Closed Bug 812415 Opened 9 years ago Closed 9 years ago

"prototype" in a sandbox no longer returns an object

Categories

(Core :: XPConnect, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla20
Tracking Status
firefox18 + fixed
firefox19 + fixed
firefox20 --- fixed

People

(Reporter: hultmann, Assigned: bholley)

References

Details

(Keywords: addon-compat, regression)

Attachments

(1 file)

The code below returns "[xpconnect wrapped native prototype]" in Firefox 16 and Beta 17. However, in Aurora 18/Nightly 19, it returns "undefined".

STR:
1. Open the Web Console.
2. Open the Error Console. Paste/execute the following:

Components.utils.import("resource://gre/modules/Services.jsm");
var tab = Services.wm.getMostRecentWindow("navigator:browser").gBrowser.selectedTab;
var win = tab.linkedBrowser.contentWindow;
var sandbox = Components.utils.Sandbox(win);
sandbox.my_win = win;
var code = "my_win.console.log(XPCNativeWrapper.unwrap(my_win.Navigator).prototype)";
Components.utils.evalInSandbox(code, sandbox);


3. The output in the Web Console looks like this:
  Firefox Beta 17: "[xpconnect wrapped native prototype]"
  Aurora 18: "undefined"
Peter, might this be related to your Xray prototype changes?
Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/96287ad60bef
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120910183953
Bad:
http://hg.mozilla.org/mozilla-central/rev/d042ad078f43
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120911065552
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=96287ad60bef&tochange=d042ad078f43

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/c8e5053af5ad
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120911004454
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/4f5b4f0ecf01
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120911010554
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c8e5053af5ad&tochange=4f5b4f0ecf01
Looks like the answer to comment 1 is "No".  ;)
Assignee: nobody → bobbyholley+bmo
Blocks: 788914
The current behavior breaks same-origin Xrays in sandboxes. This makes it match
the check we do in XrayWrapper.cpp for the .wrappedJSObject property.
Attachment #683750 - Flags: review?(mrbkap)
Note to release drivers - I recommend tracking this. The fix is simple and it has the potential to break addons.
Keywords: addon-compat
OS: Windows 7 → All
Hardware: x86_64 → All
Blocks: 812942
Attachment #683750 - Flags: review?(mrbkap) → review+
Comment on attachment 683750 [details] [diff] [review]
Use wrapperSubsumes rather than isChrome in XPCNativeWrapper.unwrap. v1

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 788914
User impact if declined: Addon-compat.
Testing completed (on m-c, etc.): Just landed to inbound.
Risk to taking this patch (and alternatives if risky): Very low risk, well-understood. Fix for a silly mistake.
String or UUID changes made by this patch: None

I'm going to be on PTO for a few weeks, so if someone could get these landed on branch for me, I'd be appreciative.
Attachment #683750 - Flags: approval-mozilla-beta?
Attachment #683750 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/022aa215f343
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
Comment on attachment 683750 [details] [diff] [review]
Use wrapperSubsumes rather than isChrome in XPCNativeWrapper.unwrap. v1

Approving for uplift to Aurora/Beta given the add-on compatibility issues we may run into in FF18 if left unfixed.
Attachment #683750 - Flags: approval-mozilla-beta?
Attachment #683750 - Flags: approval-mozilla-beta+
Attachment #683750 - Flags: approval-mozilla-aurora?
Attachment #683750 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.