618176 - Failure to serialize array returned by content in frame script

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

In a setup that looks approximately like,

  <xul window>
    <browser src="http://foo.com">
      (frame script X loaded by browser)

if script X calls a function from foo.com's |window|, and that function returns an array, then the array is JSON'd by script X, the JSONinification seems to be failing: when un-JSON'd, what was formerly an array comes out as non-array object.  Sorry for the lack of detail, but the only testcase I have right now is a heavily modified reftest framework, which is not very small.  I'll cook up a small testcase.

hg bisect says what's "at fault" is

The first bad revision is:
changeset:   58746:0641328503d8
user:        Blake Kaplan <[e-mail]>
date:        Fri Dec 03 19:00:23 2010 -0800
summary:     Bug 614757 - Properly deep wrap via call/construct. r=gal

It might be that there's a better way to do what my code is doing, but the code did work previously.

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Attachment: Test that triggers mismatched-compartments assertion (not the bug you're looking for)

Figured I'd attach this so I don't lose it.  Will follow up to see if this is a separate bug.

Comment 2

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Attachment: Small-ish test case

Run

  TEST_PATH="js/src/xpconnect/tests/chrome" make -C $objdir mochitest-chrome

and you should see

42 ERROR TEST-UNEXPECTED-FAIL | chrome://mochitests/content/chrome/js/src/xpconnect/tests/chrome/test_bug618176.xul | array was serialized and deserialized - got undefined, expected 3

As noted in a comment in the test, if |[ 1, 2, 3 ]| is serialized instead of the content array, the test passes.

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Nom'ing for blocking-fennec because this behavior change might affect extensions.  (I'm surprised it hasn't bitten the fennec frontend!)

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

With a CrossOriginWrapper around an array we actually have CrossOriginWrapper(WaiveXRayWrapper(array)). We need to strip off both layers to see the true type of the wrapped object.

Comment 5

[Andreas Gal :gal]

We should have a proper channel for this (an internal proxy method that tells you whether its an array)

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/907c8fc9370b

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/907c8fc9370b