Bug 1015380 - Fix up devtools server. r=past
authorBobby Holley <bobbyholley@gmail.com>
Wed, 28 May 2014 11:14:27 -0700
changeset 185452 bc52bb3096bcf9eb7357312f310eccdc2d2ccfbc
parent 185451 0b3ee6ef6c2f2224fcae4b40eddfecae464ea5cc
child 185453 9cf0477054739455147fd3a2f5e5228e9a514c00
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewerspast
bugs1015380
milestone32.0a1
Bug 1015380 - Fix up devtools server. r=past
toolkit/devtools/server/actors/script.js
--- a/toolkit/devtools/server/actors/script.js
+++ b/toolkit/devtools/server/actors/script.js
@@ -3641,17 +3641,28 @@ DebuggerServer.ObjectActorPreviewers = {
 
     // Avoid recursive object grips.
     if (threadActor._gripDepth > 1) {
       return true;
     }
 
     let raw = obj.unsafeDereference();
     let items = aGrip.preview.items = [];
-    for (let item of Set.prototype.values.call(raw)) {
+    // We currently lack XrayWrappers for Set, so when we iterate over
+    // the values, the temporary iterator objects get created in the target
+    // compartment. However, we _do_ have Xrays to Object now, so we end up
+    // Xraying those temporary objects, and filtering access to |it.value|
+    // based on whether or not it's Xrayable and/or callable, which breaks
+    // the for/of iteration.
+    //
+    // This code is designed to handle untrusted objects, so we can safely
+    // waive Xrays on the iterable, and relying on the Debugger machinery to
+    // make sure we handle the resulting objects carefully.
+    for (let item of Cu.waiveXrays(Set.prototype.values.call(raw))) {
+      item = Cu.unwaiveXrays(item);
       item = makeDebuggeeValueIfNeeded(obj, item);
       items.push(threadActor.createValueGrip(item));
       if (items.length == OBJECT_PREVIEW_MAX_ITEMS) {
         break;
       }
     }
 
     return true;