609139 - QueryInterfaced objects forget some interfaces when they cross compartments

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Ed Lee :Mardak]

If I do the following from the error console, it correctly reports nsPIPlacesDatabase:

const {utils: Cu} = Components;
Cu.import("resource://services-sync/util.js");
Cu.reportError(Svc.History);

[xpconnect wrapped (nsISupports, nsINavHistoryService, nsIGlobalHistory3, nsIGlobalHistory2, nsIDownloadHistory, nsIBrowserHistory, nsPIPlacesDatabase)]

However, if I do that from a restartless add-on, it doesn't have nsPIPlacesDatabase without first QIing it:

const {interfaces: Ci, utils: Cu} = Components;

function startup() {
  Cu.import("resource://services-sync/util.js");
  Cu.reportError(Svc.History);
  Cu.reportError(Svc.History.QueryInterface(Ci.nsPIPlacesDatabase));
  Cu.reportError(Svc.History);
}

[xpconnect wrapped (nsISupports, nsINavHistoryService, nsIGlobalHistory3, nsIGlobalHistory2, nsIDownloadHistory, nsIBrowserHistory)]
[xpconnect wrapped (nsISupports, nsINavHistoryService, nsIGlobalHistory3, nsIGlobalHistory2, nsIDownloadHistory, nsIBrowserHistory, nsPIPlacesDatabase)]
[xpconnect wrapped (nsISupports, nsINavHistoryService, nsIGlobalHistory3, nsIGlobalHistory2, nsIDownloadHistory, nsIBrowserHistory, nsPIPlacesDatabase)]

Comment 1

[Ed Lee :Mardak]

Seems to be m-c only:

1101 ok http://hg.mozilla.org/tracemonkey/rev/7af31ff1e9f5
1102 ok http://hg.mozilla.org/tracemonkey/rev/b71e965f4093

1101 ok http://hg.mozilla.org/mozilla-central/rev/f4ea6992e1c6
1102 bad http://hg.mozilla.org/mozilla-central/rev/45d6a73ef138

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f4ea6992e1c6&tochange=45d6a73ef138

Comment 2

[Ed Lee :Mardak]

ok http://hg.mozilla.org/mozilla-central/rev/3cc79ed380c8
bad http://hg.mozilla.org/mozilla-central/rev/addeb77512a8

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3cc79ed380c8&tochange=addeb77512a8

Bug 602223 or bug 607767 or bug 596031

Comment 3

[Ed Lee :Mardak]

Testing without the restartless addon:

var {classes: Cc, interfaces: Ci, utils: Cu} = Components; expr = "Components.utils.import('resource://services-sync/util.js'); Svc.History"; [Cu.evalInSandbox(expr, Cu.Sandbox(Cc["@mozilla.org/systemprincipal;1"].createInstance(Ci.nsIPrincipal))).toString(), eval(expr)].join("\n")

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

This won't be fixed for beta7. The problem is that we have some code to rewrap wrapped natives as they cross compartment boundaries, and two wrapped natives for the same native object don't necessarily share the same interface list. The proper way to fix this is to merge the two wrapped natives' sets when we rewrap.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Hedge a little more

Rather than do the "merge", this just uses the passed-in wrapped native's sets in more cases. This could have unexpected behavior if the wrapped native on the other side of the conversion here was QI'd to a different set of interfaces, but I hope that would be a pretty rare case.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/43781a14501d