2064277 - UrlbarChild hands parent-sent payloads to content without cloning them into its realm

Status: RESOLVED FIXED

(Firefox :: Address Bar, defect)

Description

[Dão Gottwald [:dao]]

UrlbarChild's dispatches into the child controller -- #updateEngineStore, #invokeContentAction, #receiveNotify -- waive Xrays on the controller so its methods are callable, but pass the message payload through unchanged. That payload is a structured clone living in the actor's system realm, so a content-realm <moz-urlbar> sees an Xray over it, and an Xray over a chrome array denies Symbol.iterator. Iterating the engine-store snapshot therefore throws "Permission denied to access property Symbol.iterator".

The port's returns already handle this: sendQuery, getFixupPrimitives and getPref all Cu.cloneInto(..., win). Only the parent-to-child dispatches were missed.

#receiveNotify needs more than a clone. It carries a UrlbarQueryContext that fromWire builds in the actor's realm, and cloning would flatten it to a plain object. Content has that class, so deserializing on the content side is the likely fix.

Comment 1

[Dão Gottwald [:dao]]

Attachment: Bug 2064277 - Clone parent-sent payloads into the content realm. r?mbeier!

The port's returns are already cloned; the parent's dispatches into the child
controller weren't, so a content-realm input saw an Xray over an object in this
realm and was denied even Symbol.iterator -- iterating the engine-store
snapshot threw.

Notify has the same gap and isn't fixed here: it carries a UrlbarQueryContext
that fromWire builds in this realm, and cloning would flatten it. Content has
the class, so deserializing there is likely the answer.

Comment 2

[Dão Gottwald [:dao]]

Attachment: Bug 2064277 - Build the query context in the realm that reads it. r?mbeier!

The remaining half of the previous patch, and the one a clone can't fix: the
actor deserialized the wire form into a UrlbarQueryContext in its own realm, so
a content-realm view got an Xray over it. That reads every property as
undefined rather than throwing, so a query produced no rows and no error.

The wire form is plain data, so it crosses as one and the child controller builds
the context from it. That has to happen before notify inspects id to drop a
stale query's results.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/56467e58ed36
https://hg.mozilla.org/integration/autoland/rev/7887a6c59181
Clone parent-sent payloads into the content realm. r=mbeier
https://github.com/mozilla-firefox/firefox/commit/e7e50f5e61ba
https://hg.mozilla.org/integration/autoland/rev/430c093b2bea
Build the query context in the realm that reads it. r=mbeier,urlbar-reviewers

Comment 4

[Serban Stanca [:SerbanS]]

Reverted this because it was causing mochitests failures in browser_searchbar_new.js.

• Revert link
• Push with failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | accessible/tests/browser/tree/browser_searchbar_new.js | test_searchbar_a11y_tree - [DOM node id: searchbar-new, role: grouping, address: [xpconnect wrapped nsIAccessible]] has an extra child at index 1 : [role: section, address: [xpconnect wrapped nsIAccessible]]

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/de9e8ba6b7a6
https://hg.mozilla.org/integration/autoland/rev/93e144ed07d8
Clone parent-sent payloads into the content realm. r=mbeier
https://github.com/mozilla-firefox/firefox/commit/85259daf3a6f
https://hg.mozilla.org/integration/autoland/rev/d1fc19ef81b3
Build the query context in the realm that reads it. r=mbeier,urlbar-reviewers

Comment 6

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/7887a6c59181
https://hg.mozilla.org/mozilla-central/rev/430c093b2bea

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2e0668e5e2a1
https://hg.mozilla.org/integration/autoland/rev/740a839c9a47
Clone parent-sent payloads into the content realm. r=mbeier
https://github.com/mozilla-firefox/firefox/commit/c467263c0c55
https://hg.mozilla.org/integration/autoland/rev/21500cc03d91
Build the query context in the realm that reads it. r=mbeier,urlbar-reviewers

Comment 8

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/93e144ed07d8
https://hg.mozilla.org/mozilla-central/rev/d1fc19ef81b3
https://hg.mozilla.org/mozilla-central/rev/740a839c9a47
https://hg.mozilla.org/mozilla-central/rev/21500cc03d91