Last Comment Bug 618176 - Failure to serialize array returned by content in frame script
: Failure to serialize array returned by content in frame script
Status: RESOLVED FIXED
fixed-in-tracemonkey
:
Product: Core
Classification: Components
Component: XPConnect (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: Blake Kaplan (:mrbkap)
:
:
Mentors:
Depends on:
Blocks: 614757
  Show dependency treegraph
 
Reported: 2010-12-09 17:09 PST by Chris Jones [:cjones] inactive; ni?/f?/r? if you need me
Modified: 2011-07-14 21:43 PDT (History)
9 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed
6+


Attachments
Test that triggers mismatched-compartments assertion (not the bug you're looking for) (1.61 KB, patch)
2010-12-09 17:32 PST, Chris Jones [:cjones] inactive; ni?/f?/r? if you need me
no flags Details | Diff | Splinter Review
Small-ish test case (3.89 KB, patch)
2010-12-09 19:59 PST, Chris Jones [:cjones] inactive; ni?/f?/r? if you need me
no flags Details | Diff | Splinter Review
Proposed fix (2.56 KB, patch)
2011-04-12 15:40 PDT, Blake Kaplan (:mrbkap)
gal: review+
Details | Diff | Splinter Review

Description Chris Jones [:cjones] inactive; ni?/f?/r? if you need me 2010-12-09 17:09:22 PST
In a setup that looks approximately like,

  <xul window>
    <browser src="http://foo.com">
      (frame script X loaded by browser)

if script X calls a function from foo.com's |window|, and that function returns an array, then the array is JSON'd by script X, the JSONinification seems to be failing: when un-JSON'd, what was formerly an array comes out as non-array object.  Sorry for the lack of detail, but the only testcase I have right now is a heavily modified reftest framework, which is not very small.  I'll cook up a small testcase.

hg bisect says what's "at fault" is

The first bad revision is:
changeset:   58746:0641328503d8
user:        Blake Kaplan <mrbkap@gmail.com>
date:        Fri Dec 03 19:00:23 2010 -0800
summary:     Bug 614757 - Properly deep wrap via call/construct. r=gal

It might be that there's a better way to do what my code is doing, but the code did work previously.
Comment 1 Chris Jones [:cjones] inactive; ni?/f?/r? if you need me 2010-12-09 17:32:11 PST
Created attachment 496694 [details] [diff] [review]
Test that triggers mismatched-compartments assertion (not the bug you're looking for)

Figured I'd attach this so I don't lose it.  Will follow up to see if this is a separate bug.
Comment 2 Chris Jones [:cjones] inactive; ni?/f?/r? if you need me 2010-12-09 19:59:35 PST
Created attachment 496735 [details] [diff] [review]
Small-ish test case

Run

  TEST_PATH="js/src/xpconnect/tests/chrome" make -C $objdir mochitest-chrome

and you should see

42 ERROR TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/js/src/xpconnect/tests/chrome/test_bug618176.xul | array was serialized and deserialized - got undefined, expected 3

As noted in a comment in the test, if |[ 1, 2, 3 ]| is serialized instead of the content array, the test passes.
Comment 3 Chris Jones [:cjones] inactive; ni?/f?/r? if you need me 2010-12-09 20:00:23 PST
Nom'ing for blocking-fennec because this behavior change might affect extensions.  (I'm surprised it hasn't bitten the fennec frontend!)
Comment 4 Blake Kaplan (:mrbkap) 2011-04-12 15:40:28 PDT
Created attachment 525536 [details] [diff] [review]
Proposed fix

With a CrossOriginWrapper around an array we actually have CrossOriginWrapper(WaiveXRayWrapper(array)). We need to strip off both layers to see the true type of the wrapped object.
Comment 5 Andreas Gal :gal 2011-04-12 15:45:32 PDT
We should have a proper channel for this (an internal proxy method that tells you whether its an array)
Comment 6 Blake Kaplan (:mrbkap) 2011-04-12 17:02:16 PDT
http://hg.mozilla.org/tracemonkey/rev/907c8fc9370b
Comment 7 Blake Kaplan (:mrbkap) 2011-05-03 13:52:13 PDT
http://hg.mozilla.org/mozilla-central/rev/907c8fc9370b

Note You need to log in before you can comment on or make changes to this bug.