Bug 604363 - Don't create Xray wrappers for chrome objects in sandboxes. r=peterv

--HG--
extra : rebase_source : 417edb2b843c0f3d8c4f5cb28d1872d901b3081d

js/src/xpconnect/src/nsXPConnect.cpp

@@ -1965,6 +1965,10 @@ nsXPConnect::GetWrappedNativePrototype(JSContext * aJSContext,
     if(!ccx.IsValid())
         return UnexpectedFailure(NS_ERROR_FAILURE);
 
+    JSAutoEnterCompartment ac;
+    if(!ac.enter(aJSContext, aScope))
+        return UnexpectedFailure(NS_ERROR_FAILURE);
+
     XPCWrappedNativeScope* scope =
         XPCWrappedNativeScope::FindInJSObjectScope(ccx, aScope);
     if(!scope)

js/src/xpconnect/tests/chrome/test_wrappers.xul

@@ -52,6 +52,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=500931
                           "this is wrapped correctly");
                        SimpleTest.finish();
                    }, 0)
+
+    new $('ifr').contentWindow.XMLHttpRequest();
   }
 
   SimpleTest.waitForExplicitFinish();

js/src/xpconnect/wrappers/WrapperFactory.cpp

@@ -171,17 +171,7 @@ WrapperFactory::Rewrap(JSContext *cx, JSObject *obj, JSObject *wrappedProto, JSO
     CompartmentPrivate *targetdata = static_cast<CompartmentPrivate *>(target->data);
     if (AccessCheck::isChrome(target)) {
         if (AccessCheck::isChrome(origin)) {
-            // Same origin we use a transparent wrapper, unless the compartment asks
-            // for an Xray.
-            if (targetdata && targetdata->preferXrays && IS_WN_WRAPPER(obj)) {
-                typedef XrayWrapper<JSCrossCompartmentWrapper, CrossCompartmentXray> Xray;
-                wrapper = &Xray::singleton;
-                xrayHolder = Xray::createHolder(cx, obj, parent);
-                if (!xrayHolder)
-                    return nsnull;
-            } else {
-                wrapper = &JSCrossCompartmentWrapper::singleton;
-            }
+            wrapper = &JSCrossCompartmentWrapper::singleton;
         } else if (flags & WAIVE_XRAY_WRAPPER_FLAG) {
             // If we waived the X-ray wrapper for this object, wrap it into a
             // special wrapper to transitively maintain the X-ray waiver.