Bug 1491488 - Stop waiving the return value of the Sandbox constructor when wantXrays is false. r=kmag
authorBobby Holley <bobbyholley@gmail.com>
Fri, 14 Sep 2018 12:07:01 -0700
changeset 436814 fcc53ec73be98f90478b2437c90be9b751fd7145
parent 436813 a0a8c075863138ce064fd45dbac8b8a034ef72eb
child 436815 057a798ae66189f81a2b2944080c7f481347f723
push id34660
push userbtara@mozilla.com
push dateMon, 17 Sep 2018 21:58:52 +0000
treeherdermozilla-central@87a95e1b7ec6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerskmag
bugs1491488
milestone64.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1491488 - Stop waiving the return value of the Sandbox constructor when wantXrays is false. r=kmag MozReview-Commit-ID: 9DrgknOT0Z3
js/xpconnect/src/Sandbox.cpp
js/xpconnect/tests/chrome/test_evalInSandbox.xul
js/xpconnect/tests/unit/test_bug845862.js
--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@@ -1873,23 +1873,16 @@ nsXPCComponents_utils_Sandbox::CallOrCon
     }
 
     rv = CreateSandboxObject(cx, args.rval(), prinOrSop, options);
 
     if (NS_FAILED(rv)) {
         return ThrowAndFail(rv, cx, _retval);
     }
 
-    // We have this crazy behavior where wantXrays=false also implies that the
-    // returned sandbox is implicitly waived. We've stopped advertising it, but
-    // keep supporting it for now.
-    if (!options.wantXrays && !xpc::WrapperFactory::WaiveXrayAndWrap(cx, args.rval())) {
-        return NS_ERROR_UNEXPECTED;
-    }
-
     *_retval = true;
     return NS_OK;
 }
 
 nsresult
 xpc::EvalInSandbox(JSContext* cx, HandleObject sandboxArg, const nsAString& source,
                    const nsACString& filename, int32_t lineNo,
                    MutableHandleValue rval)
--- a/js/xpconnect/tests/chrome/test_evalInSandbox.xul
+++ b/js/xpconnect/tests/chrome/test_evalInSandbox.xul
@@ -72,20 +72,24 @@ https://bugzilla.mozilla.org/show_bug.cg
 
         sandbox =
           new Cu.Sandbox(win, { sandboxPrototype: win, wantXrays: false } );
 
         checkCrossOriginSandbox(sandbox);
 
         ok(Cu.evalInSandbox("('foo' in this.document);", sandbox),
            "can see expandos");
-        ok(("foo" in Cu.evalInSandbox("this.document", sandbox)),
-           "must see expandos in wrappers returned from the sandbox");
+        ok(!("foo" in Cu.evalInSandbox("this.document", sandbox)),
+           "must not see expandos in wrappers returned from the sandbox");
+        ok(("foo" in Cu.waiveXrays(Cu.evalInSandbox("this.document", sandbox))),
+           "must see expandos in waived wrappers returned from the sandbox");
 
-        ok(("foo" in sandbox.document),
+        ok(!("foo" in sandbox.document),
+           "must not see expandos in wrappers obtained from the sandbox");
+        ok("foo" in Cu.waiveXrays(sandbox.document),
            "must see expandos in wrappers obtained from the sandbox");
 
         testDone();
       }
 
       function checkSameOrigin(ifr) {
         var win = ifr.contentWindow;
         var sandbox =
--- a/js/xpconnect/tests/unit/test_bug845862.js
+++ b/js/xpconnect/tests/unit/test_bug845862.js
@@ -1,11 +1,7 @@
 function run_test() {
-  // We rely on the crazy "wantXrays:false also causes values return from the
-  // sandbox to be waived" behavior, because it's the simplest way to get
-  // waivers out of the sandbox (which has no native objects). :-(
-  var sb = new Cu.Sandbox('http://www.example.com', {wantXrays: false});
+  var sb = new Cu.Sandbox('http://www.example.com');
   Cu.evalInSandbox("this.foo = {}; Object.defineProperty(foo, 'bar', {get: function() {return {};}});", sb);
-  Assert.ok(sb.foo != XPCNativeWrapper(sb.foo), "sb.foo is waived");
-  var desc = Object.getOwnPropertyDescriptor(sb.foo, 'bar');
+  var desc = Object.getOwnPropertyDescriptor(Cu.waiveXrays(sb.foo), 'bar');
   var b = desc.get();
   Assert.ok(b != XPCNativeWrapper(b), "results from accessor descriptors are waived");
 }