Bug 1490257 - Add asserts into loadURI where we imply SystemPrincipal. r=ckerschb

Differential Revision: https://phabricator.services.mozilla.com/D10221 --HG-- extra : moz-landing-system : lando
2018-10-31 18:00:40 +00:00 · 2018-10-31 18:00:40 +00:00 · 873b26107e
--- a/accessible/tests/browser/events/browser_test_docload.js
+++ b/accessible/tests/browser/events/browser_test_docload.js
@ -41,7 +41,7 @@ async function runTests(browser, accDoc) {
      [EVENT_STATE_CHANGE, inIframeChecker("iframe1")]]
  });

-  browser.loadURI(`data:text/html;charset=utf-8,
+  BrowserTestUtils.loadURI(browser, `data:text/html;charset=utf-8,
    <html><body id="body2">
      <iframe id="iframe1" src="http://example.com"></iframe>
    </body></html>`);
@ -54,7 +54,7 @@ async function runTests(browser, accDoc) {
      [EVENT_REORDER, getAccessible(browser)]
  ]);

-  browser.loadURI("about:about");
+  BrowserTestUtils.loadURI(browser, "about:about");

  await onLoadEvents;

@ -74,7 +74,7 @@ async function runTests(browser, accDoc) {
    [EVENT_REORDER, getAccessible(browser)]
  ]);

-  browser.loadURI("about:mozilla");
+  BrowserTestUtils.loadURI(browser, "about:mozilla");

  await onLoadEvents;

@ -94,7 +94,7 @@ async function runTests(browser, accDoc) {
    [EVENT_REORDER, getAccessible(browser)]
  ]);

-  browser.loadURI("http://www.wronguri.wronguri/");
+  BrowserTestUtils.loadURI(browser, "http://www.wronguri.wronguri/");

  await onLoadEvents;

@ -104,7 +104,7 @@ async function runTests(browser, accDoc) {
    [EVENT_REORDER, getAccessible(browser)]
  ]);

-  browser.loadURI("https://nocert.example.com:443/");
+  BrowserTestUtils.loadURI(browser, "https://nocert.example.com:443/");

  await onLoadEvents;
 }
--- a/browser/components/sessionstore/ContentRestore.jsm
+++ b/browser/components/sessionstore/ContentRestore.jsm
@ -199,7 +199,7 @@ ContentRestoreInternal.prototype = {
                       Utils.makeInputStream(loadArguments.postData) : null;
        let triggeringPrincipal = loadArguments.triggeringPrincipal
                                  ? Utils.deserializePrincipal(loadArguments.triggeringPrincipal)
-                                  : null;
+                                  : Services.scriptSecurityManager.createNullPrincipal({});

        if (loadArguments.userContextId) {
          webNavigation.setOriginAttributesBeforeLoading({ userContextId: loadArguments.userContextId });
--- a/browser/components/sessionstore/test/browser_docshell_uuid_consistency.js
+++ b/browser/components/sessionstore/test/browser_docshell_uuid_consistency.js
@ -43,7 +43,8 @@ add_task(async function contentToChromeNavigate() {
  await ContentTask.spawn(tab.linkedBrowser, null, function() {
    const CHROME_URL = "about:config";
    let webnav = content.window.getInterface(Ci.nsIWebNavigation);
-    webnav.loadURI(CHROME_URL, Ci.nsIWebNavigation.LOAD_FLAGS_NONE, null, null, null);
+    let systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+    webnav.loadURI(CHROME_URL, Ci.nsIWebNavigation.LOAD_FLAGS_NONE, null, null, null, systemPrincipal);
  });
  await BrowserTestUtils.browserLoaded(tab.linkedBrowser);

--- a/browser/extensions/webcompat-reporter/experimentalAPIs/tabExtras.js
+++ b/browser/extensions/webcompat-reporter/experimentalAPIs/tabExtras.js
@ -130,8 +130,9 @@ this.tabExtras = class extends ExtensionAPI {
              },
            };
            windowTracker.addListener("progress", listener);
+            let triggeringPrincipal = Services.scriptSecurityManager.createNullPrincipal({});
            tab.browser.webNavigation.loadURIWithOptions(url, null, null, null,
-                                                         post, null, null, null);
+                                                         post, null, null, triggeringPrincipal);
          });
        },
        async getWebcompatInfo(tabId) {
--- a/devtools/server/actors/targets/webextension.js
+++ b/devtools/server/actors/targets/webextension.js
@ -174,9 +174,10 @@ webExtensionTargetPrototype._createFallbackWindow = function() {

 webExtensionTargetPrototype._destroyFallbackWindow = function() {
  if (this.fallbackWebNav) {
+    const systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
    // Explicitly close the fallback windowless browser to prevent it to leak
    // (and to prevent it to freeze devtools xpcshell tests).
-    this.fallbackWebNav.loadURI("about:blank", 0, null, null, null);
+    this.fallbackWebNav.loadURI("about:blank", 0, null, null, null, systemPrincipal);
    this.fallbackWebNav.close();

    this.fallbackWebNav = null;
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@ -4080,6 +4080,9 @@ nsDocShell::LoadURI(const nsAString& aURI,
                    nsIInputStream* aHeaderStream,
                    nsIPrincipal* aTriggeringPrincipal)
 {
+#ifndef ANDROID
+  MOZ_ASSERT(aTriggeringPrincipal, "LoadURI: Need a valid triggeringPrincipal");
+#endif
  return LoadURIWithOptions(aURI, aLoadFlags, aReferringURI,
                            RP_Unset, aPostStream,
                            aHeaderStream, nullptr, aTriggeringPrincipal);
@ -4115,6 +4118,11 @@ nsDocShell::LoadURIWithOptions(const nsAString& aURI,
  uriString.StripCRLF();
  NS_ENSURE_TRUE(!uriString.IsEmpty(), NS_ERROR_FAILURE);

+#ifndef ANDROID
+  MOZ_ASSERT(aTriggeringPrincipal, "LoadURIWithOptions: Need a valid triggeringPrincipal");
+#endif
+
+
  rv = NS_NewURI(getter_AddRefs(uri), uriString);
  if (uri) {
    aLoadFlags &= ~LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP;
@ -9010,6 +9018,9 @@ public:
  NS_IMETHOD
  Run() override
  {
+#ifndef ANDROID
+    MOZ_ASSERT(mTriggeringPrincipal, "InternalLoadEvent: Should always have a principal here");
+#endif
    return mDocShell->InternalLoad(mURI, mOriginalURI, mResultPrincipalURI,
                                   mKeepResultPrincipalURIIfSet,
                                   mLoadReplace,
@ -13086,6 +13097,9 @@ nsDocShell::OnLinkClick(nsIContent* aContent,
                        bool aIsTrusted,
                        nsIPrincipal* aTriggeringPrincipal)
 {
+#ifndef ANDROID
+  MOZ_ASSERT(aTriggeringPrincipal, "Need a valid triggeringPrincipal");
+#endif
  NS_ASSERTION(NS_IsMainThread(), "wrong thread");

  if (!IsNavigationAllowed() || !IsOKToLoadURI(aURI)) {
--- a/docshell/base/nsDocShellLoadState.cpp
+++ b/docshell/base/nsDocShellLoadState.cpp
@ -495,6 +495,9 @@ nsDocShellLoadState::SetupTriggeringPrincipal(const mozilla::OriginAttributes& a
        return NS_ERROR_FAILURE;
      }
    } else {
+#ifndef ANDROID
+      MOZ_ASSERT(false, "LoadURI: System principal required.");
+#endif
      mTriggeringPrincipal = nsContentUtils::GetSystemPrincipal();
    }
  }
--- a/docshell/base/nsDocShellTreeOwner.cpp
+++ b/docshell/base/nsDocShellTreeOwner.cpp
@ -978,6 +978,9 @@ nsDocShellTreeOwner::HandleEvent(Event* aEvent)
          nsAutoString url;
          if (NS_SUCCEEDED(links[0]->GetUrl(url))) {
            if (!url.IsEmpty()) {
+#ifndef ANDROID
+              MOZ_ASSERT(triggeringPrincipal, "nsDocShellTreeOwner::HandleEvent: Need a valid triggeringPrincipal");
+#endif
              webnav->LoadURI(url, 0, nullptr, nullptr, nullptr,
                              triggeringPrincipal);
            }
--- a/docshell/test/unit/test_setUsePrivateBrowsing.js
+++ b/docshell/test/unit/test_setUsePrivateBrowsing.js
@ -34,7 +34,8 @@ add_task(async function() {
  equal(loadContext.usePrivateBrowsing, false,
        "Should be able to change origin attributes prior to a document load");

-  webNav.loadURI("data:text/html,", webNav.LOAD_FLAGS_NONE, null, null, null);
+  let systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+  webNav.loadURI("data:text/html,", webNav.LOAD_FLAGS_NONE, null, null, null, systemPrincipal);

  // Return to the event loop so the load can begin.
  await new Promise(executeSoon);
--- a/dom/base/MessageBroadcaster.h
+++ b/dom/base/MessageBroadcaster.h
@ -8,6 +8,7 @@
 #define mozilla_dom_MessageBroadcaster_h

 #include "mozilla/dom/MessageListenerManager.h"
+#include "nsContentUtils.h"

 namespace mozilla {
 namespace dom {
--- a/dom/base/test/chrome/test_bug430050.xul
+++ b/dom/base/test/chrome/test_bug430050.xul
@ -33,9 +33,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=430050
        if (evt.target == evt.currentTarget) {
          document.getElementById('b').setAttribute("src",
                                                    "data:text/plain,failed");
-          document.getElementById('b').loadURI('data:text/plain,succeeded',
-                                               null,
-                                               'UTF-8');
+          const systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+          document.getElementById('b').loadURI('data:text/plain,succeeded', {
+            triggeringPrincipal: systemPrincipal
+          });
          document.getElementById('b').addEventListener("load", endTest);
        }
      }, true);
--- a/dom/base/test/chrome/test_chromeOuterWindowID.xul
+++ b/dom/base/test/chrome/test_chromeOuterWindowID.xul
@ -83,9 +83,9 @@ windows.
    ok(nonRemote && !nonRemote.isRemoteBrowser,
       "Should have found a non-remote browser in test window " + num);

-    remote.loadURI(page);
+    BrowserTestUtils.loadURI(remote, page);
    await BrowserTestUtils.browserLoaded(remote);
-    nonRemote.loadURI(page);
+    BrowserTestUtils.loadURI(nonRemote, page);
    await BrowserTestUtils.browserLoaded(nonRemote);

    let result = {};
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@ -50,6 +50,7 @@ using mozilla::DefaultXDisplay;
 #include "nsIContentInlines.h"
 #include "mozilla/MiscEvents.h"
 #include "mozilla/MouseEvents.h"
+#include "mozilla/NullPrincipal.h"
 #include "mozilla/TextEvents.h"
 #include "mozilla/dom/DragEvent.h"
 #include "mozilla/dom/Element.h"
@ -482,6 +483,8 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetURL(const char *aURL,
    mozilla::OriginAttributes attrs =
      BasePrincipal::Cast(content->NodePrincipal())->OriginAttributesRef();
    triggeringPrincipal = BasePrincipal::CreateCodebasePrincipal(uri, attrs);
+  } else {
+    triggeringPrincipal = NullPrincipal::CreateWithInheritedAttributes(content->NodePrincipal());
  }

  rv = lh->OnLinkClick(content, uri, unitarget.get(), VoidString(),
--- a/dom/plugins/test/mochitest/xulbrowser_plugin_visibility.xul
+++ b/dom/plugins/test/mochitest/xulbrowser_plugin_visibility.xul
@ -16,6 +16,7 @@
  </tabbox>
  <script type="application/javascript" src="plugin-utils.js"/>
  <script type="application/javascript"><![CDATA[
+    ChromeUtils.import("resource://testing-common/BrowserTestUtils.jsm");
    const ok = window.opener.wrappedJSObject.ok;
    const is = window.opener.wrappedJSObject.is;
    const done = window.opener.wrappedJSObject.done;
@ -57,10 +58,10 @@
    function setup() {
      progressListener1 = new ProgressListener();
      browser1.addProgressListener(progressListener1, nsIWebProgress.NOTIFY_STATE_WINDOW);
-      browser1.loadURI(kURI, null, null);
+      BrowserTestUtils.loadURI(browser1, kURI);
      progressListener2 = new ProgressListener();
      browser2.addProgressListener(progressListener2, nsIWebProgress.NOTIFY_STATE_WINDOW);
-      browser2.loadURI(kURI, null, null);
+      BrowserTestUtils.loadURI(browser2, kURI);
    }

    window.addEventListener("load", setup, false);
--- a/gfx/tests/browser/browser_windowless_troubleshoot_crash.js
+++ b/gfx/tests/browser/browser_windowless_troubleshoot_crash.js
@ -18,7 +18,8 @@ add_task(async function test_windowlessBrowserTroubleshootCrash() {
    }
    Services.obs.addObserver(listener, "content-document-global-created");
  });
-  webNav.loadURI("about:blank", 0, null, null, null);
+  let triggeringPrincipal = Services.scriptSecurityManager.createNullPrincipal({});
+  webNav.loadURI("about:blank", 0, null, null, null, triggeringPrincipal);

  await onLoaded;

--- a/js/xpconnect/tests/chrome/file_bug618176.xul
+++ b/js/xpconnect/tests/chrome/file_bug618176.xul
@ -30,7 +30,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=618176
    function start() {
      messageManager.addMessageListener("test", recvTest);
      messageManager.loadFrameScript(FRAME_SCRIPT, true);
-      setTimeout(function () { document.getElementById("browser").loadURI(TEST_PAGE); }, 0);
+      let triggeringPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+      setTimeout(function () {
+        document.getElementById("browser").loadURI(TEST_PAGE, {triggeringPrincipal});
+      }, 0);
    }

    function finish() {
--- a/layout/tools/reftest/reftest-content.js
+++ b/layout/tools/reftest/reftest-content.js
@ -1072,7 +1072,8 @@ function DoAssertionCheck()
 function LoadURI(uri)
 {
    var flags = webNavigation().LOAD_FLAGS_NONE;
-    webNavigation().loadURI(uri, flags, null, null, null);
+    var systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+    webNavigation().loadURI(uri, flags, null, null, null, systemPrincipal);
 }

 function LogWarning(str)
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@ -3906,7 +3906,7 @@ Tab.prototype = {
      url = this.originalURI.spec;
    }

-    this.browser.docShell.loadURI(url, flags, null, null, null);
+    this.browser.docShell.loadURI(url, flags, null, null, null, this.browser.contentPrincipal);
  },

  destroy: function() {
@ -5075,7 +5075,14 @@ var ErrorPageEventHandler = {
            // Allow users to override and continue through to the site,
            let webNav = BrowserApp.selectedBrowser.docShell.QueryInterface(Ci.nsIWebNavigation);
            let location = BrowserApp.selectedBrowser.contentWindow.location;
-            webNav.loadURI(location, Ci.nsIWebNavigation.LOAD_FLAGS_BYPASS_CLASSIFIER, null, null, null);
+            let attrs = {};
+            let isPrivate = PrivateBrowsingUtils.isBrowserPrivate(BrowserApp.selectedBrowser);
+            if (isPrivate) {
+              attrs["privateBrowsingId"] = 1;
+            }
+
+            let triggeringPrincipal = nullServices.scriptSecurityManager.createNullPrincipal(attrs);
+            webNav.loadURI(location, Ci.nsIWebNavigation.LOAD_FLAGS_BYPASS_CLASSIFIER, null, null, triggeringPrincipal);

            // ....but add a notify bar as a reminder, so that they don't lose
            // track after, e.g., tab switching.
--- a/testing/mochitest/browser-test.js
+++ b/testing/mochitest/browser-test.js
@ -88,7 +88,8 @@ function testInit() {
      // eslint-disable-next-line no-undef
      var webNav = content.window.docShell
                          .QueryInterface(Ci.nsIWebNavigation);
-      webNav.loadURI(url, null, null, null, null);
+      var systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+      webNav.loadURI(url, null, null, null, null, systemPrincipal);
    };

    var listener = 'data:,function doLoad(e) { var data=e.detail&&e.detail.data;removeEventListener("contentEvent", function (e) { doLoad(e); }, false, true);sendAsyncMessage("chromeEvent", {"data":data}); };addEventListener("contentEvent", function (e) { doLoad(e); }, false, true);';
--- a/toolkit/components/browser/nsWebBrowser.cpp
+++ b/toolkit/components/browser/nsWebBrowser.cpp
@ -512,6 +512,9 @@ nsWebBrowser::LoadURIWithOptions(const nsAString& aURI, uint32_t aLoadFlags,
                                 nsIURI* aBaseURI,
                                 nsIPrincipal* aTriggeringPrincipal)
 {
+#ifndef ANDROID
+  MOZ_ASSERT(aTriggeringPrincipal, "nsWebBrowser::LoadURIWithOptions - Need a valid triggeringPrincipal");
+#endif
  NS_ENSURE_STATE(mDocShell);

  return mDocShellAsNav->LoadURIWithOptions(
@ -533,6 +536,9 @@ nsWebBrowser::LoadURI(const nsAString& aURI, uint32_t aLoadFlags,
                      nsIInputStream* aExtraHeaderStream,
                      nsIPrincipal* aTriggeringPrincipal)
 {
+#ifndef ANDROID
+  MOZ_ASSERT(aTriggeringPrincipal, "nsWebBrowser::LoadURI - Need a valid triggeringPrincipal");
+#endif
  NS_ENSURE_STATE(mDocShell);

  return mDocShellAsNav->LoadURI(aURI, aLoadFlags, aReferringURI,
--- a/toolkit/components/extensions/test/xpcshell/test_WebExtensionContentScript.js
+++ b/toolkit/components/extensions/test/xpcshell/test_WebExtensionContentScript.js
@ -67,7 +67,8 @@ async function loadURL(url, {frameCount}) {
  Services.obs.addObserver(loadObserver, "content-document-global-created");

  let webNav = Services.appShell.createWindowlessBrowser(false);
-  webNav.loadURI(url, 0, null, null, null);
+  let systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+  webNav.loadURI(url, 0, null, null, null, systemPrincipal);

  await loadPromise;

--- a/toolkit/components/gfx/content/gfxFrameScript.js
+++ b/toolkit/components/gfx/content/gfxFrameScript.js
@ -1,6 +1,7 @@
 /* eslint-env mozilla/frame-script */

 ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm");
+ChromeUtils.import("resource://gre/modules/Services.jsm");

 const gfxFrameScript = {
  domUtils: null,
@ -13,9 +14,10 @@ const gfxFrameScript = {

    this.domUtils = content.windowUtils;

+    let triggeringPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
    webNav.loadURI("chrome://gfxsanity/content/sanitytest.html",
                   Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
-                   null, null, null);
+                   null, null, null, triggeringPrincipal);

  },

--- a/toolkit/components/remotebrowserutils/RemoteWebNavigation.js
+++ b/toolkit/components/remotebrowserutils/RemoteWebNavigation.js
@ -136,7 +136,9 @@ RemoteWebNavigation.prototype = {
    return this._currentURI;
  },
  set currentURI(aURI) {
-    this.loadURI(aURI.spec, null, null, null);
+    // Bug 1498600 verify usages of systemPrincipal here
+    let systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+    this.loadURI(aURI.spec, null, null, null, systemPrincipal);
  },

  referringURI: null,
--- a/toolkit/components/thumbnails/BackgroundPageThumbs.jsm
+++ b/toolkit/components/thumbnails/BackgroundPageThumbs.jsm
@ -208,12 +208,24 @@ const BackgroundPageThumbs = {
      }
    };
    webProgress.addProgressListener(this._listener, Ci.nsIWebProgress.NOTIFY_STATE_ALL);
-    wlBrowser.loadURI("chrome://global/content/backgroundPageThumbs.xhtml", 0, null, null, null);
+    let triggeringPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+    wlBrowser.loadURI("chrome://global/content/backgroundPageThumbs.xhtml",
+                      0, null, null, null, triggeringPrincipal);
    this._windowlessContainer = wlBrowser;

    return false;
  },

+  get userContextId() {
+    if (Services.prefs.getBoolPref(ABOUT_NEWTAB_SEGREGATION_PREF)) {
+      // Use the private container for thumbnails.
+      let privateIdentity =
+        ContextualIdentityService.getPrivateIdentity("userContextIdInternal.thumbnail");
+      return privateIdentity.userContextId;
+    }
+    return 0;
+  },
+
  _init() {
    Services.prefs.addObserver(ABOUT_NEWTAB_SEGREGATION_PREF, this);
    Services.obs.addObserver(this, "profile-before-change");
@ -258,13 +270,7 @@ const BackgroundPageThumbs = {
    browser.setAttribute("type", "content");
    browser.setAttribute("remote", "true");
    browser.setAttribute("disableglobalhistory", "true");
-
-    if (Services.prefs.getBoolPref(ABOUT_NEWTAB_SEGREGATION_PREF)) {
-      // Use the private container for thumbnails.
-      let privateIdentity =
-        ContextualIdentityService.getPrivateIdentity("userContextIdInternal.thumbnail");
-      browser.setAttribute("usercontextid", privateIdentity.userContextId);
-    }
+    browser.setAttribute("usercontextid", this.userContextId);

    // Size the browser.  Make its aspect ratio the same as the canvases' that
    // the thumbnails are drawn into; the canvases' aspect ratio is the same as
@ -508,10 +514,8 @@ Capture.prototype = {

      if (Services.prefs.getBoolPref(ABOUT_NEWTAB_SEGREGATION_PREF)) {
        // Clear the data in the private container for thumbnails.
-        let privateIdentity =
-          ContextualIdentityService.getPrivateIdentity("userContextIdInternal.thumbnail");
        Services.obs.notifyObservers(null, "clear-origin-attributes-data",
-          JSON.stringify({ userContextId: privateIdentity.userContextId }));
+          JSON.stringify({ userContextId: this.userContextId }));
      }
    };

--- a/toolkit/components/thumbnails/content/backgroundPageThumbsContent.js
+++ b/toolkit/components/thumbnails/content/backgroundPageThumbsContent.js
@ -100,9 +100,11 @@ const backgroundPageThumbsContent = {
    this._currentCapture.pageLoadStartDate = new Date();

    try {
+      // Bug 1498603 verify usages of systemPrincipal here
+      let triggeringPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
      this._webNav.loadURI(this._currentCapture.url,
                           Ci.nsIWebNavigation.LOAD_FLAGS_STOP_CONTENT,
-                           null, null, null);
+                           null, null, null, triggeringPrincipal);
    } catch (e) {
      this._failCurrentCapture("BAD_URI");
    }
@ -222,9 +224,10 @@ const backgroundPageThumbsContent = {
    if (!docShell) {
      return;
    }
+    let triggeringPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
    this._webNav.loadURI("about:blank",
                         Ci.nsIWebNavigation.LOAD_FLAGS_STOP_CONTENT,
-                         null, null, null);
+                         null, null, null, triggeringPrincipal);
  },

  QueryInterface: ChromeUtils.generateQI([
--- a/toolkit/components/windowwatcher/nsWindowWatcher.cpp
+++ b/toolkit/components/windowwatcher/nsWindowWatcher.cpp
@ -60,6 +60,7 @@
 #include "nsSandboxFlags.h"
 #include "nsSimpleEnumerator.h"
 #include "mozilla/CheckedInt.h"
+#include "mozilla/NullPrincipal.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/Storage.h"
@ -1033,9 +1034,10 @@ nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy* aParent,
  // Note: The check for the current JSContext isn't necessarily sensical.
  // It's just designed to preserve old semantics during a mass-conversion
  // patch.
+  // Bug 1498605 verify usages of systemPrincipal here
  nsCOMPtr<nsIPrincipal> subjectPrincipal =
    nsContentUtils::GetCurrentJSContext() ? nsContentUtils::SubjectPrincipal() :
-                                            nullptr;
+                                            nsContentUtils::GetSystemPrincipal();

  bool isPrivateBrowsingWindow = false;

@ -1125,6 +1127,9 @@ nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy* aParent,
    if (subjectPrincipal) {
      loadState->SetTriggeringPrincipal(subjectPrincipal);
    }
+#ifndef ANDROID
+    MOZ_ASSERT(subjectPrincipal, "nsWindowWatcher: triggeringPrincipal required");
+#endif

    /* use the URL from the *extant* document, if any. The usual accessor
       GetDocument will synchronously create an about:blank document if
--- a/toolkit/content/tests/chrome/bug263683_window.xul
+++ b/toolkit/content/tests/chrome/bug263683_window.xul
@ -56,7 +56,7 @@
      gBrowser = document.getElementById(browserId);
      gFindBar.browser = gBrowser;
      let promise = BrowserTestUtils.browserLoaded(gBrowser);
-      gBrowser.loadURI('data:text/html,<h2>Text mozilla</h2><input id="inp" type="text" />');
+      BrowserTestUtils.loadURI(gBrowser, 'data:text/html,<h2>Text mozilla</h2><input id="inp" type="text" />');
      await promise;
      await onDocumentLoaded();
    }
@ -140,7 +140,7 @@
      // For posterity, test iframes too.

      promise = BrowserTestUtils.browserLoaded(gBrowser);
-      gBrowser.loadURI('data:text/html,<h2>Text mozilla</h2><iframe id="leframe" ' +
+      BrowserTestUtils.loadURI(gBrowser, 'data:text/html,<h2>Text mozilla</h2><iframe id="leframe" ' +
        'src="data:text/html,Text mozilla"></iframe>');
      await promise;

--- a/toolkit/content/tests/chrome/bug304188_window.xul
+++ b/toolkit/content/tests/chrome/bug304188_window.xul
@ -17,6 +17,7 @@
 find-menu appears in editor element which has had makeEditable() called but designMode not set">

  <script type="application/javascript"><![CDATA[
+    ChromeUtils.import("resource://testing-common/BrowserTestUtils.jsm");
    ChromeUtils.import("resource://testing-common/ContentTask.jsm");
    ContentTask.setTestScope(window.opener.wrappedJSObject);

@ -52,7 +53,7 @@ find-menu appears in editor element which has had makeEditable() called but desi
          });
        });
      });
-      gBrowser.loadURI("data:text/html;charset=utf-8,some%20random%20text");
+      BrowserTestUtils.loadURI(gBrowser, "data:text/html;charset=utf-8,some%20random%20text");
      await promise;
      await onDocumentLoaded();
    }
--- a/toolkit/content/tests/chrome/bug331215_window.xul
+++ b/toolkit/content/tests/chrome/bug331215_window.xul
@ -47,7 +47,7 @@
      gBrowser = document.getElementById(browserId);
      gFindBar.browser = gBrowser;
      let promise = BrowserTestUtils.browserLoaded(gBrowser);
-      gBrowser.loadURI("data:text/plain,latest");
+      BrowserTestUtils.loadURI(gBrowser, "data:text/plain,latest");
      await promise;
      await onDocumentLoaded();
    }
--- a/toolkit/content/tests/chrome/bug360437_window.xul
+++ b/toolkit/content/tests/chrome/bug360437_window.xul
@ -18,6 +18,7 @@

  <script type="application/javascript"><![CDATA[
    ChromeUtils.import("resource://testing-common/ContentTask.jsm");
+    ChromeUtils.import("resource://testing-common/BrowserTestUtils.jsm");
    ContentTask.setTestScope(window.opener.wrappedJSObject);

    var gFindBar = null;
@ -52,7 +53,7 @@
          });
        });
      });
-      gBrowser.loadURI("data:text/html,<form><input id='input' type='text' value='text inside an input element'></form>");
+      BrowserTestUtils.loadURI(gBrowser, "data:text/html,<form><input id='input' type='text' value='text inside an input element'></form>");
      await promise;
      await onDocumentLoaded();
    }
--- a/toolkit/content/tests/chrome/bug409624_window.xul
+++ b/toolkit/content/tests/chrome/bug409624_window.xul
@ -16,6 +16,7 @@
          src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"/>

  <script type="application/javascript"><![CDATA[
+    ChromeUtils.import("resource://testing-common/BrowserTestUtils.jsm");
    var gFindBar = null;
    var gBrowser;

@ -33,7 +34,7 @@
      gFindBar = document.getElementById("FindToolbar");
      gBrowser = document.getElementById("content");
      gBrowser.addEventListener("pageshow", onPageShow, false);
-      gBrowser.loadURI('data:text/html,<h2>Text mozilla</h2><input id="inp" type="text" />');
+      BrowserTestUtils.loadURI(gBrowser, 'data:text/html,<h2>Text mozilla</h2><input id="inp" type="text" />');
    }

    function onPageShow() {
--- a/toolkit/content/tests/chrome/bug429723_window.xul
+++ b/toolkit/content/tests/chrome/bug429723_window.xul
@ -14,6 +14,7 @@
        title="429723 test">

  <script type="application/javascript"><![CDATA[
+    ChromeUtils.import("resource://testing-common/BrowserTestUtils.jsm");
    var gFindBar = null;
    var gBrowser;

@ -31,7 +32,7 @@
        gFindBar = document.getElementById("FindToolbar");
        gBrowser = document.getElementById("content");
        gBrowser.addEventListener("pageshow", onPageShow, false);
-        gBrowser.loadURI("data:text/html,<h2 id='h2'>mozilla</h2>");
+        BrowserTestUtils.loadURI(gBrowser, "data:text/html,<h2 id='h2'>mozilla</h2>");
      }
      setTimeout(_delayedOnLoad, 1000);
    }
--- a/toolkit/content/tests/chrome/bug451540_window.xul
+++ b/toolkit/content/tests/chrome/bug451540_window.xul
@ -43,7 +43,7 @@
      gBrowser.addEventListener("pageshow", onPageShow, false);
      let data = `data:text/html,<input id="inp" type="text" />
                                 <textarea id="tarea"/>`;
-      gBrowser.loadURI(data);
+      BrowserTestUtils.loadURI(gBrowser, data);
    }

    function promiseHighlightFinished() {
--- a/toolkit/content/tests/chrome/findbar_entireword_window.xul
+++ b/toolkit/content/tests/chrome/findbar_entireword_window.xul
@ -20,6 +20,7 @@
          src="chrome://mochikit/content/tests/SimpleTest/ChromeUtils.js"/>

  <script type="application/javascript"><![CDATA[
+    ChromeUtils.import("resource://testing-common/BrowserTestUtils.jsm");
    ChromeUtils.import("resource://testing-common/ContentTask.jsm");
    ContentTask.setTestScope(window.opener.wrappedJSObject);

@ -132,7 +133,7 @@
          });
        });
      });
-      gBrowser.loadURI(kBaseURL + "/sample_entireword_" + testName + ".html");
+      BrowserTestUtils.loadURI(gBrowser, kBaseURL + "/sample_entireword_" + testName + ".html");
      await promise;
      await onDocumentLoaded(testName);
    }
--- a/toolkit/content/tests/chrome/findbar_events_window.xul
+++ b/toolkit/content/tests/chrome/findbar_events_window.xul
@ -48,7 +48,7 @@
      gBrowser = document.getElementById(browserId);
      gFindBar.browser = gBrowser;
      let promise = BrowserTestUtils.browserLoaded(gBrowser);
-      gBrowser.loadURI("data:text/html,hello there");
+      BrowserTestUtils.loadURI(gBrowser, "data:text/html,hello there");
      await promise;
      await onDocumentLoaded();
    }
--- a/toolkit/content/tests/chrome/findbar_window.xul
+++ b/toolkit/content/tests/chrome/findbar_window.xul
@ -89,7 +89,7 @@
      await new Promise(resolve => setTimeout(resolve, 1000));

      let promise = BrowserTestUtils.browserLoaded(gBrowser);
-      gBrowser.loadURI("data:text/html,<h2 id='h2'>" + SEARCH_TEXT +
+      BrowserTestUtils.loadURI(gBrowser, "data:text/html,<h2 id='h2'>" + SEARCH_TEXT +
        "</h2><h2><a href='" + SAMPLE_URL + "'>Link Test</a></h2><input id='text' type='text' value='" +
        SAMPLE_TEXT + "'></input><input id='button' type='button'></input><img id='img' width='50' height='50'/>");
      await promise;
--- a/toolkit/modules/HiddenFrame.jsm
+++ b/toolkit/modules/HiddenFrame.jsm
@ -105,8 +105,9 @@ HiddenFrame.prototype = {
    };
    this._webProgress.addProgressListener(this._listener, Ci.nsIWebProgress.NOTIFY_STATE_DOCUMENT);
    let docShell = this._browser.docShell;
-    docShell.createAboutBlankContentViewer(Services.scriptSecurityManager.getSystemPrincipal());
+    let systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal();
+    docShell.createAboutBlankContentViewer(systemPrincipal);
    docShell.useGlobalHistory = false;
-    this._browser.loadURI(XUL_PAGE, 0, null, null, null);
+    this._browser.loadURI(XUL_PAGE, 0, null, null, null, systemPrincipal);
  },
 };
--- a/widget/tests/test_bug428405.xul
+++ b/widget/tests/test_bug428405.xul
@ -23,6 +23,7 @@
  </tabbox>

  <script type="application/javascript"><![CDATA[
+    ChromeUtils.import("resource://testing-common/BrowserTestUtils.jsm");

    SimpleTest.waitForExplicitFinish();

@ -56,7 +57,7 @@
    // 6) Start reloading first tab.
    function loadFirstTab() {
      var browser = document.getElementById("tab1browser");
-      browser.loadURI("data:text/html;charset=utf-8,<body><h2>First Tab</h2><p><input type='submit' value='Button' id='button1'/></body>");
+      BrowserTestUtils.loadURI(browser, "data:text/html;charset=utf-8,<body><h2>First Tab</h2><p><input type='submit' value='Button' id='button1'/></body>");
    }

    function configureFirstTab() {
@ -81,7 +82,7 @@
    // 8) Start loading second tab.
    function loadSecondTab() {
      var browser = document.getElementById("tab2browser");
-      browser.loadURI("data:text/html;charset=utf-8,<body><h2>Second Tab</h2><p><input type='submit' value='Button' id='button1'/></body>");
+      BrowserTestUtils.loadURI(browser, "data:text/html;charset=utf-8,<body><h2>Second Tab</h2><p><input type='submit' value='Button' id='button1'/></body>");
    }

    function configureSecondTab() {