1751250 - console.log(new(new Proxy(XPCNativeWrapper,{}))(1)) inside content script crashes tab

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[BZZZZ]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0

Steps to reproduce:

1. install greasemonkey: https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/
2. create new greasemonkey script
3. paste console.log(new(new Proxy(XPCNativeWrapper,{}))(1)) into userscript
4. visit web page like http://example.com/

Actual results:

Gah. Your tab just crashed.

Expected results:

1 apppears in devtools console (behaves same as console.log(new XPCNativeWrapper(1)))

question:
constructors can't return non-objects in javascript:

var A=new Proxy(function(){},{
"construct":function(){
return 1
}
})
var B=function(){
return 1
}
new A() //Uncaught TypeError: proxy [[Construct]] must return an object
new B() //Object {  }

why does new XPCNativeWrapper(1) return number instead of object?

also XPCNativeWrapper works without new

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'DevTools::Console' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[BZZZZ]

(In reply to Release mgmt bot [:marco/ :calixte] from comment #1)

The Bugbug bot thinks this bug should belong to the 'DevTools::Console' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

this is not devtools console bug

Comment 3

[Tom S. (please needinfo tschuster)]

Attachment: Bug 1751250 - XPCNativeWrapper should throw for non-objects when constructing. r?mccr8

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b2dbe751ec78
XPCNativeWrapper should throw for non-objects when constructing. r=mccr8

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/b2dbe751ec78

Comment 6

[Ciprian Georgiu, Desktop QA]

I've reproduced this bug using an affected Nightly build, and using the STR from comment 0.

The crash no longer occurs on a fixed build, Beta 98.0b9, under macOS 11, Win 10 x64 and Ubuntu 18.04 x64.