812415 - "prototype" in a sandbox no longer returns an object

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Jeferson Hultmann]

The code below returns "[xpconnect wrapped native prototype]" in Firefox 16 and Beta 17. However, in Aurora 18/Nightly 19, it returns "undefined".

STR:
1. Open the Web Console.
2. Open the Error Console. Paste/execute the following:

Components.utils.import("resource://gre/modules/Services.jsm");
var tab = Services.wm.getMostRecentWindow("navigator:browser").gBrowser.selectedTab;
var win = tab.linkedBrowser.contentWindow;
var sandbox = Components.utils.Sandbox(win);
sandbox.my_win = win;
var code = "my_win.console.log(XPCNativeWrapper.unwrap(my_win.Navigator).prototype)";
Components.utils.evalInSandbox(code, sandbox);


3. The output in the Web Console looks like this:
  Firefox Beta 17: "[xpconnect wrapped native prototype]"
  Aurora 18: "undefined"

Comment 1

[Bobby Holley (:bholley)]

Peter, might this be related to your Xray prototype changes?

Comment 2

[Alice0775 White]

Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/96287ad60bef
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120910183953
Bad:
http://hg.mozilla.org/mozilla-central/rev/d042ad078f43
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120911065552
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=96287ad60bef&tochange=d042ad078f43

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/c8e5053af5ad
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120911004454
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/4f5b4f0ecf01
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120911010554
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c8e5053af5ad&tochange=4f5b4f0ecf01

Comment 3

[Boris Zbarsky [:bzbarsky]]

Looks like the answer to comment 1 is "No".  ;)

Comment 4

[Bobby Holley (:bholley)]

Attachment: Use wrapperSubsumes rather than isChrome in XPCNativeWrapper.unwrap. v1

The current behavior breaks same-origin Xrays in sandboxes. This makes it match
the check we do in XrayWrapper.cpp for the .wrappedJSObject property.

Comment 5

[Bobby Holley (:bholley)]

Note to release drivers - I recommend tracking this. The fix is simple and it has the potential to break addons.

Comment 6

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/022aa215f343

Comment 7

[Bobby Holley (:bholley)]

Comment on attachment 683750 [details] [diff] [review]
Use wrapperSubsumes rather than isChrome in XPCNativeWrapper.unwrap. v1

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 788914
User impact if declined: Addon-compat.
Testing completed (on m-c, etc.): Just landed to inbound.
Risk to taking this patch (and alternatives if risky): Very low risk, well-understood. Fix for a silly mistake.
String or UUID changes made by this patch: None

I'm going to be on PTO for a few weeks, so if someone could get these landed on branch for me, I'd be appreciative.

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/022aa215f343

Comment 9

[Alex Keybl [:akeybl]]

Comment on attachment 683750 [details] [diff] [review]
Use wrapperSubsumes rather than isChrome in XPCNativeWrapper.unwrap. v1

Approving for uplift to Aurora/Beta given the add-on compatibility issues we may run into in FF18 if left unfixed.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e1bc674168e8
https://hg.mozilla.org/releases/mozilla-beta/rev/ba72ad46105d