Bug 920125. getOwnPropertyDescriptor on Xrays for DOM interface and prototype objects should actually work. r=peterv

dom/bindings/BindingUtils.cpp

@@ -881,6 +881,13 @@ XrayResolveUnforgeableProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
                                JS::MutableHandle<JSPropertyDescriptor> desc,
                                const NativeProperties* nativeProperties);
 
+static bool
+XrayResolveNativeProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
+                          const NativePropertyHooks* nativePropertyHooks,
+                          DOMObjectType type, JS::Handle<JSObject*> obj,
+                          JS::Handle<jsid> id,
+                          JS::MutableHandle<JSPropertyDescriptor> desc);
+
 bool
 XrayResolveOwnProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
                        JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
@@ -891,7 +898,10 @@ XrayResolveOwnProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
     GetNativePropertyHooks(cx, obj, type);
 
   if (type != eInstance) {
-    return true;
+    // For prototype objects and interface objects, just return their
+    // normal set of properties.
+    return XrayResolveNativeProperty(cx, wrapper, nativePropertyHooks, type,
+                                     obj, id, desc);
   }
 
   // Check for unforgeable properties before doing mResolveOwnProperty weirdness
@@ -1101,7 +1111,7 @@ ResolvePrototypeOrConstructor(JSContext* cx, JS::Handle<JSObject*> wrapper,
   return JS_WrapPropertyDescriptor(cx, desc);
 }
 
-bool
+/* static */ bool
 XrayResolveNativeProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
                           const NativePropertyHooks* nativePropertyHooks,
                           DOMObjectType type, JS::Handle<JSObject*> obj,

dom/tests/mochitest/chrome/test_sandbox_bindings.xul

@@ -49,6 +49,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=741267
         ok(xhr, "'XMLHttpRequest.prototype' in a sandbox should return the XMLHttpRequest interface prototype object");
         ok(isXrayWrapper(xhr), "Getting an interface prototype object on an Xray wrapper should return an Xray wrapper");
         ok(isXrayWrapper(xhr.constructor), "Getting the constructor property on an Xray wrapper of an interface prototype object should return an Xray wrapper");
+        isnot(Object.getOwnPropertyDescriptor(xhr, "send"), undefined,
+              "We should claim to have a send() method");
+        isnot(Object.keys(xhr).indexOf("responseType"), -1,
+              "We should claim to have a responseType property");
+        isnot(Object.getOwnPropertyNames(xhr).indexOf("open"), -1,
+              "We should claim to have an open() method");
+        isnot(Object.getOwnPropertyDescriptor(xhr, "constructor"), undefined,
+              "We should claim to have a 'constructor' property");
       } catch (e) {
         ok(false, "'XMLHttpRequest.prototype' shouldn't throw in a sandbox");
       }
@@ -87,6 +95,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=741267
         var xhr = Components.utils.evalInSandbox("XMLHttpRequest", sandbox);
         is(xhr, "[object XrayWrapper " + XMLHttpRequest + "]", "'XMLHttpRequest' in a sandbox should return the XMLHttpRequest interface object");
         ok(isXrayWrapper(xhr.prototype), "Getting the prototype property on an Xray wrapper of an interface object should return an Xray wrapper");
+        isnot(Object.getOwnPropertyDescriptor(xhr, "UNSENT"), undefined,
+              "We should claim to have an UNSENT constant");
+        isnot(Object.keys(xhr).indexOf("OPENED"), -1,
+              "We should claim to have an OPENED constant");
+        isnot(Object.getOwnPropertyNames(xhr).indexOf("DONE"), -1,
+              "We should claim to have a DONE constant");
+        isnot(Object.getOwnPropertyDescriptor(xhr, "prototype"), undefined,
+              "We should claim to have 'prototype' property");
       } catch (e) {
         ok(false, "'XMLHttpRequest' shouldn't throw in a sandbox");
       }