342235 - [FIX]XBL method trying to use event parameter gets exception

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[aaronr]

The attached testcase doesn't work on trunk but works in Firefox 1.5.0.5 nightly.  I get the following in the java script console: "Error: uncaught exception: Permission denied to get property MouseEvent.originalTarget".  If I had to guess, I'd say that it just broke within the last week.

The immediate impact is that this bug is killing some of the controls in the XForms extension.

I've looked at this a little and if you try to get the event.originalTarget using a method that is set directly as the onclick handler on the DOM element, it works fine.  It also works fine if it is used in a click handler using xbl:handler.  The issue seems to be with an anonymous content element passing the event to a xbl:method.

Comment 1

[aaronr]

Attachment: testcase

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

I can first time see this bug in 2006-06-13 nightlies.
Perhaps Bug 255942 or Bug 176182 

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: simpler testcase

So for some reason anonymous content can't access any properties of the event.

Comment 4

[Boris Zbarsky [:bzbarsky]]

So when we get into nsScriptSecurityManager::CheckSameOriginDOMProp (called from nsScriptSecurityManager::CheckPropertyAccessImpl), the subject principal is the principal of the page, as expected, but the object principal is the hidden window's principal.  So it looks like we're wrapping the event in the wrong scope or something....

Comment 5

[Boris Zbarsky [:bzbarsky]]

So what _used_ to happen is that in nsJSEventListener::HandleEvent we'd do:

  rv = xpc->WrapNative(cx, obj, aEvent, NS_GET_IID(nsIDOMEvent),
                       getter_AddRefs(wrapper));

where |obj| was the JSObject for the target.

Now what we do instead is:

   rv = mContext->CallEventHandler(mTarget, mScopeObject, funcval, iargv,
                                   getter_AddRefs(vrv));

and CallEventHandler does:

   rv = ConvertSupportsTojsvals(aargv, aScope, &argc,
                                NS_REINTERPRET_CAST(void **, &argv), &mark);

I suspect that the latter call should pass |target| instead of aScope.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Yeah, that fixes it.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Attachment: Like so

Comment 8

[Johnny Stenback (:jst)]

Comment on attachment 226497 [details] [diff] [review]
Like so

sr=jst

Comment 9

[Johnny Stenback (:jst)]

Comment on attachment 226497 [details] [diff] [review]
Like so

Er, I screwed up the review flags, but whatever. r+sr=jst for this, even.

Comment 10

[Johnny Stenback (:jst)]

Ugh, bugzilla conflict handling screwup between my and Mark's reviews. Oh well.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Fixed.