Backed out 5 changesets (bug 790732) for talos-other hangs/crashes on a CLOSED TREE.

content/base/public/nsDeprecatedOperationList.h

@@ -25,4 +25,5 @@ DEPRECATED_OPERATION(DOMExceptionCode)
 DEPRECATED_OPERATION(NoExposedProps)
 DEPRECATED_OPERATION(MutationEvent)
 DEPRECATED_OPERATION(MozSlice)
+DEPRECATED_OPERATION(Components)
 DEPRECATED_OPERATION(PrefixedVisibilityAPI)

dom/base/nsGlobalWindow.cpp

@@ -1946,16 +1946,10 @@ CreateNativeGlobalForInner(JSContext* aCx,
 
   nsIXPConnect* xpc = nsContentUtils::XPConnect();
 
-  // If we've got XBL scopes enabled, we can now turn off the Components object
-  // for content.
-  bool usingXBLScope = !nsContentUtils::IsSystemPrincipal(aPrincipal) &&
-                       Preferences::GetBool("dom.xbl_scopes",  true);
-  uint32_t flags = usingXBLScope ? nsIXPConnect::OMIT_COMPONENTS_OBJECT : 0;
-
   nsRefPtr<nsIXPConnectJSObjectHolder> jsholder;
   nsresult rv = xpc->InitClassesWithNewWrappedGlobal(
     aCx, ToSupports(aNewInner),
-    aPrincipal, flags, getter_AddRefs(jsholder));
+    aPrincipal, 0, getter_AddRefs(jsholder));
   NS_ENSURE_SUCCESS(rv, rv);
 
   MOZ_ASSERT(jsholder);

dom/locales/en-US/chrome/dom/dom.properties

@@ -118,6 +118,8 @@ NoExposedPropsWarning=Exposing chrome JS objects to content without __exposedPro
 MutationEventWarning=Use of Mutation Events is deprecated. Use MutationObserver instead.
 # LOCALIZATION NOTE: Do not translate "Blob", "mozSlice", or "slice"
 MozSliceWarning=Use of mozSlice on the Blob object is deprecated.  Use slice instead.
+# LOCALIZATION NOTE: Do not translate "Components"
+ComponentsWarning=The Components object is deprecated. It will soon be removed.
 PluginHangUITitle=Warning: Unresponsive plugin
 PluginHangUIMessage=%S may be busy, or it may have stopped responding. You can stop the plugin now, or you can continue to see if the plugin will complete.
 PluginHangUIWaitButton=Continue

js/xpconnect/src/XPCComponents.cpp

@@ -33,6 +33,7 @@
 #include "nsIScriptContext.h"
 #include "nsJSEnvironment.h"
 #include "nsXMLHttpRequest.h"
+#include "mozilla/Telemetry.h"
 #include "nsDOMClassInfoID.h"
 
 using namespace mozilla;
@@ -4803,10 +4804,41 @@ nsXPCComponents::SetProperty(nsIXPConnectWrappedNative *wrapper,
     return NS_ERROR_XPC_CANT_MODIFY_PROP_ON_WN;
 }
 
+static JSBool
+ContentComponentsGetterOp(JSContext *cx, JSHandleObject obj, JSHandleId id,
+                          JSMutableHandleValue vp)
+{
+    // If chrome is accessing the Components object of content, allow.
+    MOZ_ASSERT(nsContentUtils::GetCurrentJSContext() == cx);
+    if (nsContentUtils::IsCallerChrome())
+        return true;
+
+    // If the caller is XBL, this is ok.
+    if (nsContentUtils::IsCallerXBL())
+        return true;
+
+    // Do Telemetry on how often this happens.
+    Telemetry::Accumulate(Telemetry::COMPONENTS_OBJECT_ACCESSED_BY_CONTENT, true);
+
+    // Warn once.
+    JSAutoCompartment ac(cx, obj);
+    nsCOMPtr<nsPIDOMWindow> win =
+        do_QueryInterface(nsJSUtils::GetStaticScriptGlobal(obj));
+    if (win) {
+        nsCOMPtr<nsIDocument> doc =
+            do_QueryInterface(win->GetExtantDocument());
+        if (doc)
+            doc->WarnOnceAbout(nsIDocument::eComponents, /* asError = */ true);
+    }
+
+    return true;
+}
+
 // static
 JSBool
 nsXPCComponents::AttachComponentsObject(XPCCallContext& ccx,
-                                        XPCWrappedNativeScope* aScope)
+                                        XPCWrappedNativeScope* aScope,
+                                        JSObject* aTarget)
 {
     JSObject *components = aScope->GetComponentsJSObject(ccx);
     if (!components)
@@ -4814,10 +4846,14 @@ nsXPCComponents::AttachComponentsObject(XPCCallContext& ccx,
 
     JSObject *global = aScope->GetGlobalJSObject();
     MOZ_ASSERT(js::IsObjectInContextCompartment(global, ccx));
+    if (!aTarget)
+        aTarget = global;
 
     jsid id = ccx.GetRuntime()->GetStringID(XPCJSRuntime::IDX_COMPONENTS);
-    return JS_DefinePropertyById(ccx, global, id, js::ObjectValue(*components),
-                                 JS_PropertyStub, JS_StrictPropertyStub, JSPROP_PERMANENT | JSPROP_READONLY);
+    JSPropertyOp getter = AccessCheck::isChrome(global) ? nullptr
+                                                        : &ContentComponentsGetterOp;
+    return JS_DefinePropertyById(ccx, aTarget, id, js::ObjectValue(*components),
+                                 getter, nullptr, JSPROP_PERMANENT | JSPROP_READONLY);
 }
 
 /* void lookupMethod (); */
@@ -4865,6 +4901,12 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c
 {
     static const char* allowed[] = { "isSuccessCode", "lookupMethod", nullptr };
     *_retval = xpc_CheckAccessList(methodName, allowed);
+    if (*_retval &&
+        methodName[0] == 'l' &&
+        !nsContentUtils::IsCallerXBL())
+    {
+        Telemetry::Accumulate(Telemetry::COMPONENTS_LOOKUPMETHOD_ACCESSED_BY_CONTENT, true);
+    }
     return NS_OK;
 }
 
@@ -4874,6 +4916,12 @@ nsXPCComponents::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName
 {
     static const char* allowed[] = { "interfaces", "interfacesByID", "results", nullptr};
     *_retval = xpc_CheckAccessList(propertyName, allowed);
+    if (*_retval &&
+        propertyName[0] == 'i' &&
+        !nsContentUtils::IsCallerXBL())
+    {
+        Telemetry::Accumulate(Telemetry::COMPONENTS_INTERFACES_ACCESSED_BY_CONTENT, true);
+    }
     return NS_OK;
 }
 

js/xpconnect/src/XPCJSRuntime.cpp

@@ -282,18 +282,8 @@ EnableUniversalXPConnect(JSContext *cx)
 
     // Recompute all the cross-compartment wrappers leaving the newly-privileged
     // compartment.
-    bool ok = js::RecomputeWrappers(cx, js::SingleCompartment(compartment),
-                                    js::AllCompartments());
-    NS_ENSURE_TRUE(ok, false);
-
-    // The Components object normally isn't defined for unprivileged web content,
-    // but we define it when UniversalXPConnect is enabled to support legacy
-    // tests.
-    XPCWrappedNativeScope *scope = priv->scope;
-    if (!scope)
-        return true;
-    XPCCallContext ccx(NATIVE_CALLER, cx);
-    return nsXPCComponents::AttachComponentsObject(ccx, scope);
+    return js::RecomputeWrappers(cx, js::SingleCompartment(compartment),
+                                 js::AllCompartments());
 }
 
 }

js/xpconnect/src/nsXPConnect.cpp

@@ -946,6 +946,9 @@ nsXPConnect::InitClasses(JSContext * aJSContext, JSObject * aGlobalJSObj)
 
     scope->RemoveWrappedNativeProtos();
 
+    if (!nsXPCComponents::AttachComponentsObject(ccx, scope))
+        return UnexpectedFailure(NS_ERROR_FAILURE);
+
     if (!XPCNativeWrapper::AttachNewConstructorObject(ccx, aGlobalJSObj))
         return UnexpectedFailure(NS_ERROR_FAILURE);
 

js/xpconnect/src/xpcprivate.h

@@ -3718,9 +3718,13 @@ public:
     NS_DECL_NSISECURITYCHECKEDCOMPONENT
 
 public:
+    // The target is the object upon which |Components| will be defined. If
+    // aTarget is left null, a default object will be computed. This is usually
+    // the right thing to do.
     static JSBool
     AttachComponentsObject(XPCCallContext& ccx,
-                           XPCWrappedNativeScope* aScope);
+                           XPCWrappedNativeScope* aScope,
+                           JSObject* aTarget = NULL);
 
     void SystemIsBeingShutDown() {ClearMembers();}
 

js/xpconnect/tests/chrome/Makefile.in

@@ -43,6 +43,7 @@ MOCHITEST_CHROME_FILES = \
 		test_bug773962.xul \
 		test_bug792280.xul \
 		test_bug793433.xul \
+		test_bug795275.xul \
 		test_bug799348.xul \
 		test_bug801241.xul \
 		test_bug812415.xul \

js/xpconnect/tests/chrome/test_bug795275.xul

@@ -0,0 +1,82 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=795275
+-->
+<window title="Mozilla Bug 795275"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=795275"
+     target="_blank">Mozilla Bug 795275</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+  /** Test for Warning in content scopes about Components. **/
+
+  SimpleTest.waitForExplicitFinish();
+
+  // Set up our console listener.
+  var gWarnings = 0;
+  function onWarning(consoleMessage) {
+    if (/soon be removed/.test(consoleMessage.message))
+      gWarnings++;
+  }
+  var gListener = {
+    observe: onWarning,
+    QueryInterface: function (iid) {
+      if (!iid.equals(Components.interfaces.nsIConsoleListener) &&
+          !iid.equals(Components.interfaces.nsISupports)) {
+        throw Components.results.NS_ERROR_NO_INTERFACE;
+      }
+      return this;
+    }
+  };
+  var gConsoleService = Components.classes["@mozilla.org/consoleservice;1"]
+                                  .getService(Components.interfaces.nsIConsoleService);
+  gConsoleService.registerListener(gListener);
+
+  // Wait for all four child frame to load.
+  var gLoadCount = 0;
+  function frameLoaded() {
+    if (++gLoadCount == document.getElementsByTagName('iframe').length)
+      go();
+  }
+
+  function getWin(id) { return document.getElementById(id).contentWindow.wrappedJSObject; }
+  function go() {
+    getWin('frame1').touchComponents();
+    getWin('frame2').touchInterfaces();
+    getWin('frame3').touchLookupMethod();
+    getWin('frame4').touchComponents();
+    getWin('frame4').touchInterfaces();
+    getWin('frame4').touchLookupMethod();
+    // This shouldn't warn.
+    getWin('frame5').touchViaXBL();
+
+    // Warnings are dispatched async, so stick ourselves at the end of the event
+    // queue.
+    setTimeout(done, 0);
+  }
+
+  function done() {
+    gConsoleService.unregisterListener(gListener);
+    is(gWarnings, 4, "Got the right number of warnings");
+    SimpleTest.finish();
+  }
+
+  ]]>
+
+  </script>
+  <iframe id="frame1" onload="frameLoaded();" type="content" src="http://mochi.test:8888/tests/js/xpconnect/tests/mochitest/file_bug795275.html" />
+  <iframe id="frame2" onload="frameLoaded();" type="content" src="http://mochi.test:8888/tests/js/xpconnect/tests/mochitest/file_bug795275.html" />
+  <iframe id="frame3" onload="frameLoaded();" type="content" src="http://mochi.test:8888/tests/js/xpconnect/tests/mochitest/file_bug795275.html" />
+  <iframe id="frame4" onload="frameLoaded();" type="content" src="http://mochi.test:8888/tests/js/xpconnect/tests/mochitest/file_bug795275.html" />
+  <iframe id="frame5" onload="frameLoaded();" type="content" src="http://mochi.test:8888/tests/js/xpconnect/tests/mochitest/file_bug795275.html" />
+
+</window>

js/xpconnect/tests/mochitest/Makefile.in

@@ -81,6 +81,8 @@ MOCHITEST_FILES =	chrome_wrappers_helper.html \
 		test_bug785096.html \
 		test_bug789713.html \
 		test_bug793969.html \
+		file_bug795275.html \
+		file_bug795275.xml \
 		file_bug799348.html \
 		test_bug800864.html \
 		test_bug802557.html \

js/xpconnect/tests/mochitest/file_bug795275.html

@@ -0,0 +1,31 @@
+<html>
+<head>
+<style>
+  .bound {
+    -moz-binding: url(file_bug795275.xml#xbltest);
+  }
+</style>
+<script type="application/javascript">
+  function touchComponents() {
+    Components;
+  }
+  function touchInterfaces() {
+    Components.interfaces;
+  }
+  function touchLookupMethod() {
+    Components.lookupMethod(document, 'getElementById');
+  }
+
+  function touchViaXBL() {
+    // Make sure none of this warns.
+    var div = document.getElementById('dummy');
+    div.testProp;
+    div.testMethod();
+  }
+
+</script>
+</head>
+<body>
+<div id="dummy" class="bound"></div>
+</body>
+</html>

js/xpconnect/tests/mochitest/file_bug795275.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<bindings id="xbltestBindings" xmlns="http://www.mozilla.org/xbl"
+          xmlns:html="http://www.w3.org/1999/xhtml">
+<binding id="xbltest">
+<implementation>
+<method name="testMethod">
+<body>
+  Components.interfaces;
+</body>
+</method>
+<property name="testProp" readonly="true"
+          onget="Components; return 3;" />
+<constructor>
+  var foo = Components;
+</constructor>
+</implementation>
+</binding>
+</bindings>

toolkit/components/passwordmgr/test/test_prompt.html

@@ -138,7 +138,7 @@ var resolveCallback = {
     const interfaces = [Ci.nsIProtocolProxyCallback, Ci.nsISupports];
 
     if (!interfaces.some( function(v) { return iid.equals(v) } ))
-      throw SpecialPowers.Cr.NS_ERROR_NO_INTERFACE;
+      throw Components.results.NS_ERROR_NO_INTERFACE;
     return this;
   },
 
@@ -160,10 +160,12 @@ var resolveCallback = {
 
 function startup() {
   //need to allow for arbitrary network servers defined in PAC instead of a hardcoded moz-proxy.
-  var ios = SpecialPowers.Cc["@mozilla.org/network/io-service;1"].
-    getService(SpecialPowers.Ci.nsIIOService);
+  var ios = SpecialPowers.wrap(Components).
+    classes["@mozilla.org/network/io-service;1"].
+    getService(Components.interfaces.nsIIOService);
 
-  var pps = SpecialPowers.Cc["@mozilla.org/network/protocol-proxy-service;1"].getService();
+  var pps = SpecialPowers.wrap(Components).
+    classes["@mozilla.org/network/protocol-proxy-service;1"].getService();
 
   var uri = ios.newURI("http://example.com", null, null);
   pps.asyncResolve(uri, 0, resolveCallback);
@@ -181,7 +183,7 @@ var storageObserver = {
                         Ci.nsISupports, Ci.nsISupportsWeakReference];
 
     if (!interfaces.some( function(v) { return iid.equals(v) } ))
-      throw SpecialPowers.Cr.NS_ERROR_NO_INTERFACE;
+      throw SpecialPowers.Components.results.NS_ERROR_NO_INTERFACE;
     return this;
   },
 

toolkit/components/satchel/test/test_form_autocomplete.html

@@ -122,7 +122,7 @@ const shiftModifier = Event.SHIFT_MASK;
 
 // Get the form history service
 var fh = SpecialPowers.Cc["@mozilla.org/satchel/form-history;1"].
-         getService(SpecialPowers.Ci.nsIFormHistory2);
+         getService(Components.interfaces.nsIFormHistory2);
 ok(fh != null, "got form history service");
 
 fh.removeAllEntries();

toolkit/components/telemetry/Histograms.json

@@ -2811,6 +2811,18 @@
     "description": "The device supports touch input",
     "cpp_guard": "XP_WIN"
   },
+  "COMPONENTS_OBJECT_ACCESSED_BY_CONTENT": {
+    "kind": "flag",
+    "description": "Whether content ever accesed the Components object in this session"
+  },
+  "COMPONENTS_LOOKUPMETHOD_ACCESSED_BY_CONTENT": {
+    "kind": "flag",
+    "description": "Whether content ever accesed Components.lookupMethod in this session"
+  },
+  "COMPONENTS_INTERFACES_ACCESSED_BY_CONTENT": {
+    "kind": "flag",
+    "description": "Whether content ever accesed Components.interfaces in this session"
+  },
   "CHECK_ADDONS_MODIFIED_MS": {
     "kind": "exponential",
     "high": "5000",