Bug 786639 - XPCChromeObjectWrapper __exposedProps__ should expose the content of typed arrays like UInt8Array. r=bholley

js/xpconnect/tests/chrome/test_bug760109.xul

@@ -57,6 +57,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=760109
     chromeArray.sort();
     is(chromeArray.join(''), 'abz', "Able to call sort");
 
+    // Make sure we can see the data on the typed array
+    is(chromeTypedArray.length, 3, "Able to check typed array length");
+    is(chromeTypedArray[0], 10, "Able to access typed array data");
+
     // We should be able to .hasOwnProperty on the Object, and have
     // it filter the objects we can see.
     ok(chromeObject.hasOwnProperty('foo'), "Should see r property");
@@ -79,6 +83,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=760109
   var sb = new Cu.Sandbox('http://www.example.org');
   sb.chromeArray = ['a', 'b', 'z'];
   sb.chromeArray.__exposedProps__ = {};
+  sb.chromeTypedArray = new Uint8Array([10, 20, 30]);
   sb.chromeObject = new SomeConstructor();
   sb.ok = ok;
   sb.is = is;

js/xpconnect/wrappers/AccessCheck.cpp

@@ -419,7 +419,8 @@ ExposedPropertiesOnly::check(JSContext *cx, JSObject *wrapper, jsid id, Wrapper:
         return false;
 
     // Always permit access to "length" and indexed properties of arrays.
-    if (JS_IsArrayObject(cx, wrappedObject) &&
+    if ((JS_IsArrayObject(cx, wrappedObject) ||
+         JS_IsTypedArrayObject(wrappedObject, cx)) &&
         ((JSID_IS_INT(id) && JSID_TO_INT(id) >= 0) ||
          (JSID_IS_STRING(id) && JS_FlatStringEqualsAscii(JSID_TO_FLAT_STRING(id), "length")))) {
         perm = PermitPropertyAccess;