Fix bug 691359. r=jst@mozilla.com, a=blocker

2011-02-01 09:19:35 -08:00 · 2011-02-01 09:19:35 -08:00 · a5ed4e4114
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@ -10041,20 +10041,14 @@ nsHistorySH::PreCreate(nsISupports *nativeObj, JSContext *cx,
                       JSObject *globalObj, JSObject **parentObj)
 {
  nsHistory *history = (nsHistory *)nativeObj;
-  nsIDocShell *ds = history->GetDocShell();
-  if (!ds) {
-    NS_WARNING("Refusing to create a history object in the wrong scope");
-    return NS_ERROR_UNEXPECTED;
+  nsCOMPtr<nsPIDOMWindow> innerWindow;
+  history->GetWindow(getter_AddRefs(innerWindow));
+  if (!innerWindow) {
+    NS_WARNING("refusing to create history object in the wrong scope");
+    return NS_ERROR_FAILURE;
  }

-  nsCOMPtr<nsIScriptGlobalObject> sgo = do_GetInterface(ds);
-  if (!sgo) {
-    NS_WARNING("Refusing to create a history object in the wrong scope because the "
-               "docshell is being destroyed");
-    return NS_ERROR_UNEXPECTED;
-  }
-
-  *parentObj = sgo->GetGlobalJSObject();
+  *parentObj = static_cast<nsGlobalWindow *>(innerWindow.get())->FastGetGlobalJSObject();
  return NS_OK;
 }

--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -1084,7 +1084,6 @@ nsGlobalWindow::CleanUp(PRBool aIgnoreModalDialog)

  mNavigator = nsnull;
  mScreen = nsnull;
-  mHistory = nsnull;
  mMenubar = nsnull;
  mToolbar = nsnull;
  mLocationbar = nsnull;
@ -1092,6 +1091,7 @@ nsGlobalWindow::CleanUp(PRBool aIgnoreModalDialog)
  mStatusbar = nsnull;
  mScrollbars = nsnull;
  mLocation = nsnull;
+  mHistory = nsnull;
  mFrames = nsnull;
  mApplicationCache = nsnull;
  mIndexedDB = nsnull;
@ -1236,6 +1236,7 @@ nsGlobalWindow::FreeInnerObjects(PRBool aClearScope)
  }

  mLocation = nsnull;
+  mHistory = nsnull;

  if (mDocument) {
    NS_ASSERTION(mDoc, "Why is mDoc null?");
@ -2388,8 +2389,6 @@ nsGlobalWindow::SetDocShell(nsIDocShell* aDocShell)

  if (mNavigator)
    mNavigator->SetDocShell(aDocShell);
-  if (mHistory)
-    mHistory->SetDocShell(aDocShell);
  if (mFrames)
    mFrames->SetDocShell(aDocShell);
  if (mScreen)
@ -2910,12 +2909,12 @@ nsGlobalWindow::GetScreen(nsIDOMScreen** aScreen)
 NS_IMETHODIMP
 nsGlobalWindow::GetHistory(nsIDOMHistory** aHistory)
 {
-  FORWARD_TO_OUTER(GetHistory, (aHistory), NS_ERROR_NOT_INITIALIZED);
+  FORWARD_TO_INNER(GetHistory, (aHistory), NS_ERROR_NOT_INITIALIZED);

  *aHistory = nsnull;

-  if (!mHistory && mDocShell) {
-    mHistory = new nsHistory(mDocShell);
+  if (!mHistory) {
+    mHistory = new nsHistory(this);
    if (!mHistory) {
      return NS_ERROR_OUT_OF_MEMORY;
    }
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@ -902,7 +902,6 @@ protected:
  nsCOMPtr<nsIPrincipal>        mArgumentsOrigin;
  nsRefPtr<nsNavigator>         mNavigator;
  nsRefPtr<nsScreen>            mScreen;
-  nsRefPtr<nsHistory>           mHistory;
  nsRefPtr<nsDOMWindowList>     mFrames;
  nsRefPtr<nsBarProp>           mMenubar;
  nsRefPtr<nsBarProp>           mToolbar;
@ -933,6 +932,7 @@ protected:
  PRUint32                      mTimeoutPublicIdCounter;
  PRUint32                      mTimeoutFiringDepth;
  nsRefPtr<nsLocation>          mLocation;
+  nsRefPtr<nsHistory>           mHistory;

  // Holder of the dummy java plugin, used to expose window.java and
  // window.packages.
--- a/dom/base/nsHistory.cpp
+++ b/dom/base/nsHistory.cpp
@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=78: */
 /* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
@ -68,7 +69,8 @@ static const char* sAllowReplaceStatePrefStr =
 //
 //  History class implementation 
 //
-nsHistory::nsHistory(nsIDocShell* aDocShell) : mDocShell(aDocShell)
+nsHistory::nsHistory(nsPIDOMWindow* aInnerWindow)
+  : mInnerWindow(do_GetWeakReference(aInnerWindow))
 {
 }

@ -91,19 +93,13 @@ NS_IMPL_ADDREF(nsHistory)
 NS_IMPL_RELEASE(nsHistory)


-void
-nsHistory::SetDocShell(nsIDocShell *aDocShell)
-{
-  mDocShell = aDocShell; // Weak Reference
-}
-
 NS_IMETHODIMP
 nsHistory::GetLength(PRInt32* aLength)
 {
  nsCOMPtr<nsISHistory>   sHistory;

  // Get session History from docshell
-  GetSessionHistoryFromDocShell(mDocShell, getter_AddRefs(sHistory));
+  GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(sHistory));
  NS_ENSURE_TRUE(sHistory, NS_ERROR_FAILURE);
  return sHistory->GetCount(aLength);
 }
@ -111,12 +107,15 @@ nsHistory::GetLength(PRInt32* aLength)
 NS_IMETHODIMP
 nsHistory::GetCurrent(nsAString& aCurrent)
 {
+  if (!nsContentUtils::IsCallerTrustedForRead())
+    return NS_ERROR_DOM_SECURITY_ERR;
+
  PRInt32 curIndex=0;
  nsCAutoString curURL;
  nsCOMPtr<nsISHistory> sHistory;

  // Get SessionHistory from docshell
-  GetSessionHistoryFromDocShell(mDocShell, getter_AddRefs(sHistory));
+  GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(sHistory));
  NS_ENSURE_TRUE(sHistory, NS_ERROR_FAILURE);

  // Get the current index at session History
@ -140,12 +139,15 @@ nsHistory::GetCurrent(nsAString& aCurrent)
 NS_IMETHODIMP
 nsHistory::GetPrevious(nsAString& aPrevious)
 {
+  if (!nsContentUtils::IsCallerTrustedForRead())
+    return NS_ERROR_DOM_SECURITY_ERR;
+
  PRInt32 curIndex;
  nsCAutoString prevURL;
  nsCOMPtr<nsISHistory>  sHistory;

  // Get session History from docshell
-  GetSessionHistoryFromDocShell(mDocShell, getter_AddRefs(sHistory));
+  GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(sHistory));
  NS_ENSURE_TRUE(sHistory, NS_ERROR_FAILURE);

  // Get the current index at session History
@ -174,7 +176,7 @@ nsHistory::GetNext(nsAString& aNext)
  nsCOMPtr<nsISHistory>  sHistory;

  // Get session History from docshell
-  GetSessionHistoryFromDocShell(mDocShell, getter_AddRefs(sHistory));
+  GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(sHistory));
  NS_ENSURE_TRUE(sHistory, NS_ERROR_FAILURE);

  // Get the current index at session History
@ -200,7 +202,7 @@ nsHistory::Back()
 {
  nsCOMPtr<nsISHistory>  sHistory;

-  GetSessionHistoryFromDocShell(mDocShell, getter_AddRefs(sHistory));
+  GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(sHistory));
  NS_ENSURE_TRUE(sHistory, NS_ERROR_FAILURE);

  //QI SHistory to WebNavigation
@ -216,7 +218,7 @@ nsHistory::Forward()
 {
  nsCOMPtr<nsISHistory>  sHistory;

-  GetSessionHistoryFromDocShell(mDocShell, getter_AddRefs(sHistory));
+  GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(sHistory));
  NS_ENSURE_TRUE(sHistory, NS_ERROR_FAILURE);

  //QI SHistory to WebNavigation
@ -231,7 +233,7 @@ NS_IMETHODIMP
 nsHistory::Go(PRInt32 aDelta)
 {
  if (aDelta == 0) {
-    nsCOMPtr<nsPIDOMWindow> window(do_GetInterface(mDocShell));
+    nsCOMPtr<nsPIDOMWindow> window(do_GetInterface(GetDocShell()));

    if (window && window->IsHandlingResizeEvent()) {
      // history.go(0) (aka location.reload()) was called on a window
@ -257,7 +259,7 @@ nsHistory::Go(PRInt32 aDelta)

  nsCOMPtr<nsISHistory> session_history;

-  GetSessionHistoryFromDocShell(mDocShell, getter_AddRefs(session_history));
+  GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(session_history));
  NS_ENSURE_TRUE(session_history, NS_ERROR_FAILURE);

  // QI SHistory to nsIWebNavigation
@ -288,15 +290,22 @@ nsHistory::PushState(nsIVariant *aData, const nsAString& aTitle,
  if (!nsContentUtils::GetBoolPref(sAllowPushStatePrefStr, PR_FALSE))
    return NS_OK;

-  NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
+  nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mInnerWindow));
+  if (!win)
+    return NS_ERROR_NOT_AVAILABLE;
+
+  if (!nsContentUtils::CanCallerAccess(win->GetOuterWindow()))
+    return NS_ERROR_DOM_SECURITY_ERR;

  // AddState might run scripts, so we need to hold a strong reference to the
  // docShell here to keep it from going away.
-  nsCOMPtr<nsIDocShell> docShell = mDocShell;
+  nsCOMPtr<nsIDocShell> docShell = win->GetDocShell();
+
+  NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);

  // PR_FALSE tells the docshell to add a new history entry instead of
  // modifying the current one.
-  nsresult rv = mDocShell->AddState(aData, aTitle, aURL, PR_FALSE);
+  nsresult rv = docShell->AddState(aData, aTitle, aURL, PR_FALSE);
  NS_ENSURE_SUCCESS(rv, rv);

  return NS_OK;
@ -310,15 +319,22 @@ nsHistory::ReplaceState(nsIVariant *aData, const nsAString& aTitle,
  if (!nsContentUtils::GetBoolPref(sAllowReplaceStatePrefStr, PR_FALSE))
    return NS_OK;

-  NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
+  nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mInnerWindow));
+  if (!win)
+    return NS_ERROR_NOT_AVAILABLE;

-  // As in PushState(), we need to keep a strong reference to the docShell
-  // here.
-  nsCOMPtr<nsIDocShell> docShell = mDocShell;
+  if (!nsContentUtils::CanCallerAccess(win->GetOuterWindow()))
+    return NS_ERROR_DOM_SECURITY_ERR;
+
+  // AddState might run scripts, so we need to hold a strong reference to the
+  // docShell here to keep it from going away.
+  nsCOMPtr<nsIDocShell> docShell = win->GetDocShell();
+
+  NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);

  // PR_TRUE tells the docshell to modify the current SHEntry, rather than
  // create a new one.
-  return mDocShell->AddState(aData, aTitle, aURL, PR_TRUE);
+  return docShell->AddState(aData, aTitle, aURL, PR_TRUE);
 }

 NS_IMETHODIMP
@ -332,7 +348,7 @@ nsHistory::Item(PRUint32 aIndex, nsAString& aReturn)
  nsresult rv = NS_OK;
  nsCOMPtr<nsISHistory>  session_history;

-  GetSessionHistoryFromDocShell(mDocShell, getter_AddRefs(session_history));
+  GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(session_history));
  NS_ENSURE_TRUE(session_history, NS_ERROR_FAILURE);

  nsCOMPtr<nsIHistoryEntry> sh_entry;
@ -367,7 +383,7 @@ nsHistory::GetSessionHistoryFromDocShell(nsIDocShell * aDocShell,
   */
  
  // QI mDocShell to nsIDocShellTreeItem
-  nsCOMPtr<nsIDocShellTreeItem> dsTreeItem(do_QueryInterface(mDocShell));
+  nsCOMPtr<nsIDocShellTreeItem> dsTreeItem(do_QueryInterface(aDocShell));
  NS_ENSURE_TRUE(dsTreeItem, NS_ERROR_FAILURE);

  // Get the root DocShell from it
--- a/dom/base/nsHistory.h
+++ b/dom/base/nsHistory.h
@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=79: */
 /* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
@ -42,6 +43,8 @@
 #include "nscore.h"
 #include "nsIScriptContext.h"
 #include "nsISHistory.h"
+#include "nsIWeakReference.h"
+#include "nsPIDOMWindow.h"

 class nsIDocShell;

@ -49,7 +52,7 @@ class nsIDocShell;
 class nsHistory : public nsIDOMHistory
 {
 public:
-  nsHistory(nsIDocShell* aDocShell);
+  nsHistory(nsPIDOMWindow* aInnerWindow);
  virtual ~nsHistory();

  // nsISupports
@ -58,14 +61,23 @@ public:
  // nsIDOMHistory
  NS_DECL_NSIDOMHISTORY

-  nsIDocShell *GetDocShell() { return mDocShell; }
-  void SetDocShell(nsIDocShell *aDocShell);
+  nsIDocShell *GetDocShell() {
+    nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mInnerWindow));
+    if (!win)
+      return nsnull;
+    return win->GetDocShell();
+  }
+
+  void GetWindow(nsPIDOMWindow **aWindow) {
+    nsCOMPtr<nsPIDOMWindow> win(do_QueryReferent(mInnerWindow));
+    *aWindow = win.forget().get();
+  }

 protected:
  nsresult GetSessionHistoryFromDocShell(nsIDocShell * aDocShell,
                                         nsISHistory ** aReturn);

-  nsIDocShell* mDocShell;
+  nsCOMPtr<nsIWeakReference> mInnerWindow;
 };

 #endif /* nsHistory_h___ */