August 2014 - tbb-commits - lists.torproject.org

[tor-browser/esr24] Bug 989183 - Check for nsXBLJSClass on esr24. r=bz a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit bfbab2b7a05871e82aa18ac2a61d14667d8b366e Author: Bobby Holley <bobbyholley(a)gmail.com> Date: Wed Apr 2 16:29:00 2014 -0300 Bug 989183 - Check for nsXBLJSClass on esr24. r=bz a=sledru --- content/xbl/src/nsXBLBinding.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp index 8b6133a6..9832a3c 100644 --- a/content/xbl/src/nsXBLBinding.cpp +++ b/content/xbl/src/nsXBLBinding.cpp @@ -1155,7 +1155,7 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JS::Handle<JSObject*> global, if (!::JS_LookupPropertyWithFlags(cx, global, className.get(), 0, val.address())) return NS_ERROR_OUT_OF_MEMORY; - if (val.isObject()) { + if (val.isObject() && JS_GetClass(&val.toObject())->finalize == XBLFinalize) { *aNew = false; proto = &val.toObject(); } else {

1 0

[tor-browser/esr24] Backed out changeset 42531d5e6ca2 (Bug 986843) for test failures
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit a79c2bfce5b8d2416d01250dbbaa7e6cf0dc1ae1 Author: Jon Coppeard <jcoppeard(a)mozilla.com> Date: Wed Apr 2 17:19:28 2014 +0100 Backed out changeset 42531d5e6ca2 (Bug 986843) for test failures --- js/src/gc/RootMarking.cpp | 2 +- js/src/gc/Zone.cpp | 1 + js/src/gc/Zone.h | 2 ++ js/src/jsapi.cpp | 29 +++++++++++------------------ js/src/jscompartment.cpp | 2 +- js/src/jscompartment.h | 2 +- js/src/jsgc.cpp | 4 ++-- 7 files changed, 19 insertions(+), 23 deletions(-) diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp index 88574f3..861c2d6 100644 --- a/js/src/gc/RootMarking.cpp +++ b/js/src/gc/RootMarking.cpp @@ -744,7 +744,7 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots) #endif for (CompartmentsIter c(rt); !c.done(); c.next()) - c->markRoots(trc); + c->mark(trc); /* The embedding can register additional roots here. */ for (size_t i = 0; i < rt->gcBlackRootTracers.length(); i++) { diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp index 0b6161c..5625b99 100644 --- a/js/src/gc/Zone.cpp +++ b/js/src/gc/Zone.cpp @@ -23,6 +23,7 @@ using namespace js::gc; JS::Zone::Zone(JSRuntime *rt) : rt(rt), allocator(this), + hold(false), ionUsingBarriers_(false), active(false), gcScheduled(false), diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h index 39e867d..73e7043 100644 --- a/js/src/gc/Zone.h +++ b/js/src/gc/Zone.h @@ -108,6 +108,8 @@ struct Zone : private JS::shadow::Zone, js::CompartmentVector compartments; + bool hold; + private: bool ionUsingBarriers_; diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp index 68b6afa..3632a74 100644 --- a/js/src/jsapi.cpp +++ b/js/src/jsapi.cpp @@ -3171,32 +3171,23 @@ JS_GetObjectId(JSContext *cx, JSObject *obj, jsid *idp) return JS_TRUE; } -class AutoCompartmentRooter : private JS::CustomAutoRooter +class AutoHoldZone { public: - explicit AutoCompartmentRooter(JSContext *cx, JSCompartment *comp - MOZ_GUARD_OBJECT_NOTIFIER_PARAM) - : CustomAutoRooter(cx), compartment(comp) + explicit AutoHoldZone(Zone *zone + MOZ_GUARD_OBJECT_NOTIFIER_PARAM) + : holdp(&zone->hold) { MOZ_GUARD_OBJECT_NOTIFIER_INIT; + *holdp = true; } - operator JSCompartment *() { - return compartment; - } - - JSCompartment *operator->() { - return compartment; - } - - protected: - virtual void trace(JSTracer *trc) - { - compartment->mark(); + ~AutoHoldZone() { + *holdp = false; } private: - JSCompartment *compartment; + bool *holdp; MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER }; @@ -3218,7 +3209,7 @@ JS_NewGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals, else zone = ((JSObject *)options.zoneSpec)->zone(); - AutoCompartmentRooter compartment(cx, NewCompartment(cx, zone, principals, options)); + JSCompartment *compartment = NewCompartment(cx, zone, principals, options); if (!compartment) return NULL; @@ -3227,6 +3218,8 @@ JS_NewGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals, rt->systemZone->isSystem = true; } + AutoHoldZone hold(compartment->zone()); + Rooted<GlobalObject *> global(cx); { AutoCompartment ac(cx, compartment); diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp index 2e66253..c448e10 100644 --- a/js/src/jscompartment.cpp +++ b/js/src/jscompartment.cpp @@ -488,7 +488,7 @@ JSCompartment::markAllCrossCompartmentWrappers(JSTracer *trc) } void -JSCompartment::markRoots(JSTracer *trc) +JSCompartment::mark(JSTracer *trc) { #ifdef JS_ION if (ionCompartment_) diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h index 1ef2ed8..6cc1bc8 100644 --- a/js/src/jscompartment.h +++ b/js/src/jscompartment.h @@ -293,7 +293,7 @@ struct JSCompartment WrapperEnum(JSCompartment *c) : js::WrapperMap::Enum(c->crossCompartmentWrappers) {} }; - void markRoots(JSTracer *trc); + void mark(JSTracer *trc); bool isDiscardingJitCode(JSTracer *trc); void sweep(js::FreeOp *fop, bool releaseTypes); void sweepCrossCompartmentWrappers(); diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp index 3157861..53a636e 100644 --- a/js/src/jsgc.cpp +++ b/js/src/jsgc.cpp @@ -2541,7 +2541,7 @@ SweepZones(FreeOp *fop, bool lastGC) while (read < end) { Zone *zone = *read++; - if (zone->wasGCStarted()) { + if (!zone->hold && zone->wasGCStarted()) { if (zone->allocator.arenas.arenaListsAreEmpty() || lastGC) { zone->allocator.arenas.checkEmptyFreeLists(); if (callback) @@ -2723,7 +2723,7 @@ BeginMarkPhase(JSRuntime *rt) } zone->scheduledForDestruction = false; - zone->maybeAlive = false; + zone->maybeAlive = zone->hold; zone->setPreservingCode(false); }

1 0

[tor-browser/esr24] No bug, Automated blocklist update from host bld-linux64-spot-075 - a=blocklist-update
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 6cc87b4fac83abf36e1ad2e3b83318db8ce5212e Author: ffxbld <none@none> Date: Sat Apr 5 03:11:11 2014 -0700 No bug, Automated blocklist update from host bld-linux64-spot-075 - a=blocklist-update --- browser/app/blocklist.xml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/browser/app/blocklist.xml b/browser/app/blocklist.xml index cb9dca8..6b94ea0 100644 --- a/browser/app/blocklist.xml +++ b/browser/app/blocklist.xml @@ -1,5 +1,5 @@ <?xml version="1.0"?> -<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1396046918000"> +<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1396307847000"> <emItems> <emItem blockID="i454" id="sqlmoz(a)facebook.com"> <versionRange minVersion="0" maxVersion="*" severity="3"> @@ -1038,8 +1038,8 @@ <prefs> </prefs> </emItem> - <emItem blockID="i67" id="youtube2(a)youtube2.com"> - <versionRange minVersion="0" maxVersion="*"> + <emItem blockID="i570" id="jid1-vW9nopuIAJiRHw@jetpack"> + <versionRange minVersion="0" maxVersion="*" severity="1"> </versionRange> <prefs> </prefs> @@ -1418,6 +1418,12 @@ <prefs> </prefs> </emItem> + <emItem blockID="i67" id="youtube2(a)youtube2.com"> + <versionRange minVersion="0" maxVersion="*"> + </versionRange> + <prefs> + </prefs> + </emItem> <emItem blockID="i476" id="mbroctone(a)facebook.com"> <versionRange minVersion="0" maxVersion="*" severity="3"> </versionRange>

1 0

[tor-browser/esr24] Bug 912322 - Sync pref from reftest-cmdline.js to bootstrap.js. r=jgriffin
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 920a9fc53347f5a778a2d142326957381ed73198 Author: Bobby Holley <bobbyholley(a)gmail.com> Date: Mon Feb 10 14:07:26 2014 -0800 Bug 912322 - Sync pref from reftest-cmdline.js to bootstrap.js. r=jgriffin --- layout/reftests/bugs/reftest.list | 6 +++--- layout/tools/reftest/bootstrap.js | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list index a5a4512..d4424e4 100644 --- a/layout/reftests/bugs/reftest.list +++ b/layout/reftests/bugs/reftest.list @@ -1170,9 +1170,9 @@ fuzzy(127,2) == 448193.html 448193-ref.html # == 448987.html 448987-ref.html # Disabled for now - it needs privileges != 449149-1a.html about:blank != 449149-1b.html about:blank -# Retry the above with in-content XBL behavior -test-pref(dom.use_xbl_scopes_for_remote_xul,false) fails-if(Android) != 449149-1a.html about:blank -test-pref(dom.use_xbl_scopes_for_remote_xul,false) fails-if(Android) != 449149-1b.html about:blank +# Retry the above with XBL scopes +test-pref(dom.use_xbl_scopes_for_remote_xul,true) != 449149-1a.html about:blank +test-pref(dom.use_xbl_scopes_for_remote_xul,true) != 449149-1b.html about:blank == 449149-2.html 449149-2-ref.html == 449171-1.html 449171-ref.html == 449362-1.html 449362-1-ref.html diff --git a/layout/tools/reftest/bootstrap.js b/layout/tools/reftest/bootstrap.js index a6123fc..36ab76c 100644 --- a/layout/tools/reftest/bootstrap.js +++ b/layout/tools/reftest/bootstrap.js @@ -12,6 +12,11 @@ function setDefaultPrefs() { var prefs = Components.classes["@mozilla.org/preferences-service;1"]. getService(Components.interfaces.nsIPrefService); var branch = prefs.getDefaultBranch(""); + // For mochitests, we're more interested in testing the behavior of in- + // content XBL bindings, so we set this pref to true. In reftests, we're + // more interested in testing the behavior of XBL as it works in chrome, + // so we want this pref to be false. + branch.setBoolPref("dom.use_xbl_scopes_for_remote_xul", false); branch.setBoolPref("gfx.color_management.force_srgb", true); branch.setBoolPref("browser.dom.window.dump.enabled", true); branch.setIntPref("ui.caretBlinkTime", -1);

1 0

[tor-browser/esr24] Bug 894448 part 1. Move IsChromeOrXBL to xpcpublic.h. r=bholley
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 8f3244276e1f3d464239d2fe6ee44ea4a2c7f672 Author: Boris Zbarsky <bzbarsky(a)mit.edu> Date: Mon Feb 10 14:07:26 2014 -0800 Bug 894448 part 1. Move IsChromeOrXBL to xpcpublic.h. r=bholley --- content/base/public/nsINode.h | 6 ------ content/base/src/nsINode.cpp | 9 --------- dom/bindings/Codegen.py | 3 +-- dom/webidl/Node.webidl | 4 ++-- js/xpconnect/src/nsXPConnect.cpp | 13 +++++++++++++ js/xpconnect/src/xpcpublic.h | 6 ++++++ 6 files changed, 22 insertions(+), 19 deletions(-) diff --git a/content/base/public/nsINode.h b/content/base/public/nsINode.h index 8d725a5..2c0b0b5 100644 --- a/content/base/public/nsINode.h +++ b/content/base/public/nsINode.h @@ -1120,12 +1120,6 @@ public: return NS_OK; } - /** - * Control if GetUserData and SetUserData methods will be exposed to - * unprivileged content. - */ - static bool IsChromeOrXBL(JSContext* aCx, JSObject* /* unused */); - void LookupPrefix(const nsAString& aNamespace, nsAString& aResult); bool IsDefaultNamespace(const nsAString& aNamespaceURI) { diff --git a/content/base/src/nsINode.cpp b/content/base/src/nsINode.cpp index bc93f7e..297d519 100644 --- a/content/base/src/nsINode.cpp +++ b/content/base/src/nsINode.cpp @@ -735,15 +735,6 @@ nsINode::GetUserData(JSContext* aCx, const nsAString& aKey, ErrorResult& aError) return result; } -//static -bool -nsINode::IsChromeOrXBL(JSContext* aCx, JSObject* /* unused */) -{ - JSCompartment* compartment = js::GetContextCompartment(aCx); - return xpc::AccessCheck::isChrome(compartment) || - xpc::IsXBLScope(compartment); -} - uint16_t nsINode::CompareDocumentPosition(nsINode& aOtherNode) const { diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py index a8f277f..88892d7 100644 --- a/dom/bindings/Codegen.py +++ b/dom/bindings/Codegen.py @@ -1479,8 +1479,7 @@ class MethodDefiner(PropertyDefiner): "length": 1, "flags": "0", "condition": - MemberCondition(None, - "nsINode::IsChromeOrXBL") }) + MemberCondition(None, "IsChromeOrXBL") }) if not static: stringifier = descriptor.operations['Stringifier'] diff --git a/dom/webidl/Node.webidl b/dom/webidl/Node.webidl index c6084de..2002d64 100644 --- a/dom/webidl/Node.webidl +++ b/dom/webidl/Node.webidl @@ -96,9 +96,9 @@ interface Node : EventTarget { readonly attribute DOMString? localName; boolean hasAttributes(); - [Throws, Func="nsINode::IsChromeOrXBL"] + [Throws, Func="IsChromeOrXBL"] any setUserData(DOMString key, any data, UserDataHandler? handler); - [Throws, Func="nsINode::IsChromeOrXBL"] + [Throws, Func="IsChromeOrXBL"] any getUserData(DOMString key); [ChromeOnly] readonly attribute Principal nodePrincipal; diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp index 9c6f74b..12a8fd0 100644 --- a/js/xpconnect/src/nsXPConnect.cpp +++ b/js/xpconnect/src/nsXPConnect.cpp @@ -1707,3 +1707,16 @@ IsXrayWrapper(JSObject *obj) } // namespace xpc +namespace mozilla { +namespace dom { + +bool +IsChromeOrXBL(JSContext* cx, JSObject* /* unused */) +{ + JSCompartment* compartment = js::GetContextCompartment(cx); + return AccessCheck::isChrome(compartment) || + IsXBLScope(compartment); +} + +} // namespace dom +} // namespace mozilla diff --git a/js/xpconnect/src/xpcpublic.h b/js/xpconnect/src/xpcpublic.h index 9398f24..365f1ba5 100644 --- a/js/xpconnect/src/xpcpublic.h +++ b/js/xpconnect/src/xpcpublic.h @@ -498,6 +498,12 @@ DefineStaticJSVals(JSContext *cx); void Register(nsScriptNameSpaceManager* aNameSpaceManager); +/** + * A test for whether WebIDL methods that should only be visible to + * chrome or XBL scopes should be exposed. + */ +bool IsChromeOrXBL(JSContext* cx, JSObject* /* unused */); + } // namespace dom } // namespace mozilla

1 0

[tor-browser/esr24] Bug 912322 - Fix tests. r=bz
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 5cd158557d04d3918b9911f624777a3f44fb1007 Author: Bobby Holley <bobbyholley(a)gmail.com> Date: Mon Feb 10 14:07:27 2014 -0800 Bug 912322 - Fix tests. r=bz The crashtest changes are untested (aside from the fact that they don't crash). --- content/base/crashtests/308120-1.xul | 2 +- content/base/crashtests/330925-1.xhtml | 2 +- content/base/crashtests/401993-1.html | 2 +- content/base/test/test_base.xhtml | 2 +- content/base/test/test_bug330925.xhtml | 9 +++++---- content/base/test/test_bug372086.html | 4 ++-- content/base/test/test_bug444030.xhtml | 2 +- content/html/content/crashtests/465466-1.xhtml | 2 +- content/xbl/crashtests/472260-1.xhtml | 2 +- content/xbl/test/file_bug379959_cross.html | 4 ++-- content/xbl/test/file_bug379959_data.html | 2 +- content/xbl/test/file_bug591198_inner.html | 2 +- content/xbl/test/test_bug378866.xhtml | 2 +- content/xbl/test/test_bug468210.xhtml | 2 +- content/xslt/tests/mochitest/test_bug319374.xhtml | 9 ++++++--- content/xul/content/crashtests/326864-1.xul | 10 +++++++--- content/xul/content/crashtests/384740-1.xul | 2 +- dom/base/crashtests/404869-1.xul | 2 +- dom/indexedDB/test/head.js | 2 +- js/xpconnect/crashtests/471366-1.html | 2 +- layout/base/crashtests/379105-1.xhtml | 2 +- layout/inspector/tests/test_bug522601.xhtml | 2 +- layout/reftests/bugs/495385-2f.xhtml | 18 ++++++++++++++---- layout/reftests/bugs/reftest.list | 2 +- .../test/test_selectors_on_anonymous_content.html | 2 +- layout/xul/base/src/crashtests/328135-1.xul | 2 +- layout/xul/base/src/crashtests/329477-1.xhtml | 4 ++-- toolkit/content/tests/widgets/test_popupanchor.xul | 2 +- 28 files changed, 59 insertions(+), 41 deletions(-) diff --git a/content/base/crashtests/308120-1.xul b/content/base/crashtests/308120-1.xul index dc8a21c..55963d7 100644 --- a/content/base/crashtests/308120-1.xul +++ b/content/base/crashtests/308120-1.xul @@ -1,3 +1,3 @@ -<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var button=document.getElementsByTagName('button')[0]; try { button.appendChild(document.getAnonymousNodes(button)[0]); } catch(e) { }"> +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var button=document.getElementsByTagName('button')[0]; try { button.appendChild(SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(button))[0]); } catch(e) { }"> <button/> </window> diff --git a/content/base/crashtests/330925-1.xhtml b/content/base/crashtests/330925-1.xhtml index 02e1dac..7dac837 100644 --- a/content/base/crashtests/330925-1.xhtml +++ b/content/base/crashtests/330925-1.xhtml @@ -10,7 +10,7 @@ function init() var emb = document.getElementById("emb"); try { - foopy.appendChild(document.getAnonymousNodes(emb)[0]); + foopy.appendChild(SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(emb))[0]); emb.parentNode.removeChild(emb); foopy.parentNode.removeChild(foopy); } catch (e) { diff --git a/content/base/crashtests/401993-1.html b/content/base/crashtests/401993-1.html index ba071e2..b8679df 100644 --- a/content/base/crashtests/401993-1.html +++ b/content/base/crashtests/401993-1.html @@ -11,7 +11,7 @@ function s() function boom() { - var nodes = document.getAnonymousNodes(x); + var nodes = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(x)); if (!nodes) { setTimeout(boom, 10); return; diff --git a/content/base/test/test_base.xhtml b/content/base/test/test_base.xhtml index 41e5bbc..b77551a 100644 --- a/content/base/test/test_base.xhtml +++ b/content/base/test/test_base.xhtml @@ -40,7 +40,7 @@ addLoadEvent(function() { "http://mochi.test:8888/tests/content/base/test/file_base_xbl.xml", "http://mochi.test:8888/tests/content/base/test/file_base_xbl.xml#shesellsse…", ]; - node = document.getAnonymousNodes(document.getElementById("bound"))[0]; + node = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(document.getElementById("bound")))[0]; while(node) { is(node.baseURI, svgExpected.shift(), "node base"); node = node.firstChild; diff --git a/content/base/test/test_bug330925.xhtml b/content/base/test/test_bug330925.xhtml index 3784bd1..a26ab94 100644 --- a/content/base/test/test_bug330925.xhtml +++ b/content/base/test/test_bug330925.xhtml @@ -46,20 +46,21 @@ addLoadEvent(init); function init() { var t = document.getElementById("t"); + var d = SpecialPowers.wrap(document); - is(document.getBindingParent(document.getAnonymousNodes(t)[0]), + is(SpecialPowers.unwrap(d.getBindingParent(d.getAnonymousNodes(t)[0])), t, "Wrong binding parent for anonymous node"); - is(document.getBindingParent(document.getAnonymousNodes(t)[1].childNodes[0]), + is(SpecialPowers.unwrap(d.getBindingParent(d.getAnonymousNodes(t)[1].childNodes[0])), t, "Wrong binding parent for child of anonymous node"); - is(document.getBindingParent(t), + is(d.getBindingParent(t), null, "Non-anonymous node should not have a binding parent"); - is(document.getBindingParent(document.documentElement), + is(d.getBindingParent(document.documentElement), null, "Document element should not have a binding parent"); diff --git a/content/base/test/test_bug372086.html b/content/base/test/test_bug372086.html index d439215..43d8c6e 100644 --- a/content/base/test/test_bug372086.html +++ b/content/base/test/test_bug372086.html @@ -42,7 +42,7 @@ function runTest() { is(range.endOffset, 3, "Unexpected end offset"); is(range.toString(), "bc", "Unexpected range serialization"); - var anon = document.getAnonymousNodes($("d"))[0]; + var anon = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes($("d")))[0]; // Should collapse the range, because can't determine order range.setEnd(anon, 2); is(range.startContainer, anon, "Unexpected collapsed start container"); @@ -59,7 +59,7 @@ function runTest() { is(range.endOffset, 2, "Unexpected end offset after"); is(range.toString(), "de", "Unexpected range serialization after"); - anon = document.getAnonymousNodes($("d"))[2]; + anon = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes($("d")))[2]; // Collapses because one endpoint is anonymous from point of view of // the other. range.setStart(anon, 1); diff --git a/content/base/test/test_bug444030.xhtml b/content/base/test/test_bug444030.xhtml index 92f6ba0..6ba2c6e 100644 --- a/content/base/test/test_bug444030.xhtml +++ b/content/base/test/test_bug444030.xhtml @@ -26,7 +26,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=444030 /** Test for Bug 444030 **/ function doTest() { - var anonTextNode = document.getAnonymousNodes(document.getElementById("boundElement"))[0]; + var anonTextNode = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(document.getElementById("boundElement")))[0]; var hadException = false; try { var wholeText = anonTextNode.wholeText; diff --git a/content/html/content/crashtests/465466-1.xhtml b/content/html/content/crashtests/465466-1.xhtml index d1b85da..4e12587 100644 --- a/content/html/content/crashtests/465466-1.xhtml +++ b/content/html/content/crashtests/465466-1.xhtml @@ -11,7 +11,7 @@ function boom() { var f = document.getElementById("f"); - var anon = document.getAnonymousNodes(f)[0]; + var anon = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(f))[0]; document.body.removeChild(f); anon.appendChild(document.createElement("label")); } diff --git a/content/xbl/crashtests/472260-1.xhtml b/content/xbl/crashtests/472260-1.xhtml index 4b8d97f..49d5407 100644 --- a/content/xbl/crashtests/472260-1.xhtml +++ b/content/xbl/crashtests/472260-1.xhtml @@ -12,7 +12,7 @@ function boom() { var bo = document.getElementById("bo"); - var anon = document.getAnonymousNodes(bo)[0]; + var anon = SpecialPowers.wrap(document).getAnonymousNodes(bo)[0]; bo.style.MozBinding = "url(#bar)"; diff --git a/content/xbl/test/file_bug379959_cross.html b/content/xbl/test/file_bug379959_cross.html index 29a456d..8f356d2 100644 --- a/content/xbl/test/file_bug379959_cross.html +++ b/content/xbl/test/file_bug379959_cross.html @@ -16,9 +16,9 @@ <div id="div2"></div> <script> onload = function() { - nodes = document.getAnonymousNodes(document.getElementById('div1')); + nodes = SpecialPowers.wrap(document).getAnonymousNodes(document.getElementById('div1')); parent.postMessage(nodes ? nodes.length : 0, "http://mochi.test:8888"); - nodes = document.getAnonymousNodes(document.getElementById('div2')); + nodes = SpecialPowers.wrap(document).getAnonymousNodes(document.getElementById('div2')); parent.postMessage(nodes ? nodes.length : 0, "http://mochi.test:8888"); } </script> diff --git a/content/xbl/test/file_bug379959_data.html b/content/xbl/test/file_bug379959_data.html index a84b63c..dd10176 100644 --- a/content/xbl/test/file_bug379959_data.html +++ b/content/xbl/test/file_bug379959_data.html @@ -11,7 +11,7 @@ <div id="d"></div> <script> onload = function() { - nodes = document.getAnonymousNodes(document.getElementById('d')); + nodes = SpecialPowers.wrap(document).getAnonymousNodes(document.getElementById('d')); parent.postMessage(nodes ? nodes.length : 0, "http://mochi.test:8888"); } </script> diff --git a/content/xbl/test/file_bug591198_inner.html b/content/xbl/test/file_bug591198_inner.html index 12fc9f5..89b547a 100644 --- a/content/xbl/test/file_bug591198_inner.html +++ b/content/xbl/test/file_bug591198_inner.html @@ -22,7 +22,7 @@ function sendResults() { try { res.anonChildCount = - document.getAnonymousNodes(document.getElementById('b')).length; + SpecialPowers.wrap(document).getAnonymousNodes(document.getElementById('b')).length; } catch (ex) {} diff --git a/content/xbl/test/test_bug378866.xhtml b/content/xbl/test/test_bug378866.xhtml index d4de492..8dcbf11 100644 --- a/content/xbl/test/test_bug378866.xhtml +++ b/content/xbl/test/test_bug378866.xhtml @@ -33,7 +33,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=378866 /** Test for Bug 378866 **/ function runTest() { - var anon = document.getAnonymousNodes(document.getElementById('grandparent')); + var anon = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(document.getElementById('grandparent'))); var child = document.getElementById('child'); var insertionPoint = anon[0].childNodes[0]; insertionPoint.parentNode.removeChild(insertionPoint); diff --git a/content/xbl/test/test_bug468210.xhtml b/content/xbl/test/test_bug468210.xhtml index f930880..04434fd 100644 --- a/content/xbl/test/test_bug468210.xhtml +++ b/content/xbl/test/test_bug468210.xhtml @@ -32,7 +32,7 @@ addLoadEvent(function() { var div = $("d"); var n = document.anchors.length; is(n, 1, "Unexpected number of anchors"); - var anon = document.getAnonymousNodes(div)[0]; + var anon = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(div))[0]; is(anon instanceof HTMLSpanElement, true, "Unexpected node"); is(anon.parentNode, div, "Unexpected parent"); document.body.appendChild(div); diff --git a/content/xslt/tests/mochitest/test_bug319374.xhtml b/content/xslt/tests/mochitest/test_bug319374.xhtml index c891fb3..a3496b7 100644 --- a/content/xslt/tests/mochitest/test_bug319374.xhtml +++ b/content/xslt/tests/mochitest/test_bug319374.xhtml @@ -31,6 +31,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=319374 // cause non-anonymous XPath result to throw exceptions.. var counter = 0; var error = null; + function getAnonymousNodes(e) { + return SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(e)); + } try { var xp = new XPathEvaluator(); var result = xp.evaluate("*", @@ -42,7 +45,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=319374 var res = null; while (res = result.iterateNext()) { ++counter; - var anon = document.getAnonymousNodes(res); + var anon = getAnonymousNodes(res); anon[0].removeChild(anon[0].firstChild); // Removing a child node anon[0].removeAttribute("attr1"); // Removing an attribute anon[1].firstChild.data = "anon text changed" // Modifying text data @@ -56,10 +59,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=319374 // Test 2: If the context node is in anonymous content, changing some // other anonymous tree shouldn't cause XPath result to throw. var anonAttr1 = - document.getAnonymousNodes(document.getElementById('content'). + getAnonymousNodes(document.getElementById('content'). firstChild)[0].getAttributeNode('attr'); var anonAttr2 = - document.getAnonymousNodes(document.getElementById('content'). + getAnonymousNodes(document.getElementById('content'). lastChild)[0].getAttributeNode('attr'); var resultAttr = null; try { diff --git a/content/xul/content/crashtests/326864-1.xul b/content/xul/content/crashtests/326864-1.xul index 154b134..5515ca2 100644 --- a/content/xul/content/crashtests/326864-1.xul +++ b/content/xul/content/crashtests/326864-1.xul @@ -6,13 +6,17 @@ <script> +function getAnonymousNodes(e) { + return SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(e)); +} + function init() { var tt = document.getElementById("textbox"); - var hb = document.getAnonymousNodes(tt)[0]; // hbox - var men = document.getAnonymousNodes(hb)[1]; // menupopup + var hb = getAnonymousNodes(tt)[0]; // hbox + var men = getAnonymousNodes(hb)[1]; // menupopup var menitem = men.childNodes[0]; // menuitem - var hb2 = document.getAnonymousNodes(menitem)[1]; // hbox + var hb2 = getAnonymousNodes(menitem)[1]; // hbox var label2 = hb2.childNodes[0]; // label men.menu = null; diff --git a/content/xul/content/crashtests/384740-1.xul b/content/xul/content/crashtests/384740-1.xul index 3f47b47..374f47c 100644 --- a/content/xul/content/crashtests/384740-1.xul +++ b/content/xul/content/crashtests/384740-1.xul @@ -12,7 +12,7 @@ function boom() var scrollbar = document.createElementNS(XUL_NS, 'scrollbar'); document.documentElement.appendChild(scrollbar); - var sbb = document.getAnonymousNodes(scrollbar)[0]; + var sbb = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(scrollbar))[0]; var action = document.createElementNS(XUL_NS, 'action'); action.setAttribute('datasources', ""); sbb.appendChild(action); diff --git a/dom/base/crashtests/404869-1.xul b/dom/base/crashtests/404869-1.xul index e530f7e..f5c7fac 100644 --- a/dom/base/crashtests/404869-1.xul +++ b/dom/base/crashtests/404869-1.xul @@ -10,7 +10,7 @@ function boom() { var menupopup = document.getElementById("menupopup"); - var x = document.getAnonymousNodes(menupopup)[0]; + var x = SpecialPowers.wrap(document).getAnonymousNodes(menupopup)[0]; menupopup.style.MozBinding = "url('#empty')"; for (var ppp in x) { } diff --git a/dom/indexedDB/test/head.js b/dom/indexedDB/test/head.js index 514b509..f47bead 100644 --- a/dom/indexedDB/test/head.js +++ b/dom/indexedDB/test/head.js @@ -60,7 +60,7 @@ function triggerSecondaryCommand(popup, index) // Cancel the arrow panel slide-in transition (bug 767133) such that // it won't interfere with us interacting with the dropdown. - document.getAnonymousNodes(popup)[0].style.transition = "none"; + SpecialPowers.wrap(document).getAnonymousNodes(popup)[0].style.transition = "none"; notification.button.focus(); diff --git a/js/xpconnect/crashtests/471366-1.html b/js/xpconnect/crashtests/471366-1.html index 75d0f25..b450d5e 100644 --- a/js/xpconnect/crashtests/471366-1.html +++ b/js/xpconnect/crashtests/471366-1.html @@ -3,7 +3,7 @@ <head> <script type="text/javascript"> -document.getAnonymousNodes({__proto__: XPCNativeWrapper.prototype}); +SpecialPowers.wrap(document).getAnonymousNodes({__proto__: XPCNativeWrapper.prototype}); </script> </head> diff --git a/layout/base/crashtests/379105-1.xhtml b/layout/base/crashtests/379105-1.xhtml index 662ebbd..e20cced 100644 --- a/layout/base/crashtests/379105-1.xhtml +++ b/layout/base/crashtests/379105-1.xhtml @@ -25,7 +25,7 @@ function boom1() function boom2() { - var nodes = document.getAnonymousNodes(xbltarget); + var nodes = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(xbltarget)); if (!nodes) { setTimeout(boom2, 10); return; diff --git a/layout/inspector/tests/test_bug522601.xhtml b/layout/inspector/tests/test_bug522601.xhtml index 8a94fe6..344dc61 100644 --- a/layout/inspector/tests/test_bug522601.xhtml +++ b/layout/inspector/tests/test_bug522601.xhtml @@ -106,7 +106,7 @@ addLoadEvent(function() { testFunc(walkerNonAnon, "previousNode", null, "step back past root"); - var anonDiv = document.getAnonymousNodes($("display"))[0]; + var anonDiv = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes($("display")))[0]; var walkerAnon = SpecialPowers.Cc["@mozilla.org/inspector/deep-tree-walker;1"] diff --git a/layout/reftests/bugs/495385-2f.xhtml b/layout/reftests/bugs/495385-2f.xhtml index 9b01963..3c35872 100644 --- a/layout/reftests/bugs/495385-2f.xhtml +++ b/layout/reftests/bugs/495385-2f.xhtml @@ -13,6 +13,19 @@ </binding> <binding id="empty2"> <content><children/><div xmlns="http://www.w3.org/1999/xhtml">Kitty</div></content> + <implementation> + <constructor> + // We used to do this in an onload handler, but getAnonymousNodes is no + // longer accessible to content, and we can't use SpecialPowers in + // reftests. So we enable XBL scopes and take advantage of the fact that XBL + // scopes can access these functions. We apply this binding + // programatically to make absolutely sure this constructor runs after all the + // other bindings have been set up. + document.body.offsetHeight; + document.getAnonymousNodes(document.getElementById("d3"))[0].style.display = 'inline'; + document.getAnonymousNodes(document.getElementById("d4"))[2].style.display = 'inline'; + </constructor> + </implementation> </binding> </bindings> <style> @@ -21,13 +34,10 @@ body > div { border:1px solid black; margin:1em; #d1 { -moz-binding:url(#before); } #d2 { -moz-binding:url(#after); } #d3 { -moz-binding:url(#empty1); } -#d4 { -moz-binding:url(#empty2); } </style> <script> function loaded() { - document.body.offsetHeight; - document.getAnonymousNodes(document.getElementById("d3"))[0].style.display = 'inline'; - document.getAnonymousNodes(document.getElementById("d4"))[2].style.display = 'inline'; + document.getElementById('d4').style.MozBinding = "url(#empty2)"; } </script> </head> diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list index d4424e4..0dbd0e6 100644 --- a/layout/reftests/bugs/reftest.list +++ b/layout/reftests/bugs/reftest.list @@ -1370,7 +1370,7 @@ fails-if(Android) == 488685-1.html 488685-1-ref.html == 495385-2c.html 495385-2-ref.html == 495385-2d.html 495385-2-ref.html == 495385-2e.html 495385-2-ref.html -== 495385-2f.xhtml 495385-2-ref.html +pref(dom.use_xbl_scopes_for_remote_xul,true) == 495385-2f.xhtml 495385-2-ref.html == 495385-2g.html 495385-2-ref.html == 495385-2h.html 495385-2-ref.html == 495385-2i.html 495385-2-ref.html diff --git a/layout/style/test/test_selectors_on_anonymous_content.html b/layout/style/test/test_selectors_on_anonymous_content.html index 89da83fe..7a65f53 100644 --- a/layout/style/test/test_selectors_on_anonymous_content.html +++ b/layout/style/test/test_selectors_on_anonymous_content.html @@ -42,7 +42,7 @@ function run() { style_text.data = selector + "{ z-index: " + zi + " }"; var doc_div = document.getElementById("display"); - var anon_div = document.getAnonymousNodes(doc_div)[0]; + var anon_div = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(doc_div))[0]; var should_match = []; var should_not_match = []; (matches_docdiv ? should_match : should_not_match).push(doc_div); diff --git a/layout/xul/base/src/crashtests/328135-1.xul b/layout/xul/base/src/crashtests/328135-1.xul index 1a532e18..77a4679 100644 --- a/layout/xul/base/src/crashtests/328135-1.xul +++ b/layout/xul/base/src/crashtests/328135-1.xul @@ -9,7 +9,7 @@ function init() { var pop = document.getElementsByTagName("popup")[0]; - document.getAnonymousNodes(pop)[0]; + SpecialPowers.wrap(document).getAnonymousNodes(pop)[0]; eval.eee = document.documentElement; }; diff --git a/layout/xul/base/src/crashtests/329477-1.xhtml b/layout/xul/base/src/crashtests/329477-1.xhtml index 87c8bd6..fcbd3da 100644 --- a/layout/xul/base/src/crashtests/329477-1.xhtml +++ b/layout/xul/base/src/crashtests/329477-1.xhtml @@ -9,8 +9,8 @@ function init() { var textbox = document.getElementsByTagName("textbox")[0]; - var hbox = document.getAnonymousNodes(textbox)[0]; - var menupopup = document.getAnonymousNodes(hbox)[1]; + var hbox = SpecialPowers.wrap(document).getAnonymousNodes(textbox)[0]; + var menupopup = SpecialPowers.wrap(document).getAnonymousNodes(hbox)[1]; menupopup.click(); } diff --git a/toolkit/content/tests/widgets/test_popupanchor.xul b/toolkit/content/tests/widgets/test_popupanchor.xul index ec6548d..9ad60e2 100644 --- a/toolkit/content/tests/widgets/test_popupanchor.xul +++ b/toolkit/content/tests/widgets/test_popupanchor.xul @@ -383,7 +383,7 @@ SimpleTest.waitForExplicitFinish(); addEventListener("load", function() { // anchor is set by the test runner above panel = document.getElementById("testPanel"); - arrow = document.getAnonymousElementByAttribute(panel, "anonid", "arrow"); + arrow = SpecialPowers.wrap(document).getAnonymousElementByAttribute(panel, "anonid", "arrow"); // Cancel the arrow panel slide-in transition (bug 767133) so the size and // position are "stable" enough to test without jumping through hoops... arrow.style.transition = "none";

1 0

[tor-browser/esr24] Bug 958867 - Consistent OwningObject handling in IDBFactory::Create methods. r=bent, a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 1b768e2f4c6ed464264efaef40d7c8efda730ab3 Author: Olli Pettay <Olli.Pettay(a)helsinki.fi> Date: Sun Jan 12 04:45:15 2014 +0200 Bug 958867 - Consistent OwningObject handling in IDBFactory::Create methods. r=bent, a=sledru --- dom/indexedDB/IDBFactory.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dom/indexedDB/IDBFactory.cpp b/dom/indexedDB/IDBFactory.cpp index 43a6cc4..1e7b73a 100644 --- a/dom/indexedDB/IDBFactory.cpp +++ b/dom/indexedDB/IDBFactory.cpp @@ -133,6 +133,9 @@ IDBFactory::Create(nsPIDOMWindow* aWindow, factory->mWindow = aWindow; factory->mContentParent = aContentParent; + NS_HOLD_JS_OBJECTS(factory, IDBFactory); + factory->mRootedOwningObject = true; + if (!IndexedDatabaseManager::IsMainProcess()) { TabChild* tabChild = GetTabChildFrom(aWindow); NS_ENSURE_TRUE(tabChild, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);

1 0

[tor-browser/esr24] Bug 925747 - Patch file extraction cleanup. r=bbondy, a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 6ff583446d721fdda2c272fb0d6ee108427c4304 Author: Robert Strong <robert.bugzilla(a)gmail.com> Date: Mon Jan 27 10:50:54 2014 -0800 Bug 925747 - Patch file extraction cleanup. r=bbondy, a=sledru --- .../macbuild/Contents/_CodeSignature/CodeResources | 12 ++++++++++ toolkit/mozapps/update/test/unit/head_update.js.in | 23 ++++++++++++++++++++ toolkit/mozapps/update/updater/updater.cpp | 10 +++++++-- 3 files changed, 43 insertions(+), 2 deletions(-) diff --git a/browser/app/macbuild/Contents/_CodeSignature/CodeResources b/browser/app/macbuild/Contents/_CodeSignature/CodeResources index 22666b9..6f6e20e 100644 --- a/browser/app/macbuild/Contents/_CodeSignature/CodeResources +++ b/browser/app/macbuild/Contents/_CodeSignature/CodeResources @@ -54,6 +54,18 @@ <key>weight</key> <real>10</real> </dict> + <key>^Updated.app/.*</key><dict> + <key>omit</key> + <true/> + <key>weight</key> + <real>10</real> + </dict> + <key>^updating/.*</key><dict> + <key>omit</key> + <true/> + <key>weight</key> + <real>10</real> + </dict> </dict> </dict> </plist> diff --git a/toolkit/mozapps/update/test/unit/head_update.js.in b/toolkit/mozapps/update/test/unit/head_update.js.in index 974afa4..68a19e1 100644 --- a/toolkit/mozapps/update/test/unit/head_update.js.in +++ b/toolkit/mozapps/update/test/unit/head_update.js.in @@ -424,6 +424,22 @@ function getUpdatedDirPath() { } /** + * Helper function for getting the updating directory which is used by the + * updater to extract the update manifest and patch files. + * + * @return nsIFile for the directory for the updating directory. + */ +function getUpdatingDir() { + let updatingDir = getApplyDirFile(null, true); + + if (IS_MACOSX) { + updatingDir = updatingDir.parent.parent; + } + updatingDir.append("updating"); + return updatingDir; +} + +/** * Helper function for getting the nsIFile for the directory where the update * has been applied. * @@ -650,6 +666,9 @@ function runUpdate() { updateSettingsIni.moveTo(updateSettingsIni.parent, FILE_UPDATE_SETTINGS_INI); } + logTestInfo("testing updating directory doesn't exist"); + do_check_false(getUpdatingDir().exists()); + return process.exitValue; } @@ -1015,6 +1034,10 @@ function runUpdateUsingService(aInitialStatus, aExpectedStatus, if (aCheckSvcLog) { checkServiceLogs(svcOriginalLog); } + + logTestInfo("testing updating directory doesn't exist"); + do_check_false(getUpdatingDir().exists()); + aCallback(); } diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp index eae3ce3..927f77e 100644 --- a/toolkit/mozapps/update/updater/updater.cpp +++ b/toolkit/mozapps/update/updater/updater.cpp @@ -1394,7 +1394,7 @@ PatchFile::Prepare() mPatchIndex = sPatchIndex++; NS_tsnprintf(spath, sizeof(spath)/sizeof(spath[0]), - NS_T("%s/%d.patch"), gSourcePath, mPatchIndex); + NS_T("%s/updating/%d.patch"), gDestinationPath, mPatchIndex); NS_tremove(spath); @@ -2230,6 +2230,10 @@ UpdateThreadFunc(void *param) if (rv == OK) { rv = DoUpdate(); gArchiveReader.Close(); + NS_tchar updatingDir[MAXPATHLEN]; + NS_tsnprintf(updatingDir, sizeof(updatingDir)/sizeof(updatingDir[0]), + NS_T("%s/updating"), gDestinationPath); + ensure_remove_recursive(updatingDir); } } @@ -3644,7 +3648,8 @@ int DoUpdate() { NS_tchar manifest[MAXPATHLEN]; NS_tsnprintf(manifest, sizeof(manifest)/sizeof(manifest[0]), - NS_T("%s/update.manifest"), gSourcePath); + NS_T("%s/updating/update.manifest"), gDestinationPath); + ensure_parent_dir(manifest); // extract the manifest int rv = gArchiveReader.ExtractFile("updatev2.manifest", manifest); @@ -3657,6 +3662,7 @@ int DoUpdate() } NS_tchar *rb = GetManifestContents(manifest); + NS_tremove(manifest); if (rb == NULL) { LOG(("DoUpdate: error opening manifest file: " LOG_S, manifest)); return READ_ERROR;

1 0

[tor-browser/esr24] Bug 912322 - Update semantics of IsChromeOrXBL to return true for remote XUL. r=bz
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit c13c8f0e40eaeed7a7f31f1f7fdbe48001ce3671 Author: Bobby Holley <bobbyholley(a)gmail.com> Date: Mon Feb 10 14:07:27 2014 -0800 Bug 912322 - Update semantics of IsChromeOrXBL to return true for remote XUL. r=bz This brings us into alignment with nsContentUtils::IsCallerXBL(). We also take the opportunity to clean up some comments and invariants that changed with the removal of the XBL bit. --- js/xpconnect/src/XPCWrappedNativeScope.cpp | 9 +++++++++ js/xpconnect/src/nsXPConnect.cpp | 13 ++++++++++--- js/xpconnect/src/xpcprivate.h | 17 +++++++---------- 3 files changed, 26 insertions(+), 13 deletions(-) diff --git a/js/xpconnect/src/XPCWrappedNativeScope.cpp b/js/xpconnect/src/XPCWrappedNativeScope.cpp index c3a0780..223fcc4 100644 --- a/js/xpconnect/src/XPCWrappedNativeScope.cpp +++ b/js/xpconnect/src/XPCWrappedNativeScope.cpp @@ -266,6 +266,15 @@ XPCWrappedNativeScope::EnsureXBLScope(JSContext *cx) return mXBLScope; } +bool +XPCWrappedNativeScope::AllowXBLScope() +{ + // We only disallow XBL scopes in remote XUL situations. + MOZ_ASSERT_IF(!mAllowXBLScope, + nsContentUtils::AllowXULXBLForPrincipal(GetPrincipal())); + return mAllowXBLScope; +} + namespace xpc { JSObject *GetXBLScope(JSContext *cx, JSObject *contentScopeArg) { diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp index 12a8fd0..67d4fb1 100644 --- a/js/xpconnect/src/nsXPConnect.cpp +++ b/js/xpconnect/src/nsXPConnect.cpp @@ -1713,9 +1713,16 @@ namespace dom { bool IsChromeOrXBL(JSContext* cx, JSObject* /* unused */) { - JSCompartment* compartment = js::GetContextCompartment(cx); - return AccessCheck::isChrome(compartment) || - IsXBLScope(compartment); + MOZ_ASSERT(NS_IsMainThread()); + JSCompartment* c = js::GetContextCompartment(cx); + + // For remote XUL, we run XBL in the XUL scope. Given that we care about + // compat and not security for remote XUL, we just always claim to be XBL. + // + // Note that, for performance, we don't check AllowXULXBLForPrincipal here, + // and instead rely on the fact that AllowXBLScope() only returns false in + // remote XUL situations. + return AccessCheck::isChrome(c) || IsXBLScope(c) || !AllowXBLScope(c); } } // namespace dom diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h index b63c634..af1cf89 100644 --- a/js/xpconnect/src/xpcprivate.h +++ b/js/xpconnect/src/xpcprivate.h @@ -1435,7 +1435,7 @@ public: nsAutoPtr<JSObject2JSObjectMap> mWaiverWrapperMap; bool IsXBLScope() { return mIsXBLScope; } - bool AllowXBLScope() { return mAllowXBLScope; } + bool AllowXBLScope(); bool UseXBLScope() { return mUseXBLScope; } protected: @@ -1472,20 +1472,17 @@ private: bool mIsXBLScope; - // There are certain cases where we explicitly disallow XBL scopes: they - // can be prefed off, or we might be running in a remote XUL domain where - // we want to run all XBL in content to maintain compat. We separately + // For remote XUL domains, we run all XBL in the content scope for compat + // reasons (though we sometimes pref this off for automation). We separately // track the result of this decision (mAllowXBLScope), from the decision // of whether to actually _use_ an XBL scope (mUseXBLScope), which depends // on the type of global and whether the compartment is system principal // or not. // - // This distinction is useful primarily because it tells us whether we - // can infer the XBL-ness of a caller by checking that the caller is - // running in an XBL scope, or whether we need to check the XBL bit on the - // script. The XBL bit is nasty, so we want to consult it only if we - // absolutely have to, which should generally happen only in unsupported - // pref configurations. + // This distinction is useful primarily because, if true, we know that we + // have no way of distinguishing XBL script from content script for the + // given scope. In these (unsupported) situations, we just always claim to + // be XBL. bool mAllowXBLScope; bool mUseXBLScope; };

1 0

[tor-browser/esr24] Bug 912322 - Stop making XBL methods available to the web. r=bz a=sylvestre
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit b0f60cb668c5a37f2be4dfc4aa87e5bb0d707dac Author: Bobby Holley <bobbyholley(a)gmail.com> Date: Mon Feb 10 14:07:27 2014 -0800 Bug 912322 - Stop making XBL methods available to the web. r=bz a=sylvestre --- dom/webidl/Document.webidl | 5 +++- js/xpconnect/tests/mochitest/Makefile.in | 1 + js/xpconnect/tests/mochitest/test_bug912322.html | 35 ++++++++++++++++++++++ 3 files changed, 40 insertions(+), 1 deletion(-) diff --git a/dom/webidl/Document.webidl b/dom/webidl/Document.webidl index 2233af8..4805a74 100644 --- a/dom/webidl/Document.webidl +++ b/dom/webidl/Document.webidl @@ -277,11 +277,14 @@ partial interface Document { partial interface Document { // nsIDOMDocumentXBL. Wish we could make these [ChromeOnly], but // that would likely break bindings running with the page principal. + [Func="IsChromeOrXBL"] NodeList? getAnonymousNodes(Element elt); + [Func="IsChromeOrXBL"] Element? getAnonymousElementByAttribute(Element elt, DOMString attrName, DOMString attrValue); + [Func="IsChromeOrXBL"] Element? getBindingParent(Node node); - [Throws] + [Throws, Func="IsChromeOrXBL"] void loadBindingDocument(DOMString documentURL); // nsIDOMDocumentTouch diff --git a/js/xpconnect/tests/mochitest/Makefile.in b/js/xpconnect/tests/mochitest/Makefile.in index 4c947e9..e3e1b63 100644 --- a/js/xpconnect/tests/mochitest/Makefile.in +++ b/js/xpconnect/tests/mochitest/Makefile.in @@ -96,6 +96,7 @@ MOCHITEST_FILES = chrome_wrappers_helper.html \ test_bug865260.html \ test_bug870423.html \ test_bug871887.html \ + test_bug912322.html \ file_crosscompartment_weakmap.html \ test_crosscompartment_weakmap.html \ test_asmjs.html \ diff --git a/js/xpconnect/tests/mochitest/test_bug912322.html b/js/xpconnect/tests/mochitest/test_bug912322.html new file mode 100644 index 0000000..22fcc9f --- /dev/null +++ b/js/xpconnect/tests/mochitest/test_bug912322.html @@ -0,0 +1,35 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta charset="utf-8"> + <title>Test for Bug 912322</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> + <script type="application/javascript"> + + /** Test that XBL functions aren't exposed to the web. **/ + funs = ['getAnonymousNodes', 'getAnonymousElementByAttribute', + 'getBindingParent', 'loadBindingDocument']; + for (var f of funs) { + ok(!(f in document), f + " should not be available to content"); + ok(f in SpecialPowers.wrap(document), f + " should be available to chrome via Xray"); + } + + + + + </script> +</head> +<body> +<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=912322">Mozilla Bug 912322</a> +<p id="display"></p> +<div id="content" style="display: none"> + +</div> +<pre id="test"> +</pre> +</body> +</html>

1 0