michael@0: // This code is evaluated in a sandbox courtesy of toSource();
michael@0: let sandboxCode = (function() {
michael@0:   let req = new XMLHttpRequest();
michael@0:   req.open("GET", "http://mochi.test:8888/browser/dom/tests/browser/", true);
michael@0:   req.onreadystatechange = function() {
michael@0:     if (req.readyState === 4) {
michael@0:       // If we get past the problem above, we end up with a req.status of zero
michael@0:       // (ie, blocked due to CORS) even though we are fetching from the same
michael@0:       // origin as the window itself.
michael@0:       let result;
michael@0:       if (req.status != 200) {
michael@0:         result = "ERROR: got request status of " + req.status;
michael@0:       } else if (req.responseText.length == 0) {
michael@0:         result = "ERROR: got zero byte response text";
michael@0:       } else {
michael@0:         result = "ok";
michael@0:       }
michael@0:       postMessage({result: result}, "*");
michael@0:     }
michael@0:   };
michael@0:   req.send(null);
michael@0: }).toSource() + "();";
michael@0: 
michael@0: function test() {
michael@0:   waitForExplicitFinish();
michael@0:   let appShell = Cc["@mozilla.org/appshell/appShellService;1"]
michael@0:                   .getService(Ci.nsIAppShellService);
michael@0:   let doc = appShell.hiddenDOMWindow.document;
michael@0:   let frame = doc.createElement("iframe");
michael@0:   frame.setAttribute("type", "content");
michael@0:   frame.setAttribute("src", "http://mochi.test:8888/browser/dom/tests/browser/browser_xhr_sandbox.js");
michael@0: 
michael@0:   frame.addEventListener("load", function () {
michael@0:     let workerWindow = frame.contentWindow;
michael@0:     workerWindow.addEventListener("message", function(evt) {
michael@0:       is(evt.data.result, "ok", "check the sandbox code was happy");
michael@0:       frame.remove();
michael@0:       finish();
michael@0:     }, true);
michael@0:     let sandbox = new Cu.Sandbox(workerWindow);
michael@0:     // inject some functions from the window into the sandbox.
michael@0:     // postMessage so the async code in the sandbox can report a result.
michael@0:     sandbox.importFunction(workerWindow.postMessage.bind(workerWindow), "postMessage");
michael@0:     sandbox.importFunction(workerWindow.XMLHttpRequest, "XMLHttpRequest");
michael@0:     Cu.evalInSandbox(sandboxCode, sandbox, "1.8");
michael@0:   }, true);
michael@0: 
michael@0:   let container = doc.body ? doc.body : doc.documentElement;
michael@0:   container.appendChild(frame);
michael@0: }