674436 - NS_ENSURE_TRUE(JS_GetProperty(ctx, object, "receiveMessage", &funval) with message manager and sandboxes

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[:Felipe Gomes (needinfo for replies!)]

I've been trying to add mm listeners using the Scratchpad, but whenever a message is received, I get the following error and the listener is not called:

WARNING: NS_ENSURE_TRUE(JS_GetProperty(ctx, object, "receiveMessage", &funval) && JSVAL_IS_OBJECT(funval) && !JSVAL_IS_NULL(funval)) failed: file c:/moz/mozilla
-central/ff-debug/content/base/src/../../../../mozilla/content/base/src/nsFrameMessageManager.cpp, line 436


How to reproduce:
-----------------
set the pref devtools.chrome.enabled = true
Open Scratchpad (Shift + F4) and set Environment -> Browser

type this code in the text area, select all the text and choose Execute -> Run:

/***** begin *****/

gBrowser.selectedBrowser.messageManager.addMessageListener("z", function(o) {
  alert(o.json.q);
});

gBrowser.selectedBrowser.messageManager.loadFrameScript('data:,sendAsyncMessage("z", {q: "bar"})', false);

/***** end *****/


###########
What causes it is that the Scratchpad runs the code through a sandbox prototyped with the browser window.


The actual code boils down to:

/*** begin ***/
var mm = gBrowser.selectedBrowser.messageManager;
var win = Services.wm.getMostRecentWindow("navigator:browser");
var sand = new Cu.Sandbox(win, {sandboxPrototype:win});

var sandboxscript = "gBrowser.selectedBrowser.messageManager.addMessageListener('z', function(o) { alert(o.json.q);});"
Cu.evalInSandbox(sandboxscript, sand);
mm.loadFrameScript('data:,sendAsyncMessage("z", {q: "bar"})', false);

/*** end ***/

Comment 1

[Josh Matthews [:jdm]]

Attachment: Relax message listener restrictions to allow callable proxies.

Comment 2

[Josh Matthews [:jdm]]

Comment on attachment 548678 [details] [diff] [review]
Relax message listener restrictions to allow callable proxies.

There's nothing wrong with this patch, but I just noticed the other call to JS_IsObjectFunction in the other branch. We should probably nix that too, because I suspect that the current testcase with an object that has receiveMessage would probably fail similarly.

Comment 3

[Josh Matthews [:jdm]]

Attachment: Relax message listener restrictions to allow callable proxies.

Comment 4

[:Felipe Gomes (needinfo for replies!)]

thanks Josh!
http://hg.mozilla.org/integration/mozilla-inbound/rev/3d3f25a67e24

Comment 5

[Dão Gottwald [:dao]]

backed out for android reftest failures

Comment 6

[Marco Bonardo [:mak]]

I think it has nothing to do with those failures, my suspect is that the Android ndk changes are causing them (mozilla central has same failures)

Comment 7

[Marco Bonardo [:mak]]

relanded
http://hg.mozilla.org/integration/mozilla-inbound/rev/c2ab7a1d1350

Comment 8

[(no longer active)]

This was backed out from inbound...

Comment 9

[Marco Bonardo [:mak]]

it was not, I relanded it :)
http://hg.mozilla.org/mozilla-central/rev/c2ab7a1d1350