Bug 1344443. Fix [[SetPrototypeOf]] on cross-origin objects to follow the spec. r=bholley,waldo

MozReview-Commit-ID: JI9fbQTS0PS

js/xpconnect/tests/mochitest/test_bug965082.html

@@ -15,7 +15,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=965082
 
   function checkThrows(f, msg) {
     try { f(); ok(false, "Should have thrown: " + msg); }
-    catch (e) { ok(/denied|insecure/.test(e), "Should throw security exception: " + e + " (" + msg + ")"); }
+    catch (e) { ok(/denied|insecure|can't set prototype/.test(e), "Should throw security exception: " + e + " (" + msg + ")"); }
   }
 
   function go() {

js/xpconnect/wrappers/FilteringWrapper.cpp

@@ -301,6 +301,20 @@ CrossOriginXrayWrapper::delete_(JSContext* cx, JS::Handle<JSObject*> wrapper,
     return false;
 }
 
+bool
+CrossOriginXrayWrapper::setPrototype(JSContext* cx, JS::HandleObject wrapper,
+                                     JS::HandleObject proto,
+                                     JS::ObjectOpResult& result) const
+{
+    // https://html.spec.whatwg.org/multipage/browsers.html#windowproxy-setprototypeof
+    // and
+    // https://html.spec.whatwg.org/multipage/browsers.html#location-setprototypeof
+    // both say to return false.  In terms of ObjectOpResult that means
+    // calling one of the fail*() things on it, and it's got one that does just
+    // what we want.
+    return result.failCantSetProto();
+}
+
 #define XOW FilteringWrapper<CrossOriginXrayWrapper, CrossOriginAccessiblePropertiesOnly>
 #define NNXOW FilteringWrapper<CrossCompartmentSecurityWrapper, Opaque>
 #define NNXOWC FilteringWrapper<CrossCompartmentSecurityWrapper, OpaqueWithCall>

js/xpconnect/wrappers/FilteringWrapper.h

@@ -80,6 +80,10 @@ class CrossOriginXrayWrapper : public SecurityXrayDOM {
     virtual bool getPropertyDescriptor(JSContext* cx, JS::Handle<JSObject*> wrapper,
                                        JS::Handle<jsid> id,
                                        JS::MutableHandle<JS::PropertyDescriptor> desc) const override;
+
+    virtual bool setPrototype(JSContext* cx, JS::HandleObject wrapper,
+                              JS::HandleObject proto,
+                              JS::ObjectOpResult& result) const override;
 };
 
 // Check whether the given jsid is a symbol whose value can be gotten

testing/web-platform/meta/html/browsers/origin/cross-origin-objects/cross-origin-objects.html.ini

@@ -1,5 +0,0 @@
-[cross-origin-objects.html]
-  type: testharness
-  [[[SetPrototypeOf\]\] should throw (exception type)]
-    expected: FAIL
-

testing/web-platform/tests/html/browsers/origin/cross-origin-objects/cross-origin-objects.html

@@ -146,7 +146,13 @@ addTest(function(exception_t) {
     test_throws(exception_t, new TypeError, function() { protoSetter.call(C, new Object()); }, "proto setter |call| on cross-origin Window");
     test_throws(exception_t, new TypeError, function() { protoSetter.call(C.location, new Object()); }, "proto setter |call| on cross-origin Location");
   });
-}, "[[SetPrototypeOf]] should throw");
+  if (Reflect.setPrototypeOf) {
+    assert_false(Reflect.setPrototypeOf(C, new Object()),
+                 "Reflect.setPrototypeOf on cross-origin Window");
+    assert_false(Reflect.setPrototypeOf(C, new Object()),
+                "Reflect.setPrototypeOf on cross-origin Location");
+  }
+}, "[[SetPrototypeOf]] should return false");
 
 /*
  * [[IsExtensible]]