Bug 836301 - Stop using JSRESOLVE_ASSIGNING to determine GET vs SET. r=mrbkap

This is just a heuristic, anyway, and some of the usage is downright broken.
There are two cases here:

1 - Deciding what to do for get{Own,}PropertyDescriptor. In these cases, we can
just enter with GET and rely on the filtering machinery to filter out dangerous
setters for security wrappers.

2 - Custom Xray props. None of these make sense in a |set| context. In fact,
    they generally have null setters anyway, so we can just assume GET.

The policy-entering code in XrayWrapper is super haphazard. We'll get rid of it
entirely later in these patches.

js/src/jswrapper.cpp

@@ -151,8 +151,7 @@ Wrapper::getPropertyDescriptor(JSContext *cx, JSObject *wrapperArg,
     RootedObject wrapper(cx, wrapperArg);
     JS_ASSERT(!hasPrototype()); // Should never be called when there's a prototype.
     desc->obj = NULL; // default result if we refuse to perform this action
-    CHECKED(DirectProxyHandler::getPropertyDescriptor(cx, wrapper, id, desc, flags),
-            (flags & JSRESOLVE_ASSIGNING) ? SET : GET);
+    CHECKED(DirectProxyHandler::getPropertyDescriptor(cx, wrapper, id, desc, flags), GET);
 }
 
 bool

js/xpconnect/wrappers/XrayWrapper.cpp

@@ -726,8 +726,7 @@ XPCWrappedNativeXrayTraits::resolveNativeProperty(JSContext *cx, JSObject *wrapp
 {
     MOZ_ASSERT(js::GetObjectJSClass(holder) == &HolderClass);
     XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
-    if (!(flags & JSRESOLVE_ASSIGNING) &&
-        id == rt->GetStringID(XPCJSRuntime::IDX_MOZMATCHESSELECTOR) &&
+    if (id == rt->GetStringID(XPCJSRuntime::IDX_MOZMATCHESSELECTOR) &&
         Is<nsIDOMElement>(wrapper))
     {
         // XPC calling mechanism cannot handle call/bind properly in some cases
@@ -986,9 +985,8 @@ XPCWrappedNativeXrayTraits::resolveOwnProperty(JSContext *cx, js::Wrapper &jsWra
           (id == rt->GetStringID(XPCJSRuntime::IDX_DOCUMENTURIOBJECT) &&
           Is<nsIDocument>(wrapper)))) {
         bool status;
-        Wrapper::Action action = (flags & JSRESOLVE_ASSIGNING) ? Wrapper::SET : Wrapper::GET;
         desc->obj = NULL; // default value
-        if (!jsWrapper.enter(cx, wrapper, id, action, &status))
+        if (!jsWrapper.enter(cx, wrapper, id, Wrapper::GET, &status))
             return status;
 
         desc->obj = wrapper;
@@ -1410,9 +1408,8 @@ XrayWrapper<Base, Traits>::getPropertyDescriptor(JSContext *cx, JSObject *wrappe
     }
 
     bool status;
-    Wrapper::Action action = (flags & JSRESOLVE_ASSIGNING) ? Wrapper::SET : Wrapper::GET;
     desc->obj = NULL; // default value
-    if (!this->enter(cx, wrapper, id, action, &status))
+    if (!this->enter(cx, wrapper, id, Wrapper::GET, &status))
         return status;
 
     typename Traits::ResolvingIdImpl resolving(wrapper, id);
@@ -1441,9 +1438,8 @@ XrayWrapper<Base, Traits>::getPropertyDescriptor(JSContext *cx, JSObject *wrappe
     if (AccessCheck::wrapperSubsumes(wrapper) &&
         id == rt->GetStringID(XPCJSRuntime::IDX_WRAPPED_JSOBJECT)) {
         bool status;
-        Wrapper::Action action = (flags & JSRESOLVE_ASSIGNING) ? Wrapper::SET : Wrapper::GET;
         desc->obj = NULL; // default value
-        if (!this->enter(cx, wrapper, id, action, &status))
+        if (!this->enter(cx, wrapper, id, Wrapper::GET, &status))
             return status;
 
         desc->obj = wrapper;
@@ -1540,9 +1536,8 @@ XrayWrapper<Base, Traits>::getOwnPropertyDescriptor(JSContext *cx, JSObject *wra
     }
 
     bool status;
-    Wrapper::Action action = (flags & JSRESOLVE_ASSIGNING) ? Wrapper::SET : Wrapper::GET;
     desc->obj = NULL; // default value
-    if (!this->enter(cx, wrapper, id, action, &status))
+    if (!this->enter(cx, wrapper, id, Wrapper::GET, &status))
         return status;
 
     typename Traits::ResolvingIdImpl resolving(wrapper, id);
@@ -1596,6 +1591,8 @@ XrayWrapper<Base, Traits>::defineProperty(JSContext *cx, JSObject *wrapper, jsid
                                      desc->attrs);
     }
 
+    // NB: We still need JSRESOLVE_ASSIGNING here for the time being, because it
+    // tells things like nodelists whether they should create the property or not.
     PropertyDescriptor existing_desc;
     if (!getOwnPropertyDescriptor(cx, wrapper, id, &existing_desc, JSRESOLVE_ASSIGNING))
         return false;