609949 - Impossible to retrieve prototype of objects returned by evalInSandbox with wantXrays=false

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Kris Maglione [:kmag]]

User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:2.0b8pre) Gecko/20101105 Firefox/4.0b8pre
Build Identifier:  Mozilla/5.0 (X11; Linux x86_64; rv:2.0b8pre) Gecko/20101105 Firefox/4.0b8pre

Objects returned by evalInSandbox from sandboxes created with wantXrays=false, though they appear to have their prototype chain intact, always return null when accessing __proto__ or calling Object.getPrototypeOf. This is the case with the latest Tracemonkey nightly, as will as the latest mozilla-central nightly.

The problem only exists for objects returned by evalInSandbox, not objects passed to extenal code by other means:

let context = Cu.Sandbox(window, { wantXrays: false });
context.object = { __proto__: { foo: "bar" } };

let obj = Components.utils.evalInSandbox('object', context);
dump(context.object.foo + " " + obj.foo + " " + obj.__proto__ + " " + Object.getPrototypeOf(obj) + "\n");
// Prints: bar bar null null

context.export = function (o) { obj = o }
Components.utils.evalInSandbox('export(object)', context);
dump(context.object.foo + " " + obj.foo + " " + obj.__proto__ + " " + Object.getPrototypeOf(obj) + "\n");
// Prints: bar bar [object Object] [object Object]



Reproducible: Always