Bug 1773732 - Set proto outparam in RemoteObjectProxyBase::getPrototypeIfOrdinary. r=peterv

This prevents us from ilooping in `SetPrototype`. Differential Revision: https://phabricator.services.mozilla.com/D149261
2022-06-15 09:30:33 +00:00 · 2022-06-15 09:30:33 +00:00 · 3b8f2c6431
--- a/dom/bindings/RemoteObjectProxy.cpp
+++ b/dom/bindings/RemoteObjectProxy.cpp
@ -75,6 +75,7 @@ bool RemoteObjectProxyBase::getPrototypeIfOrdinary(
  // We nonetheless can implement it with a static [[Prototype]], because the
  // [[GetPrototypeOf]] trap should always return null.
  *aIsOrdinary = true;
+  aProtop.set(nullptr);
  return true;
 }

--- a/dom/bindings/test/mochitest.ini
+++ b/dom/bindings/test/mochitest.ini
@ -99,3 +99,4 @@ skip-if = debug == false
 [test_observablearray_helper.html]
 skip-if = debug == false
 [test_large_imageData.html]
+[test_remoteProxyAsPrototype.html]
--- a/dom/bindings/test/test_remoteProxyAsPrototype.html
+++ b/dom/bindings/test/test_remoteProxyAsPrototype.html
@ -0,0 +1,33 @@
+<!-- Any copyright is dedicated to the Public Domain.
+- http://creativecommons.org/publicdomain/zero/1.0/ -->
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>Test for bug 1773732</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<script>
+
+SimpleTest.waitForExplicitFinish();
+
+function go() {
+  let frame = document.createElement("iframe");
+  frame.onload = () => {
+    let win = frame.contentWindow;
+    is(SpecialPowers.Cu.isRemoteProxy(win), SpecialPowers.useRemoteSubframes,
+       "win is a remote proxy if Fission is enabled");
+    let o = {};
+    Object.setPrototypeOf(o, win);
+    is(Object.getPrototypeOf(o), win, "should have expected proto");
+    SimpleTest.finish();
+  };
+  frame.src = "https://example.com";
+  document.body.appendChild(frame);
+};
+go();
+
+</script>
+</body>
+</html>