Bug 654137 - Make window.top not replacable; r=bz
authorMs2ger <ms2ger@gmail.com>
Tue, 10 May 2011 20:24:44 +0200
changeset 69261 d75f13dbf81fd5e4f11835ae40e26169e994fc8d
parent 69260 95dad5bda710ee99bf6a1e8938089840e52cfb0c
child 69262 b68afa9fd243acb26283e3b4236ad568af6f3fd2
push id19901
push userMs2ger@gmail.com
push dateTue, 10 May 2011 18:34:22 +0000
treeherdermozilla-central@c6bea9fce84e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs654137
milestone6.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 654137 - Make window.top not replacable; r=bz
dom/base/nsDOMClassInfo.cpp
dom/base/nsDOMClassInfo.h
dom/tests/mochitest/bugs/Makefile.in
dom/tests/mochitest/bugs/test_bug654137.html
toolkit/content/tests/widgets/test_contextmenu_list.xul
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -1559,17 +1559,16 @@ static const nsConstructorFuncMapData kC
 
 nsIXPConnect *nsDOMClassInfo::sXPConnect = nsnull;
 nsIScriptSecurityManager *nsDOMClassInfo::sSecMan = nsnull;
 PRBool nsDOMClassInfo::sIsInitialized = PR_FALSE;
 PRBool nsDOMClassInfo::sDisableDocumentAllSupport = PR_FALSE;
 PRBool nsDOMClassInfo::sDisableGlobalScopePollutionSupport = PR_FALSE;
 
 
-jsid nsDOMClassInfo::sTop_id             = JSID_VOID;
 jsid nsDOMClassInfo::sParent_id          = JSID_VOID;
 jsid nsDOMClassInfo::sScrollbars_id      = JSID_VOID;
 jsid nsDOMClassInfo::sLocation_id        = JSID_VOID;
 jsid nsDOMClassInfo::sConstructor_id     = JSID_VOID;
 jsid nsDOMClassInfo::s_content_id        = JSID_VOID;
 jsid nsDOMClassInfo::sContent_id         = JSID_VOID;
 jsid nsDOMClassInfo::sMenubar_id         = JSID_VOID;
 jsid nsDOMClassInfo::sToolbar_id         = JSID_VOID;
@@ -1894,17 +1893,16 @@ nsDOMClassInfo::DefineStaticJSVals(JSCon
 #define SET_JSID_TO_STRING(_id, _cx, _str)                                    \
   if (JSString *str = ::JS_InternString(_cx, _str))                           \
       _id = INTERNED_STRING_TO_JSID(str);                                     \
   else                                                                        \
       return NS_ERROR_OUT_OF_MEMORY;
 
   JSAutoRequest ar(cx);
 
-  SET_JSID_TO_STRING(sTop_id,             cx, "top");
   SET_JSID_TO_STRING(sParent_id,          cx, "parent");
   SET_JSID_TO_STRING(sScrollbars_id,      cx, "scrollbars");
   SET_JSID_TO_STRING(sLocation_id,        cx, "location");
   SET_JSID_TO_STRING(sConstructor_id,     cx, "constructor");
   SET_JSID_TO_STRING(s_content_id,        cx, "_content");
   SET_JSID_TO_STRING(sContent_id,         cx, "content");
   SET_JSID_TO_STRING(sMenubar_id,         cx, "menubar");
   SET_JSID_TO_STRING(sToolbar_id,         cx, "toolbar");
@@ -5017,17 +5015,16 @@ nsDOMClassInfo::ShutDown()
   if (sClassInfoData[0].u.mConstructorFptr) {
     PRUint32 i;
 
     for (i = 0; i < eDOMClassInfoIDCount; i++) {
       NS_IF_RELEASE(sClassInfoData[i].mCachedClassInfo);
     }
   }
 
-  sTop_id             = JSID_VOID;
   sParent_id          = JSID_VOID;
   sScrollbars_id      = JSID_VOID;
   sLocation_id        = JSID_VOID;
   sConstructor_id     = JSID_VOID;
   s_content_id        = JSID_VOID;
   sContent_id         = JSID_VOID;
   sMenubar_id         = JSID_VOID;
   sToolbar_id         = JSID_VOID;
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@@ -197,18 +197,17 @@ protected:
   // Checks if id is a number and returns the number, if aIsNumber is
   // non-null it's set to true if the id is a number and false if it's
   // not a number. If id is not a number this method returns -1
   static PRInt32 GetArrayIndexFromId(JSContext *cx, jsid id,
                                      PRBool *aIsNumber = nsnull);
 
   static inline PRBool IsReadonlyReplaceable(jsid id)
   {
-    return (id == sTop_id          ||
-            id == sParent_id       ||
+    return (id == sParent_id       ||
             id == sScrollbars_id   ||
             id == sContent_id      ||
             id == sMenubar_id      ||
             id == sToolbar_id      ||
             id == sLocationbar_id  ||
             id == sPersonalbar_id  ||
             id == sStatusbar_id    ||
             id == sControllers_id  ||
@@ -241,17 +240,16 @@ protected:
   // nsIXPCScriptable code
   static nsresult DefineStaticJSVals(JSContext *cx);
 
   static PRBool sIsInitialized;
   static PRBool sDisableDocumentAllSupport;
   static PRBool sDisableGlobalScopePollutionSupport;
 
 public:
-  static jsid sTop_id;
   static jsid sParent_id;
   static jsid sScrollbars_id;
   static jsid sLocation_id;
   static jsid sConstructor_id;
   static jsid s_content_id;
   static jsid sContent_id;
   static jsid sMenubar_id;
   static jsid sToolbar_id;
--- a/dom/tests/mochitest/bugs/Makefile.in
+++ b/dom/tests/mochitest/bugs/Makefile.in
@@ -133,14 +133,15 @@ include $(topsrcdir)/config/rules.mk
 		file_bug593174_2.html \
 		test_bug612267.html \
 		test_bug617296.html \
 		test_bug620947.html \
 		test_bug622361.html \
 		test_bug633133.html \
 		test_bug642026.html \
 		test_bug648465.html \
+		test_bug654137.html \
 		test_window_bar.html \
 		file_window_bar.html \
 		$(NULL)
 
 libs:: 	$(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
new file mode 100644
--- /dev/null
+++ b/dom/tests/mochitest/bugs/test_bug654137.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=654137
+-->
+<head>
+  <title>Test for Bug 654137</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=654137">Mozilla Bug 654137</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+/** Test for Bug 654137 **/
+var prev = window.top;
+top = "Fail";
+is(top, prev, "top should not have been replaced");
+</script>
+</pre>
+</body>
+</html>
--- a/toolkit/content/tests/widgets/test_contextmenu_list.xul
+++ b/toolkit/content/tests/widgets/test_contextmenu_list.xul
@@ -179,18 +179,18 @@ function isRoundedY(a, b, msg)
 
 function checkContextMenu(event)
 {
   var rect = $(gTestElement).getBoundingClientRect();
 
   var frombase = (gTestId == -1 || gTestId == 1);
   if (!frombase)
     rect = event.originalTarget.getBoundingClientRect();
-  left = frombase ? rect.left + 7 : rect.left;
-  top = frombase ? rect.top + 4 : rect.bottom;
+  var left = frombase ? rect.left + 7 : rect.left;
+  var top = frombase ? rect.top + 4 : rect.bottom;
 
   isRoundedX(event.clientX, left, gTestElement + " clientX " + gSelectionStep + " " + gTestId + "," + frombase);
   isRoundedY(event.clientY, top, gTestElement + " clientY " + gSelectionStep + " " + gTestId);
   ok(event.screenX > left, gTestElement + " screenX " + gSelectionStep + " " + gTestId);
   ok(event.screenY > top, gTestElement + " screenY " + gSelectionStep + " " + gTestId);
 
   // context menu from mouse click
   switch (gTestId) {