276205 - [FIX]Disabling javascript does not disable js inside <constructor> in xbl anymore

Status: RESOLVED FIXED

(Core :: XBL, defect, P1)

Description

[Martijn Wargers (dead)]

This is a regression.
Not happening in:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040910
Firefox/0.9.1+ 8:52am
Happening in:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040911
Firefox/0.9.1+ 7:44am

Bonsai link:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-09-10+08%3A00%3A00&maxdate=2004-09-11+08%3A00%3A00&cvsroot=%2Fcvsroot

It seems to me that the fix for bug 230816 caused this regression (if not my
appologies).

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Look at this testcase when you have javascript turned off in your browser.

Comment 2

[Brendan Eich [:brendan]]

Shouldn't assign this to hyatt if it's a regression to be fixed soon.

/be

Comment 3

[Boris Zbarsky [:bzbarsky]]

(In reply to comment #2)
> Shouldn't assign this to hyatt if it's a regression to be fixed soon.

hyatt's the default assignee for this component (and a few others, so watching
him doesn't work so hot either).  Fixing that in the database would be nice and all.

I'll look into this, but I don't see anything in the old code that would have
prevented the constructor from firing in this case, just like I don't see
anything in the new code....

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

There's a call to CheckFunctionAccess in nsJSContext::CallEventHandler, and I
think we should do the same thing here.  This patch fixes the testcase when JS
is disabled, and I tested that having XML on one website load XBL from another
website continues to work (the constructors run, if JS is enabled).

Comment 5

[Johnny Stenback (:jst)]

Comment on attachment 170271 [details] [diff] [review]
Patch

+    ok = ::JS_CallFunctionValue(cx, thisObject, OBJECT_TO_JSVAL(method),
+					0 /* argc */, nsnull /* argv */,
&retval);

r+sr=jst if you fix the next-line argument indentation there :)

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed on trunk for 1.8a6