9/OSX:
Error: [Exception... "'Permission denied to get property NodeList.length' when
calling method: [nsIDOMEventListener::handleEvent]" nsresult: "0x8057001e
(NS_ERROR_XPC_JS_THREW_STRING)" location: "" data: no]

Comment 1

[Rakesh Mishra]

changing Q/A contact

Comment 2

[Heikki Toivonen (remove -bugzilla when emailing directly)]

This is bizarre, works on latest Windows mozilla build, but I get the error
using Mac OSX build from last week or something...

I don't think XML is the correct component, reassigning to DOM Core and adding
mstoltz as this is security related.

Comment 3

[Peter Van der Beken [:peterv]]

I've seen other failures like this one on OS 9 too.

Comment 4

[Heikki Toivonen (remove -bugzilla when emailing directly)]

We need to check this out, we can't ship if simple DOM operations won't work on
the Mac.

Could we get the testcase in normal HTML to see if it happens in XML only (doubt
it)?

Comment 5

[Andy Edmonds]

I'll craft a XML-free test case, but I've got XBL that loops over childNodes on 
the Mac successfully (http://surfmind.com/musings/categories/mozilla/).

Comment 6

[Andy Edmonds]

Attachment: XML free .childNodes iteration, works fine on Mac OS9.

ML free .childNodes iteration, works fine on Mac OS9.

This does seem to be an issue with XML load as opposed to general Mac DOM
operations.  Email me directly if there's a further testcase which would help.

Comment 7

[Peter Van der Beken [:peterv]]

Attachment: Testcase (xml file, loaded by the html through document.load)

Comment 8

[Peter Van der Beken [:peterv]]

Attachment: Testcase (html file)

Comment 9

[Peter Van der Beken [:peterv]]

Ok, so when opening attachment 80932 [details] on Mac I get an exception "Permission
denied to get property NodeList.length", while on Windows and Linux accessing
.length just gives the right value (0). I have no idea what is going on here.
I'm adding the XPConnect folks too, right now I'm stuck and I could use some
hints on how to debug this.

Comment 10

[Peter Van der Beken [:peterv]]

Ok, so with dbradley's help I tracked this down a bit. It seems that the
security check to get .length fails in CheckSameOrigin. Mitch, any idea why this
would fail on Mac only?

Comment 11

[Laurens van den Oever]

We have similar problems when using code like:

var xpe = new XPathEvaluator();
var nsRes = xpe.createNSResolver(xmlNode); // Permission denied exception
var result = xpe.evaluate(xpath, xmlNode, 
                        null, null, null); // Permission denied exception

Maybe there is a problem with the eventhandler and is the xmlDoc not yet loaded?

Comment 12

[selmer (gone)]

What's the current status of this bug?  (No comments for a VERY long time...)

Comment 13

[Mitchell Stoltz (not reading bugmail)]

I'm looking at it now. ETA 6/20.

Comment 14

[Peter Van der Beken [:peterv]]

Jst and I have debugged this and I have a patch almost ready.

Comment 15

[Mitchell Stoltz (not reading bugmail)]

What was the problem? And why did it only affect the Mac?

Comment 16

[Mitchell Stoltz (not reading bugmail)]

OK, sounds like peterv has a fix for the trunk, but it won't work for the branch
because it depends on some major API changes that have landed on the trunk
recently. jst thinks we can get by without this fix for Moz1.0.1, but I'm going
to reassign this to peterv and let him make the final call. If this is not a
stop-ship, please remove the nsbeta1+.

Comment 17

[Jaime Rodriguez, Jr.]

makring as nsbeta1-, and lowering ADT impact to ADT2 per Comment #16 From
Mitchell Stoltz. let's see if we can't get this on a future release.

Comment 18

[Peter Van der Beken [:peterv]]

Attachment: Patch

This fixes it for me. Not sure if there are other place where we need a similar
fix. The problem is that we were using the safe context when calling the event
handler and the safe context comes from the hidden window (and on Mac the
hidden window probably contains a document with a chrome URI).

Comment 19

[Johnny Stenback (:jst)]

Comment on attachment 88885 [details] [diff] [review]
Patch

nsContentUtils::GetDocshellFromGlobalObject needs to be renamed to something
like GetCurrentDOMWindow() and changed to return the DOM window off the current
JS context.
- In nsXMLDocument.cpp:

+    nsCOMPtr<nsIScriptGlobalObjectOwner> container =
+	 do_QueryReferent(mDocumentContainer);

Sigh, 4-space indentation! :-)

sr=jst if you fix that.

Comment 20

[Peter Van der Beken [:peterv]]

Attachment: Patch

Updated to trunk and renamed method.

Comment 21

[Peter Van der Beken [:peterv]]

Comment on attachment 91813 [details] [diff] [review]
Patch

Carrying forward jst's sr.

Comment 22

[Mitchell Stoltz (not reading bugmail)]

Comment on attachment 91813 [details] [diff] [review]
Patch

Would there be any performance benefit to keeping a reference to the
JSContextStack service across multiple iterations of this code?

r=mstoltz whether or not you do this.

Comment 23

[Peter Van der Beken [:peterv]]

Attachment: Patch

Changed to cache context stack.

Comment 24

[Peter Van der Beken [:peterv]]

Comment on attachment 94019 [details] [diff] [review]
Patch

Carrying forward r and sr.

Comment 25

[Johnny Stenback (:jst)]

There's now (as of a few weeks ago) an nsCxPusher class in
nsEventListenerManager.h, maybe you could move that to nsContentUtils and use
that in nsXMLDocument?

Either way, my sr= still stands.

Comment 26

[Peter Van der Beken [:peterv]]

Attachment: Patch

Comment 27

[Johnny Stenback (:jst)]

Comment on attachment 94451 [details] [diff] [review]
Patch

- In nsXMLDocument.cpp:

+
+    nsCOMPtr<nsIJSContextStack> stack;
+    nsCOMPtr<nsIScriptGlobalObjectOwner> container =
+      do_QueryReferent(mDocumentContainer);
+
+    nsCxPusher pusher(container);
+
     HandleDOMEvent(nsnull, &event, nsnull, NS_EVENT_FLAG_INIT, &status);

I don't see stack being used anywhere, so remove that.

Other than that, sr=jst

Comment 28

[Mitchell Stoltz (not reading bugmail)]

Comment on attachment 94451 [details] [diff] [review]
Patch

Looks good to me. r=mstoltz.

Comment 29

[Peter Van der Beken [:peterv]]

Checked in.

Comment 30

[Conny Svensson]

Can you reopen this bug, it seems to be back again.

I'm getting the same error again on MacOS X 10.3.6.  I'm getting this both in 
Firefox 1.0 and Mozilla 1.8.alpha5. The example provided for this bug, gives me: 
"Error: xmlDoc.childNodes.item(i) has no properties
Source File: http://surfmind.com/lab/moz/bugs/macxml/
Line: 28"

In my own code I still get the original childNodes.length error. And it seems to
be for nodes from level 2 and down. I have tested to create the DOM document
both thru document.load and XMLHTTPRequest, with the same result.

Comment 31

[Peter Van der Beken [:peterv]]

File a new bug if this regressed.