1465602 - Exposure checks in toJSON implementations aren't quite right

Status: RESOLVED FIXED

(Core :: DOM: Bindings (WebIDL), enhancement)

Description

[Boris Zbarsky [:bzbarsky]]

They pass the "this" value of the toJSON call to Prefable::isEnabled.  That's wrong when that value is a cross-compartment wrapper, especially an Xray.  We should be passing the unwrapped version instead.

Comment 1

[Boris Zbarsky [:bzbarsky]]

I will write a patch for this in a bit.  I need to write a bunch of tests first.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: part 1. Enforce that the default toJSON can only return 'object'

The spec says:

  The return type of the default toJSON operation must be object.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: part 2. Fix the interaction of default toJSON with Func-controlled exposure that examines the object's global

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: part 2. Fix the interaction of default toJSON with Func-controlled exposure that examines the object's global

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/916e5914d84a
part 1.  Enforce that the default toJSON can only return 'object'.  r=qdot
https://hg.mozilla.org/integration/mozilla-inbound/rev/7c76daa75842
part 2.  Fix the interaction of default toJSON with Func-controlled exposure that examines the object's global.  r=qdot

Comment 6

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/916e5914d84a
https://hg.mozilla.org/mozilla-central/rev/7c76daa75842