michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: /* See https://bugzilla.mozilla.org/show_bug.cgi?id=813901 */
michael@0: 
michael@0: const Cu = Components.utils;
michael@0: const TypedArrays = [ Int8Array, Uint8Array, Int16Array, Uint16Array,
michael@0:                       Int32Array, Uint32Array, Float32Array, Float64Array,
michael@0:                       Uint8ClampedArray ];
michael@0: 
michael@0: // Make sure that the correct nativecall-y stuff is denied on security wrappers.
michael@0: 
michael@0: function run_test() {
michael@0: 
michael@0:   var sb = new Cu.Sandbox('http://www.example.org');
michael@0:   sb.obj = {foo: 2};
michael@0: 
michael@0:   /* Set up some typed arrays. */
michael@0:   sb.ab = new ArrayBuffer(8);
michael@0:   for (var i = 0; i < 8; ++i)
michael@0:     new Uint8Array(sb.ab)[i] = i * 10;
michael@0:   sb.ta = [];
michael@0:   TypedArrays.forEach(function(f) sb.ta.push(new f(sb.ab)));
michael@0:   sb.dv = new DataView(sb.ab);
michael@0: 
michael@0:   /* Things that should throw. */
michael@0:   checkThrows("Object.prototype.__lookupSetter__('__proto__').call(obj, {});", sb);
michael@0:   sb.re = /f/;
michael@0:   checkThrows("RegExp.prototype.exec.call(re, 'abcdefg').index", sb);
michael@0:   sb.d = new Date();
michael@0:   checkThrows("Date.prototype.setYear.call(d, 2011)", sb);
michael@0:   sb.m = new Map();
michael@0:   checkThrows("(new Map()).clear.call(m)", sb);
michael@0:   checkThrows("ArrayBuffer.prototype.__lookupGetter__('byteLength').call(ab);", sb);
michael@0:   checkThrows("ArrayBuffer.prototype.slice.call(ab, 0);", sb);
michael@0:   checkThrows("DataView.prototype.getInt8.call(dv, 0);", sb);
michael@0: 
michael@0:   /* Now that Date is on Xrays, these should all throw. */
michael@0:   checkThrows("Date.prototype.getYear.call(d)", sb);
michael@0:   checkThrows("Date.prototype.valueOf.call(d)", sb);
michael@0:   checkThrows("d.valueOf()", sb);
michael@0:   checkThrows("Date.prototype.toString.call(d)", sb);
michael@0:   checkThrows("d.toString()", sb);
michael@0: 
michael@0:   /* Typed arrays. */
michael@0:   function testForTypedArray(t) {
michael@0:     sb.curr = t;
michael@0:     do_check_eq(Cu.evalInSandbox("this[curr.constructor.name].prototype.subarray.call(curr, 0)[0]", sb), t[0]);
michael@0:     do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('length').call(curr)", sb), t.length);
michael@0:     do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('buffer').call(curr)", sb), sb.ab);
michael@0:     do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('byteOffset').call(curr)", sb), t.byteOffset);
michael@0:     do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('byteLength').call(curr)", sb), t.byteLength);
michael@0:   }
michael@0:   sb.ta.forEach(testForTypedArray);
michael@0: }
michael@0: 
michael@0: function checkThrows(expression, sb) {
michael@0:   var result = Cu.evalInSandbox('(function() { try { ' + expression + '; return "allowed"; } catch (e) { return e.toString(); }})();', sb);
michael@0:   dump('result: ' + result + '\n\n\n');
michael@0:   do_check_true(!!/denied/.exec(result));
michael@0: }
michael@0: