The Tor Browser: js/xpconnect/src/XPCWrappedJS.cpp@129ffea94266 (annotated)

js/xpconnect/src/XPCWrappedJS.cpp@129ffea94266 (annotated)

js/xpconnect/src/XPCWrappedJS.cpp

Sat, 03 Jan 2015 20:18:00 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Sat, 03 Jan 2015 20:18:00 +0100
branch: TOR_BUG_3246
changeset 7: 129ffea94266
permissions: -rw-r--r--

Conditionally enable double key logic according to:
private browsing mode or privacy.thirdparty.isolate preference and
implement in GetCookieStringCommon and FindCookie where it counts...
With some reservations of how to convince FindCookie users to test
condition and pass a nullptr when disabling double key logic.

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /* vim: set ts=8 sts=4 et sw=4 tw=99: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /* Class that wraps JS objects to appear as XPCOM objects. */
 #include "xpcprivate.h"
 #include "jsprf.h"
 #include "nsCCUncollectableMarker.h"
 #include "nsCxPusher.h"
 #include "nsContentUtils.h"
 #include "nsThreadUtils.h"
 using namespace mozilla;
 // NOTE: much of the fancy footwork is done in xpcstubs.cpp
 // nsXPCWrappedJS lifetime.
 //
 // An nsXPCWrappedJS is either rooting its JS object or is subject to finalization.
 // The subject-to-finalization state lets wrappers support
 // nsSupportsWeakReference in the case where the underlying JS object
 // is strongly owned, but the wrapper itself is only weakly owned.
 //
 // A wrapper is rooting its JS object whenever its refcount is greater than 1. In
 // this state, root wrappers are always added to the cycle collector graph. The
 // wrapper keeps around an extra refcount, added in the constructor, to support
 // the possibility of an eventual transition to the subject-to-finalization state.
 // This extra refcount is ignored by the cycle collector, which traverses the "self"
 // edge for this refcount.
 //
 // When the refcount of a rooting wrapper drops to 1, if there is no weak reference
 // to the wrapper (which can only happen for the root wrapper), it is immediately
 // Destroy()'d. Otherwise, it becomes subject to finalization.
 //
 // When a wrapper is subject to finalization, the wrapper has a refcount of 1. It is
 // now owned exclusively by its JS object. Either a weak reference will be turned into
 // a strong ref which will bring its refcount up to 2 and change the wrapper back to
 // the rooting state, or it will stay alive until the JS object dies. If the JS object
 // dies, then when XPCJSRuntime::FinalizeCallback calls FindDyingJSObjects
 // it will find the wrapper and call Release() in it, destroying the wrapper.
 // Otherwise, the wrapper will stay alive, even if it no longer has a weak reference
 // to it.
 //
 // When the wrapper is subject to finalization, it is kept alive by an implicit reference
 // from the JS object which is invisible to the cycle collector, so the cycle collector
 // does not traverse any children of wrappers that are subject to finalization. This will
 // result in a leak if a wrapper in the non-rooting state has an aggregated native that
 // keeps alive the wrapper's JS object.  See bug 947049.
 // If traversing wrappedJS wouldn't release it, nor cause any other objects to be
 // added to the graph, there is no need to add it to the graph at all.
 bool
 nsXPCWrappedJS::CanSkip()
 {
     if (!nsCCUncollectableMarker::sGeneration)
         return false;
     if (IsSubjectToFinalization())
         return true;
     // If this wrapper holds a gray object, need to trace it.
     JSObject *obj = GetJSObjectPreserveColor();
     if (obj && xpc_IsGrayGCThing(obj))
         return false;
     // For non-root wrappers, check if the root wrapper will be
     // added to the CC graph.
     if (!IsRootWrapper())
         return mRoot->CanSkip();
     // For the root wrapper, check if there is an aggregated
     // native object that will be added to the CC graph.
     if (!IsAggregatedToNative())
         return true;
     nsISupports* agg = GetAggregatedNativeObject();
     nsXPCOMCycleCollectionParticipant* cp = nullptr;
     CallQueryInterface(agg, &cp);
     nsISupports* canonical = nullptr;
     agg->QueryInterface(NS_GET_IID(nsCycleCollectionISupports),
                         reinterpret_cast<void**>(&canonical));
     return cp && canonical && cp->CanSkipThis(canonical);
 }
 NS_IMETHODIMP
 NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
    (void *p, nsCycleCollectionTraversalCallback &cb)
 {
     nsISupports *s = static_cast<nsISupports*>(p);
     MOZ_ASSERT(CheckForRightISupports(s), "not the nsISupports pointer we expect");
     nsXPCWrappedJS *tmp = Downcast(s);
     nsrefcnt refcnt = tmp->mRefCnt.get();
     if (cb.WantDebugInfo()) {
         char name[72];
         if (tmp->GetClass())
             JS_snprintf(name, sizeof(name), "nsXPCWrappedJS (%s)",
                         tmp->GetClass()->GetInterfaceName());
         else
             JS_snprintf(name, sizeof(name), "nsXPCWrappedJS");
         cb.DescribeRefCountedNode(refcnt, name);
     } else {
         NS_IMPL_CYCLE_COLLECTION_DESCRIBE(nsXPCWrappedJS, refcnt)
     }
     // A wrapper that is subject to finalization will only die when its JS object dies.
     if (tmp->IsSubjectToFinalization())
         return NS_OK;
     // Don't let the extra reference for nsSupportsWeakReference keep a wrapper that is
     // not subject to finalization alive.
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "self");
     cb.NoteXPCOMChild(s);
     if (tmp->IsValid()) {
         MOZ_ASSERT(refcnt > 1);
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mJSObj");
         cb.NoteJSChild(tmp->GetJSObjectPreserveColor());
     }
     if (tmp->IsRootWrapper()) {
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "aggregated native");
         cb.NoteXPCOMChild(tmp->GetAggregatedNativeObject());
     } else {
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "root");
         cb.NoteXPCOMChild(ToSupports(tmp->GetRootWrapper()));
     }
     return NS_OK;
 }
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXPCWrappedJS)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXPCWrappedJS)
     tmp->Unlink();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 // XPCJSRuntime keeps a table of WJS, so we can remove them from
 // the purple buffer in between CCs.
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsXPCWrappedJS)
     return true;
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_BEGIN(nsXPCWrappedJS)
     return tmp->CanSkip();
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_END
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_BEGIN(nsXPCWrappedJS)
     return tmp->CanSkip();
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_END
 NS_IMETHODIMP
 nsXPCWrappedJS::AggregatedQueryInterface(REFNSIID aIID, void** aInstancePtr)
 {
     MOZ_ASSERT(IsAggregatedToNative(), "bad AggregatedQueryInterface call");
     if (!IsValid())
         return NS_ERROR_UNEXPECTED;
     // Put this here rather that in DelegatedQueryInterface because it needs
     // to be in QueryInterface before the possible delegation to 'outer', but
     // we don't want to do this check twice in one call in the normal case:
     // once in QueryInterface and once in DelegatedQueryInterface.
     if (aIID.Equals(NS_GET_IID(nsIXPConnectWrappedJS))) {
         NS_ADDREF(this);
         *aInstancePtr = (void*) static_cast<nsIXPConnectWrappedJS*>(this);
         return NS_OK;
     }
     return mClass->DelegatedQueryInterface(this, aIID, aInstancePtr);
 }
 NS_IMETHODIMP
 nsXPCWrappedJS::QueryInterface(REFNSIID aIID, void** aInstancePtr)
 {
     if (nullptr == aInstancePtr) {
         NS_PRECONDITION(0, "null pointer");
         return NS_ERROR_NULL_POINTER;
     }
     if ( aIID.Equals(NS_GET_IID(nsXPCOMCycleCollectionParticipant)) ) {
         *aInstancePtr = NS_CYCLE_COLLECTION_PARTICIPANT(nsXPCWrappedJS);
         return NS_OK;
     }
     if (aIID.Equals(NS_GET_IID(nsCycleCollectionISupports))) {
         *aInstancePtr =
             NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Upcast(this);
         return NS_OK;
     }
     if (!IsValid())
         return NS_ERROR_UNEXPECTED;
     // Always check for this first so that our 'outer' can get this interface
     // from us without recurring into a call to the outer's QI!
     if (aIID.Equals(NS_GET_IID(nsIXPConnectWrappedJS))) {
         NS_ADDREF(this);
         *aInstancePtr = (void*) static_cast<nsIXPConnectWrappedJS*>(this);
         return NS_OK;
     }
     nsISupports* outer = GetAggregatedNativeObject();
     if (outer)
         return outer->QueryInterface(aIID, aInstancePtr);
     // else...
     return mClass->DelegatedQueryInterface(this, aIID, aInstancePtr);
 }
 // For a description of nsXPCWrappedJS lifetime and reference counting, see
 // the comment at the top of this file.
 MozExternalRefCountType
 nsXPCWrappedJS::AddRef(void)
 {
     if (!MOZ_LIKELY(NS_IsMainThread()))
         MOZ_CRASH();
     MOZ_ASSERT(int32_t(mRefCnt) >= 0, "illegal refcnt");
     nsISupports *base = NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Upcast(this);
     nsrefcnt cnt = mRefCnt.incr(base);
     NS_LOG_ADDREF(this, cnt, "nsXPCWrappedJS", sizeof(*this));
     if (2 == cnt && IsValid()) {
         GetJSObject(); // Unmark gray JSObject.
         mClass->GetRuntime()->AddWrappedJSRoot(this);
     }
     return cnt;
 }
 MozExternalRefCountType
 nsXPCWrappedJS::Release(void)
 {
     if (!MOZ_LIKELY(NS_IsMainThread()))
         MOZ_CRASH();
     MOZ_ASSERT(int32_t(mRefCnt) > 0, "dup release");
     NS_ASSERT_OWNINGTHREAD(nsXPCWrappedJS);
     bool shouldDelete = false;
     nsISupports *base = NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Upcast(this);
     nsrefcnt cnt = mRefCnt.decr(base, &shouldDelete);
     NS_LOG_RELEASE(this, cnt, "nsXPCWrappedJS");
     if (0 == cnt) {
         if (MOZ_UNLIKELY(shouldDelete)) {
             mRefCnt.stabilizeForDeletion();
             DeleteCycleCollectable();
         } else {
             mRefCnt.incr(base);
             Destroy();
             mRefCnt.decr(base);
         }
     } else if (1 == cnt) {
         if (IsValid())
             RemoveFromRootSet();
         // If we are not a root wrapper being used from a weak reference,
         // then the extra ref is not needed and we can let outselves be
         // deleted.
         if (!HasWeakReferences())
             return Release();
         MOZ_ASSERT(IsRootWrapper(), "Only root wrappers should have weak references");
     }
     return cnt;
 }
 NS_IMETHODIMP_(void)
 nsXPCWrappedJS::DeleteCycleCollectable(void)
 {
     delete this;
 }
 void
 nsXPCWrappedJS::TraceJS(JSTracer* trc)
 {
     MOZ_ASSERT(mRefCnt >= 2 && IsValid(), "must be strongly referenced");
     trc->setTracingDetails(GetTraceName, this, 0);
     JS_CallHeapObjectTracer(trc, &mJSObj, "nsXPCWrappedJS::mJSObj");
 }
 // static
 void
 nsXPCWrappedJS::GetTraceName(JSTracer* trc, char *buf, size_t bufsize)
 {
     const nsXPCWrappedJS* self = static_cast<const nsXPCWrappedJS*>
                                             (trc->debugPrintArg());
     JS_snprintf(buf, bufsize, "nsXPCWrappedJS[%s,0x%p:0x%p].mJSObj",
                 self->GetClass()->GetInterfaceName(), self, self->mXPTCStub);
 }
 NS_IMETHODIMP
 nsXPCWrappedJS::GetWeakReference(nsIWeakReference** aInstancePtr)
 {
     if (!IsRootWrapper())
         return mRoot->GetWeakReference(aInstancePtr);
     return nsSupportsWeakReference::GetWeakReference(aInstancePtr);
 }
 JSObject*
 nsXPCWrappedJS::GetJSObject()
 {
     if (mJSObj) {
         JS::ExposeObjectToActiveJS(mJSObj);
     }
     return mJSObj;
 }
 // static
 nsresult
 nsXPCWrappedJS::GetNewOrUsed(JS::HandleObject jsObj,
                              REFNSIID aIID,
                              nsXPCWrappedJS** wrapperResult)
 {
     // Do a release-mode assert against accessing nsXPCWrappedJS off-main-thread.
     if (!MOZ_LIKELY(NS_IsMainThread()))
         MOZ_CRASH();
     AutoJSContext cx;
     XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
     JSObject2WrappedJSMap* map = rt->GetWrappedJSMap();
     if (!map) {
         MOZ_ASSERT(map,"bad map");
         return NS_ERROR_FAILURE;
     }
     nsRefPtr<nsXPCWrappedJSClass> clasp = nsXPCWrappedJSClass::GetNewOrUsed(cx, aIID);
     if (!clasp)
         return NS_ERROR_FAILURE;
     JS::RootedObject rootJSObj(cx, clasp->GetRootJSObject(cx, jsObj));
     if (!rootJSObj)
         return NS_ERROR_FAILURE;
     nsRefPtr<nsXPCWrappedJS> root = map->Find(rootJSObj);
     if (root) {
         nsRefPtr<nsXPCWrappedJS> wrapper = root->FindOrFindInherited(aIID);
         if (wrapper) {
             wrapper.forget(wrapperResult);
             return NS_OK;
         }
     } else if (rootJSObj != jsObj) {
         // Make a new root wrapper, because there is no existing
         // root wrapper, and the wrapper we are trying to make isn't
         // a root.
         nsRefPtr<nsXPCWrappedJSClass> rootClasp = nsXPCWrappedJSClass::GetNewOrUsed(cx, NS_GET_IID(nsISupports));
         if (!rootClasp)
             return NS_ERROR_FAILURE;
         root = new nsXPCWrappedJS(cx, rootJSObj, rootClasp, nullptr);
     }
     nsRefPtr<nsXPCWrappedJS> wrapper = new nsXPCWrappedJS(cx, jsObj, clasp, root);
     wrapper.forget(wrapperResult);
     return NS_OK;
 }
 nsXPCWrappedJS::nsXPCWrappedJS(JSContext* cx,
                                JSObject* aJSObj,
                                nsXPCWrappedJSClass* aClass,
                                nsXPCWrappedJS* root)
     : mJSObj(aJSObj),
       mClass(aClass),
       mRoot(root ? root : MOZ_THIS_IN_INITIALIZER_LIST()),
       mNext(nullptr)
 {
     InitStub(GetClass()->GetIID());
     // There is an extra AddRef to support weak references to wrappers
     // that are subject to finalization. See the top of the file for more
     // details.
     NS_ADDREF_THIS();
     if (IsRootWrapper()) {
         nsXPConnect::GetRuntimeInstance()->GetWrappedJSMap()->Add(cx, this);
     } else {
         NS_ADDREF(mRoot);
         mNext = mRoot->mNext;
         mRoot->mNext = this;
     }
 }
 nsXPCWrappedJS::~nsXPCWrappedJS()
 {
     Destroy();
 }
 void
 nsXPCWrappedJS::Destroy()
 {
     MOZ_ASSERT(1 == int32_t(mRefCnt), "should be stabilized for deletion");
     if (IsRootWrapper()) {
         XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
         JSObject2WrappedJSMap* map = rt->GetWrappedJSMap();
         if (map)
             map->Remove(this);
     }
     Unlink();
 }
 void
 nsXPCWrappedJS::Unlink()
 {
     if (IsValid()) {
         XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
         if (rt) {
             if (IsRootWrapper()) {
                 JSObject2WrappedJSMap* map = rt->GetWrappedJSMap();
                 if (map)
                     map->Remove(this);
             }
             if (mRefCnt > 1)
                 RemoveFromRootSet();
         }
         mJSObj = nullptr;
     }
     if (IsRootWrapper()) {
         ClearWeakReferences();
     } else if (mRoot) {
         // unlink this wrapper
         nsXPCWrappedJS* cur = mRoot;
         while (1) {
             if (cur->mNext == this) {
                 cur->mNext = mNext;
                 break;
             }
             cur = cur->mNext;
             MOZ_ASSERT(cur, "failed to find wrapper in its own chain");
         }
         // let the root go
         NS_RELEASE(mRoot);
     }
     mClass = nullptr;
     if (mOuter) {
         XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
         if (rt->GCIsRunning()) {
             nsContentUtils::DeferredFinalize(mOuter.forget().take());
         } else {
             mOuter = nullptr;
         }
     }
 }
 nsXPCWrappedJS*
 nsXPCWrappedJS::Find(REFNSIID aIID)
 {
     if (aIID.Equals(NS_GET_IID(nsISupports)))
         return mRoot;
     for (nsXPCWrappedJS* cur = mRoot; cur; cur = cur->mNext) {
         if (aIID.Equals(cur->GetIID()))
             return cur;
     }
     return nullptr;
 }
 // check if asking for an interface that some wrapper in the chain inherits from
 nsXPCWrappedJS*
 nsXPCWrappedJS::FindInherited(REFNSIID aIID)
 {
     MOZ_ASSERT(!aIID.Equals(NS_GET_IID(nsISupports)), "bad call sequence");
     for (nsXPCWrappedJS* cur = mRoot; cur; cur = cur->mNext) {
         bool found;
         if (NS_SUCCEEDED(cur->GetClass()->GetInterfaceInfo()->
                          HasAncestor(&aIID, &found)) && found)
             return cur;
     }
     return nullptr;
 }
 NS_IMETHODIMP
 nsXPCWrappedJS::GetInterfaceInfo(nsIInterfaceInfo** infoResult)
 {
     MOZ_ASSERT(GetClass(), "wrapper without class");
     MOZ_ASSERT(GetClass()->GetInterfaceInfo(), "wrapper class without interface");
     // Since failing to get this info will crash some platforms(!), we keep
     // mClass valid at shutdown time.
     nsCOMPtr<nsIInterfaceInfo> info = GetClass()->GetInterfaceInfo();
     if (!info)
         return NS_ERROR_UNEXPECTED;
     info.forget(infoResult);
     return NS_OK;
 }
 NS_IMETHODIMP
 nsXPCWrappedJS::CallMethod(uint16_t methodIndex,
                            const XPTMethodDescriptor* info,
                            nsXPTCMiniVariant* params)
 {
     // Do a release-mode assert against accessing nsXPCWrappedJS off-main-thread.
     if (!MOZ_LIKELY(NS_IsMainThread()))
         MOZ_CRASH();
     if (!IsValid())
         return NS_ERROR_UNEXPECTED;
     return GetClass()->CallMethod(this, methodIndex, info, params);
 }
 NS_IMETHODIMP
 nsXPCWrappedJS::GetInterfaceIID(nsIID** iid)
 {
     NS_PRECONDITION(iid, "bad param");
     *iid = (nsIID*) nsMemory::Clone(&(GetIID()), sizeof(nsIID));
     return *iid ? NS_OK : NS_ERROR_UNEXPECTED;
 }
 void
 nsXPCWrappedJS::SystemIsBeingShutDown()
 {
     // XXX It turns out that it is better to leak here then to do any Releases
     // and have them propagate into all sorts of mischief as the system is being
     // shutdown. This was learned the hard way :(
     // mJSObj == nullptr is used to indicate that the wrapper is no longer valid
     // and that calls should fail without trying to use any of the
     // xpconnect mechanisms. 'IsValid' is implemented by checking this pointer.
     // NOTE: that mClass is retained so that GetInterfaceInfo can continue to
     // work (and avoid crashing some platforms).
     // Use of unsafeGet() is to avoid triggering post barriers in shutdown, as
     // this will access the chunk containing mJSObj, which may have been freed
     // at this point.
     *mJSObj.unsafeGet() = nullptr;
     // Notify other wrappers in the chain.
     if (mNext)
         mNext->SystemIsBeingShutDown();
 }
 /***************************************************************************/
 /* readonly attribute nsISimpleEnumerator enumerator; */
 NS_IMETHODIMP
 nsXPCWrappedJS::GetEnumerator(nsISimpleEnumerator * *aEnumerate)
 {
     AutoJSContext cx;
     XPCCallContext ccx(NATIVE_CALLER, cx);
     if (!ccx.IsValid())
         return NS_ERROR_UNEXPECTED;
     return nsXPCWrappedJSClass::BuildPropertyEnumerator(ccx, GetJSObject(),
                                                         aEnumerate);
 }
 /* nsIVariant getProperty (in AString name); */
 NS_IMETHODIMP
 nsXPCWrappedJS::GetProperty(const nsAString & name, nsIVariant **_retval)
 {
     AutoJSContext cx;
     XPCCallContext ccx(NATIVE_CALLER, cx);
     if (!ccx.IsValid())
         return NS_ERROR_UNEXPECTED;
     return nsXPCWrappedJSClass::
         GetNamedPropertyAsVariant(ccx, GetJSObject(), name, _retval);
 }
 /***************************************************************************/
 NS_IMETHODIMP
 nsXPCWrappedJS::DebugDump(int16_t depth)
 {
 #ifdef DEBUG
     XPC_LOG_ALWAYS(("nsXPCWrappedJS @ %x with mRefCnt = %d", this, mRefCnt.get()));
         XPC_LOG_INDENT();
         XPC_LOG_ALWAYS(("%s wrapper around JSObject @ %x", \
                         IsRootWrapper() ? "ROOT":"non-root", mJSObj.get()));
         char* name;
         GetClass()->GetInterfaceInfo()->GetName(&name);
         XPC_LOG_ALWAYS(("interface name is %s", name));
         if (name)
             nsMemory::Free(name);
         char * iid = GetClass()->GetIID().ToString();
         XPC_LOG_ALWAYS(("IID number is %s", iid ? iid : "invalid"));
         if (iid)
             NS_Free(iid);
         XPC_LOG_ALWAYS(("nsXPCWrappedJSClass @ %x", mClass.get()));
         if (!IsRootWrapper())
             XPC_LOG_OUTDENT();
         if (mNext) {
             if (IsRootWrapper()) {
                 XPC_LOG_ALWAYS(("Additional wrappers for this object..."));
                 XPC_LOG_INDENT();
             }
             mNext->DebugDump(depth);
             if (IsRootWrapper())
                 XPC_LOG_OUTDENT();
         }
         if (IsRootWrapper())
             XPC_LOG_OUTDENT();
 #endif
     return NS_OK;
 }

The Tor Browser / annotate

js/xpconnect/src/XPCWrappedJS.cpp@129ffea94266 (annotated)

js/xpconnect/src/XPCWrappedJS.cpp