Bug 935283 Keep document as a data property on window for now. r=bz

content/base/public/nsIDocument.h

@@ -2171,6 +2171,9 @@ public:
 
   virtual nsHTMLDocument* AsHTMLDocument() { return nullptr; }
 
+  virtual JSObject* WrapObject(JSContext *aCx,
+                               JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
+
 private:
   uint64_t mWarnedAbout;
   SelectorCache mSelectorCache;

content/base/src/nsDocument.cpp

@@ -11329,6 +11329,57 @@ nsDocument::Evaluate(const nsAString& aExpression, nsIDOMNode* aContextNode,
                                     aInResult, aResult);
 } 
 
+// This is just a hack around the fact that window.document is not
+// [Unforgeable] yet.
+JSObject*
+nsIDocument::WrapObject(JSContext *aCx, JS::Handle<JSObject*> aScope)
+{
+  MOZ_ASSERT(IsDOMBinding());
+
+  JS::Rooted<JSObject*> obj(aCx, nsINode::WrapObject(aCx, aScope));
+  if (!obj) {
+    return nullptr;
+  }
+
+  nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(GetInnerWindow());
+  if (!win) {
+    // No window, nothing else to do here
+    return obj;
+  }
+
+  if (this != win->GetExtantDoc()) {
+    // We're not the current document; we're also done here
+    return obj;
+  }
+
+  JSAutoCompartment ac(aCx, obj);
+
+  JS::Rooted<JS::Value> winVal(aCx);
+  nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
+  nsresult rv = nsContentUtils::WrapNative(aCx, obj, win,
+                                           &NS_GET_IID(nsIDOMWindow),
+                                           &winVal,
+                                           getter_AddRefs(holder),
+                                           false);
+  if (NS_FAILED(rv)) {
+    Throw(aCx, rv);
+    return nullptr;
+  }
+
+  NS_NAMED_LITERAL_STRING(doc_str, "document");
+
+  if (!JS_DefineUCProperty(aCx, JSVAL_TO_OBJECT(winVal),
+                           reinterpret_cast<const jschar *>
+                                           (doc_str.get()),
+                           doc_str.Length(), JS::ObjectValue(*obj),
+                           JS_PropertyStub, JS_StrictPropertyStub,
+                           JSPROP_READONLY | JSPROP_ENUMERATE)) {
+    return nullptr;
+  }
+
+  return obj;
+}
+
 XPathEvaluator*
 nsIDocument::XPathEvaluator()
 {

dom/base/nsDOMClassInfo.cpp

@@ -3620,17 +3620,19 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   }
 
   if (!(flags & JSRESOLVE_ASSIGNING) && sDocument_id == id) {
+    nsCOMPtr<nsIDocument> document = win->GetDoc();
+    JS::Rooted<JS::Value> v(cx);
+    nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
+    rv = WrapNative(cx, JS::CurrentGlobalOrNull(cx), document, document,
+                    &NS_GET_IID(nsIDOMDocument), &v, getter_AddRefs(holder),
+                    false);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // nsIDocument::WrapObject will handle defining the property.
+    *objp = obj;
+
+    // NB: We need to do this for any Xray wrapper.
     if (xpc::WrapperFactory::IsXrayWrapper(obj)) {
-      nsCOMPtr<nsIDocument> document = win->GetDoc();
-      JS::Rooted<JS::Value> v(cx);
-      nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
-      rv = WrapNative(cx, JS::CurrentGlobalOrNull(cx), document, document,
-                      &NS_GET_IID(nsIDOMDocument), &v, getter_AddRefs(holder),
-                      false);
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      *objp = obj;
-
       *_retval = JS_WrapValue(cx, &v) &&
                  JS_DefineProperty(cx, obj, "document", v,
                                    JS_PropertyStub, JS_StrictPropertyStub,

dom/webidl/Window.webidl

@@ -28,7 +28,7 @@ typedef any Transferable;
   // the current browsing context
   [Unforgeable, Throws] readonly attribute WindowProxy window;
   [Replaceable, Throws] readonly attribute WindowProxy self;
-  [Unforgeable] readonly attribute Document? document;
+  //[Unforgeable] readonly attribute Document? document;
   [Throws] attribute DOMString name; 
   [PutForwards=href, Unforgeable, Throws] readonly attribute Location? location;
   [Throws] readonly attribute History history;