wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-04 23:08:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Bug 1353647 - Fix the custom elements v0 upgrade inconsistency;

Browse source 
There are two places doing prototype setup in old upgrade,
- If definition comes after JS reflector creation, CustomElementRegistry::Upgrade will do prototype swizzling.
- If definition comes before JS reflector creation, Element::WrapObject will set up the prototype.

The later one does SubsumesConsideringDomain, but the former doesn't not.

This patch is to fix the inconsistency, i.e. the former case should also do SubsumesConsideringDomain.

Tag UXP Issue #1344
This commit is contained in:
Gaming4JC 2020-01-05 10:32:10 -05:00 • committed by Roy Tam
commit 3dce7ee1bb
1 changed files with 25 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

38
dom/base/CustomElementRegistry.cpp
View file

@ -798,30 +798,40 @@ CustomElementRegistry::Upgrade(Element* aElement,
}
MOZ_ASSERT(aElement->IsHTMLElement(aDefinition->mLocalName));
nsWrapperCache* cache;
CallQueryInterface(aElement, &cache);
MOZ_ASSERT(cache, "Element doesn't support wrapper cache?");
AutoJSAPI jsapi;
if (NS_WARN_IF(!jsapi.Init(mWindow))) {
return;
}
JSContext *cx = jsapi.cx();
// We want to set the custom prototype in the the compartment of define()'s caller.
// We store the prototype from define() directly,
// hence the prototype's compartment is the caller's compartment.
JS::RootedObject wrapper(cx);
JS::Rooted<JSObject*> prototype(cx, aDefinition->mPrototype);
{ // Enter prototype's compartment.
JSAutoCompartment ac(cx, prototype);
JSContext* cx = jsapi.cx();
if ((wrapper = cache->GetWrapper()) && JS_WrapObject(cx, &wrapper)) {
if (!JS_SetPrototype(cx, wrapper, prototype)) {
JS::Rooted<JSObject*> reflector(cx, aElement->GetWrapper());
if (reflector) {
Maybe<JSAutoCompartment> ac;
JS::Rooted<JSObject*> prototype(cx, aDefinition->mPrototype);
if (aElement->NodePrincipal()->SubsumesConsideringDomain(nsContentUtils::ObjectPrincipal(prototype))) {
ac.emplace(cx, reflector);
if (!JS_WrapObject(cx, &prototype) ||
!JS_SetPrototype(cx, reflector, prototype)) {
return;
}
} else {
// We want to set the custom prototype in the compartment where it was
// registered. We store the prototype from define() without unwrapped,
// hence the prototype's compartment is the compartment where it was
// registered.
// In the case that |reflector| and |prototype| are in different
// compartments, this will set the prototype on the |reflector|'s wrapper
// and thus only visible in the wrapper's compartment, since we know
// reflector's principal does not subsume prototype's in this case.
ac.emplace(cx, prototype);
if (!JS_WrapObject(cx, &reflector) ||
!JS_SetPrototype(cx, reflector, prototype)) {
return;
}
}
} // Leave prototype's compartment.
}
EnqueueLifecycleCallback(nsIDocument::eCreated, aElement, nullptr, aDefinition);
}