Bug 781476 - Cross-compartment wrap same-origin objects with PreCreat…

…e even if PreCreate requests one wrapper per scope. r=mrbkap a=lsblakk
mozilla · Aug 14, 2012 · ba6b771 · ba6b771
1 parent 76d2aed
commit ba6b771
Show file tree

Hide file tree

Showing 4 changed files with 62 additions and 0 deletions.
diff --git a/js/xpconnect/tests/mochitest/Makefile.in b/js/xpconnect/tests/mochitest/Makefile.in
@@ -65,6 +65,8 @@ _TEST_FILES =	bug500931_helper.html \
 		test_bug745483.html \
 		file_bug758563.html \
 		test_bug764389.html \
+		test_bug781476.html \
+		file_bug781476.html \
 		file_nodelists.html \
 		file_bug706301.html \
 		file_exnstack.html \

diff --git a/js/xpconnect/tests/mochitest/file_bug781476.html b/js/xpconnect/tests/mochitest/file_bug781476.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="application/javascript">
+function makeEvent() {
+  var evt = new Event("MouseEvents");
+  evt.expando = 42;
+  is(evt.expando, 42, "Expando properly visible in iframe");
+  return evt;
+}
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/js/xpconnect/tests/mochitest/test_bug781476.html b/js/xpconnect/tests/mochitest/test_bug781476.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=781476
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 781476</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=781476">Mozilla Bug 781476</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<iframe onload="go();" id="ifr" src="file_bug781476.html"></iframe>
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 781476 **/
+SimpleTest.waitForExplicitFinish();
+
+function go() {
+  var iwin = document.getElementById('ifr').contentWindow;
+  iwin.is = is;
+  var evt = iwin.makeEvent();
+  is(evt.expando, 42, "Expando properly visible in caller frame");
+  SimpleTest.finish();
+}
+
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/js/xpconnect/wrappers/WrapperFactory.cpp b/js/xpconnect/wrappers/WrapperFactory.cpp
@@ -222,6 +222,15 @@ WrapperFactory::PrepareForWrapping(JSContext *cx, JSObject *scope, JSObject *obj
 
                 // Ok, must be case (1). Fall through and create a new wrapper.
             }
+
+            // Nasty hack for late-breaking bug 781476. This will confuse identity checks,
+            // but it's probably better than any of our alternatives.
+            if (!AccessCheck::isChrome(js::GetObjectCompartment(scope)) &&
+                 AccessCheck::isSameOrigin(js::GetObjectCompartment(scope),
+                                           js::GetObjectCompartment(obj)))
+            {
+                return DoubleWrap(cx, obj, flags);
+            }
         }
     }