Bug 1448397. Make WebIDL QueryInterface chrome-only. r=qdot

dom/bindings/Codegen.py

@@ -2416,15 +2416,17 @@ class MethodDefiner(PropertyDefiner):
         self.chrome = []
         self.regular = []
         for m in methods:
-            if m.identifier.name == 'queryInterface':
+            if m.identifier.name == 'QueryInterface':
+                # QueryInterface is special, because instead of generating an
+                # impl we just call out directly to our shared one.
                 if m.isStatic():
-                    raise TypeError("Legacy queryInterface member shouldn't be static")
+                    raise TypeError("Legacy QueryInterface member shouldn't be static")
                 signatures = m.signatures()
 
                 def argTypeIsIID(arg):
                     return arg.type.inner.isExternal() and arg.type.inner.identifier.name == 'IID'
                 if len(signatures) > 1 or len(signatures[0][1]) > 1 or not argTypeIsIID(signatures[0][1][0]):
-                    raise TypeError("There should be only one queryInterface method with 1 argument of type IID")
+                    raise TypeError("There should be only one QueryInterface method with 1 argument of type IID")
 
                 # Make sure to not stick QueryInterface on abstract interfaces.
                 if (not self.descriptor.interface.hasInterfacePrototypeObject() or
@@ -2432,13 +2434,16 @@ class MethodDefiner(PropertyDefiner):
                     raise TypeError("QueryInterface is only supported on "
                                     "interfaces that are concrete: " +
                                     self.descriptor.name)
-                condition = "WantsQueryInterface<%s>::Enabled" % descriptor.nativeType
-                self.regular.append({
+
+                if not isChromeOnly(m):
+                    raise TypeError("QueryInterface must be ChromeOnly")
+
+                self.chrome.append({
                     "name": 'QueryInterface',
                     "methodInfo": False,
                     "length": 1,
                     "flags": "0",
-                    "condition": MemberCondition(func=condition)
+                    "condition": PropertyDefiner.getControllingCondition(m, descriptor)
                 })
                 continue
 
@@ -12792,7 +12797,7 @@ class CGDescriptor(CGThing):
             descriptor.interface.hasInterfacePrototypeObject()):
             cgThings.append(CGIsInstanceMethod(descriptor))
         for m in descriptor.interface.members:
-            if m.isMethod() and m.identifier.name == 'queryInterface':
+            if m.isMethod() and m.identifier.name == 'QueryInterface':
                 continue
 
             props = memberProperties(m, descriptor)

dom/tests/mochitest/general/test_interfaces.js

@@ -1309,12 +1309,6 @@ function createInterfaceMap(isXBLScope) {
 
   addInterfaces(ecmaGlobals);
   addInterfaces(interfaceNamesInGlobalScope);
-  if (isXBLScope) {
-    // We expose QueryInterface to XBL scopes. It's not an interface but we
-    // need to handle it because it's an own property of the global and the
-    // property name starts with an uppercase letter.
-    interfaceMap["QueryInterface"] = true;
-  }
 
   return interfaceMap;
 }

dom/webidl/LegacyQueryInterface.webidl

@@ -12,10 +12,9 @@ interface IID;
  // that are exposed in workers.
  Exposed=(Window,Worker,System)]
 interface LegacyQueryInterface {
-  // Legacy QueryInterface, only exposed to chrome or XBL code on the
-  // main thread.
-  [Exposed=Window]
-  nsISupports queryInterface(IID iid);
+  // Legacy QueryInterface, only exposed to chrome code on the main thread.
+  [Exposed=(Window,System), ChromeOnly]
+  nsISupports QueryInterface(IID iid);
 };
 
 Attr implements LegacyQueryInterface;

dom/xbl/test/file_bug821850.xhtml

@@ -19,6 +19,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=821850
           var win = XPCNativeWrapper.unwrap(window);
           SpecialPowers = win.SpecialPowers;
           Cu = SpecialPowers.Cu;
+          Ci = SpecialPowers.Ci;
           is = win.is;
           ok = win.ok;
           SimpleTest = win.SimpleTest;
@@ -57,9 +58,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=821850
 
           // Check that here HTMLImageElement.QueryInterface works
           var img = document.querySelector("img");
-          ok("QueryInterface" in img,
+          ok("QueryInterface" in SpecialPowers.wrap(img),
              "Should have a img.QueryInterface here");
-          is(img.QueryInterface(Components.interfaces.nsIImageLoadingContent),
+          is(SpecialPowers.unwrap(SpecialPowers.wrap(img).QueryInterface(Ci.nsIImageLoadingContent)),
              img, "Should be able to QI the image");
 
           // Make sure standard constructors work right in the presence of

dom/xbl/test/file_bug950909.xml

@@ -19,7 +19,7 @@
         var holder = SpecialPowers.Cu.generateXPCWrappedJS(this, scope);
 
         // Now, QI |this|, which will generate an aggregated native.
-        this.QueryInterface(Components.interfaces.nsIObserver);
+        SpecialPowers.wrap(this).QueryInterface(SpecialPowers.Ci.nsIObserver);
 
         ok(true, "Didn't assert or crash");