533882 - Avoid calling into caps when we don't have to in XOWs

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Doing so knocks us off trace.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

Note that our attempts to not fall off trace when executing window.foo are defeated by js_LeaveTraceIfGlobalObject. But this avoids calling into caps when a XOW whose parent (scope) is the same as the object it's wrapping. It's safe to do this because XOWs can't be shared across origins. For the cross-origin, same-scope case, we'll still call into caps, but the security check will pass.

Comment 2

[Boris Zbarsky [:bzbarsky]]

> For the cross-origin, same-scope case, we'll still call into caps

You meant cross-scope, same-origin?

What's with this js_LeaveTraceIfGlobalObject stuff?  :(

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

(In reply to comment #2)
> You meant cross-scope, same-origin?

Oops, yes.

> What's with this js_LeaveTraceIfGlobalObject stuff?  :(

I talked with brendan and gal about this yesterday. The problem is that we lazily import global slots into the trace and then only update the slots in the global object after we leave trace. Because of this, we have to bail any time someone aliases the global object. According to gal, it would not be hard to populate the global object with updated values, but we don't do that yet.

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 416841 [details] [diff] [review]
Proposed fix

 UnwrapXOW(JSContext *cx, JSObject *wrapper)
 {
-  wrapper = UnwrapGeneric(cx, &XPCCrossOriginWrapper::XOWClass, wrapper);
+  JSObject *innerObj =
+    UnwrapGeneric(cx, &XPCCrossOriginWrapper::XOWClass, wrapper);
   if (!wrapper) {
     return nsnull;
   }

You want to check innerObj there, not wrapper.

r=jst with that.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 416841 [details] [diff] [review]
Proposed fix

sr=bzbarsky with jst's nit addressed.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/eea9f123edfe