we tracked this down on 1.8branch, but the problem has been reported and exists on trunk. (we need it fixed on branch). note: the *first* time you try, you won't encounter this because classinfo will init *after* the nsIInterfaceRequester which means xpconnect will successfully bind the object... just try it a second time and you'll be merily screwed. # 00 xpc3250!XPCWrappedNative::InitTearOff(class XPCCallContext * ccx = 0x0012ba5c, class XPCWrappedNativeTearOff * aTearOff = 0x12ed1e74, class XPCNativeInterface * aInterface = 0x01f94130, int needJSObject = 0)+0x49 (FPO: [Non-Fpo]) (CONV: thiscall) 01 xpc3250!XPCWrappedNative::FindTearOff(class XPCCallContext * ccx = 0x0012ba5c, class XPCNativeInterface * aInterface = 0x01f94130, int needJSObject = 0, unsigned int * pError = 0x0012b80c)+0xc6 (FPO: [Non-Fpo]) (CONV: thiscall) 02 xpc3250!XPCWrappedNative::GetNewOrUsed(class XPCCallContext * ccx = 0x0012ba5c, class nsISupports * Object = 0x015b58d8, class XPCWrappedNativeScope * Scope = 0x016127c0, class XPCNativeInterface * Interface = 0x01f94130, class XPCWrappedNative ** resultWrapper = 0x0012b854)+0x33b (FPO: [Non-Fpo]) (CONV: cdecl) 03 xpc3250!XPCConvert::NativeInterface2JSObject(class XPCCallContext * ccx = 0x0012ba5c, class nsIXPConnectJSObjectHolder ** dest = 0x0012b890, class nsISupports * src = 0x11d231b0, struct nsID * iid = 0x0012b9d4, struct JSObject * scope = 0x0c9d0840, int allowNativeWrapper = 1, unsigned int * pErr = 0x0012ba20)+0x79 (FPO: [Non-Fpo]) (CONV: cdecl) 04 xpc3250!XPCConvert::NativeData2JS(class XPCCallContext * ccx = 0x00000000, long * d = 0x0012ba34, void * s = 0x0012b8b8, class nsXPTType * type = 0x0012ba30, struct nsID * iid = 0x0012b9d4, struct JSObject * scope = 0x0c9d0840, unsigned int * pErr = 0x0012ba20)+0x2fe (FPO: [Non-Fpo]) (CONV: cdecl) 05 xpc3250!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x0012ba5c, XPCWrappedNative::CallMode mode = CALL_GETTER (1))+0x85a (FPO: [Non-Fpo]) (CONV: cdecl) 06 xpc3250!XPC_WN_GetterSetter(struct JSContext * cx = 0x0b212148, struct JSObject * obj = 0x0c9d0840, unsigned int argc = 0, long * argv = 0x11a4e874, long * vp = 0x0012bb1c)+0xce (FPO: [Non-Fpo]) (CONV: cdecl) 07 js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 0, unsigned int flags = 2)+0x556 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 08 js3250!js_InternalInvoke(struct JSContext * cx = 0x122fd4c4, struct JSObject * obj = 0x0c9d0840, long fval = 0x110e10d8, unsigned int flags = 0, unsigned int argc = 0, long * argv = 0x00000000, long * rval = 0x0012bdf0)+0x89 (FPO: [Non-Fpo]) (CONV: cdecl) 09 js3250!js_InternalGetOrSet(struct JSContext * cx = 0x0b212148, struct JSObject * obj = 0x0c9d0840, long id = 0x1e69220, long fval = 0x110e10d8, JSAccessMode mode = JSACC_READ (4), unsigned int argc = 0, long * argv = 0x00000000, long * rval = 0x0012bdf0)+0xd0 (FPO: [Non-Fpo]) (CONV: cdecl) 0a js3250!js_GetProperty(struct JSContext * cx = 0x0b212148, struct JSObject * obj = 0x0c9d0840, long id = 0x1e69220, long * vp = 0x0012bdf0)+0x251 (FPO: [Non-Fpo]) (CONV: cdecl) 0b js3250!js_Interpret(struct JSContext * cx = 0x0b212148, unsigned char * pc = 0x12044e33 "5", long * result = 0x0012be30)+0x7bf4 (FPO: [Uses EBP] [3,85,0]) (CONV: cdecl) 0c js3250!js_Execute(struct JSContext * cx = 0x00a2f7e0, struct JSObject * chain = 0x110e0ed0, struct JSScript * script = 0x12044e00, struct JSStackFrame * down = 0x122fd2e8, unsigned int flags = 0x30, long * result = 0x0012bf54)+0x1a0 (FPO: [Non-Fpo]) (CONV: cdecl) 0d js3250!JS_EvaluateUCInStackFrame(struct JSContext * cx = 0x12044e00, struct JSStackFrame * fp = 0x00000088, unsigned short * bytes = 0x11d97ab8 "channel.notificationCallbacks", unsigned int length = 0x1d, char * filename = 0x12b36dd0 "x-jsd:interactive-session", unsigned int lineno = 1, long * rval = 0x0012bf54)+0x6e (FPO: [Non-Fpo]) (CONV: cdecl) 0e jsd3250!jsd_EvaluateUCScriptInStackFrame(struct JSDContext * jsdc = 0x00000001, struct JSDThreadState * jsdthreadstate = 0x131dee20, struct JSDStackFrameInfo * jsdframe = 0x131dee48, unsigned short * bytes = 0x11d97ab8 "channel.notificationCallbacks", unsigned int length = 0x1d, char * filename = 0x12b36dd0 "x-jsd:interactive-session", unsigned int lineno = 1, int eatExceptions = 0, long * rval = 0x0012bf54)+0x7f (FPO: [Non-Fpo]) (CONV: cdecl) 0f jsd3250!JSD_AttemptUCScriptInStackFrame(struct JSDContext * jsdc = 0x00a2f7e0, struct JSDThreadState * jsdthreadstate = 0x131dee20, struct JSDStackFrameInfo * jsdframe = 0x131dee48, unsigned short * bytes = 0x11d97ab8 "channel.notificationCallbacks", unsigned int length = 0x1d, char * filename = 0x12b36dd0 "x-jsd:interactive-session", unsigned int lineno = 1, long * rval = 0x0012bf54)+0x22 (FPO: [Non-Fpo]) (CONV: cdecl) 10 jsd3250!jsdStackFrame::Eval(class nsAString_internal * bytes = 0x12044030, char * fileName = 0x12b36dd0 "x-jsd:interactive-session", unsigned int line = 1, class jsdIValue ** result = 0x0012bfe0, int * _rval = 0x0012bff0)+0x87 (FPO: [Non-Fpo]) (CONV: stdcall) 11 xpcom_core!XPTC_InvokeByIndex(class nsISupports * that = 0x11ffea98, unsigned int methodIndex = 0x14, unsigned int paramCount = 5, struct nsXPTCVariant * params = 0x0012bfb0)+0x27 (CONV: cdecl) 12 xpc3250!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x0012c154, XPCWrappedNative::CallMode mode = CALL_METHOD (0))+0x6c4 (FPO: [Non-Fpo]) (CONV: cdecl) 13 xpc3250!XPC_WN_CallMethod(struct JSContext * cx = 0x0b269cc0, struct JSObject * obj = 0x11447a08, unsigned int argc = 4, long * argv = 0x11aa27fc, long * vp = 0x0012c214)+0x8e (FPO: [Non-Fpo]) (CONV: cdecl) 14 js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 4, unsigned int flags = 0)+0x556 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 15 js3250!js_Interpret(struct JSContext * cx = 0x0b269cc0, unsigned char * pc = 0x0b40c51a ":", long * result = 0x0012c49c)+0x4fb5 (FPO: [Uses EBP] [3,85,0]) (CONV: cdecl) 16 js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 1, unsigned int flags = 0)+0x597 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 17 js3250!js_Interpret(struct JSContext * cx = 0x0b269cc0, unsigned char * pc = 0x0b348957 ":", long * result = 0x0012c6bc)+0x4fb5 (FPO: [Uses EBP] [3,85,0]) (CONV: cdecl) 18 js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 3, unsigned int flags = 0)+0x597 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 19 js3250!js_Interpret(struct JSContext * cx = 0x0b269cc0, unsigned char * pc = 0x0b34d258 ":", long * result = 0x0012c8dc)+0x4fb5 (FPO: [Uses EBP] [3,85,0]) (CONV: cdecl) 1a js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 1, unsigned int flags = 2)+0x597 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 1b js3250!js_InternalInvoke(struct JSContext * cx = 0x0b269ce8, struct JSObject * obj = 0x11c946b8, long fval = 0x11b07408, unsigned int flags = 0, unsigned int argc = 1, long * argv = 0x0012ca90, long * rval = 0x0012cab4)+0x89 (FPO: [Non-Fpo]) (CONV: cdecl) 1c js3250!JS_CallFunctionValue(struct JSContext * cx = 0x0b269cc0, struct JSObject * obj = 0x11c946b8, long fval = 0x11b07408, unsigned int argc = 1, long * argv = 0x0012ca90, long * rval = 0x0012cab4)+0x1f (FPO: [Non-Fpo]) (CONV: cdecl) 1d gklayout!nsJSContext::CallEventHandler(struct JSObject * aTarget = 0x11c946b8, struct JSObject * aHandler = 0x11b07408, unsigned int argc = 1, long * argv = 0x0012ca90, long * rval = 0x00000000)+0xa6 (FPO: [Non-Fpo]) (CONV: thiscall) 1e gklayout!nsJSEventListener::HandleEvent(class nsIDOMEvent * aEvent = 0x11d977c0)+0x28d (FPO: [Uses EBP] [2,57,0]) (CONV: stdcall) 1f gklayout!nsEventListenerManager::HandleEventSubType(struct nsListenerStruct * aListenerStruct = 0x11c5a038, class nsIDOMEvent * aDOMEvent = 0x11d977c0, class nsIDOMEventTarget * aCurrentTarget = 0x13bb2850, unsigned int aSubType = 0x11d977c8, unsigned int aPhaseFlags = 2)+0x14e (FPO: [Uses EBP] [5,54,0]) (CONV: thiscall) 20 gklayout!nsEventListenerManager::HandleEvent(class nsPresContext * aPresContext = 0x00000000, class nsEvent * aEvent = 0x0012d4e8, class nsIDOMEvent ** aDOMEvent = 0x0012d128, class nsIDOMEventTarget * aCurrentTarget = 0x13bb2850, unsigned int aFlags = 2, nsEventStatus * aEventStatus = 0x0012d438)+0x241 (FPO: [Non-Fpo]) (CONV: stdcall) 21 gklayout!nsXULElement::HandleDOMEvent(class nsPresContext * aPresContext = 0x0b2f5aa8, class nsEvent * aEvent = 0x00000000, class nsIDOMEvent ** aDOMEvent = 0x0012d128, unsigned int aFlags = 2, nsEventStatus * aEventStatus = 0x0012d438)+0x5b2 (FPO: [Uses EBP] [5,127,0]) (CONV: thiscall) 22 gklayout!nsXULElement::HandleDOMEvent(class nsPresContext * aPresContext = 0x0b2f5aa8, class nsEvent * aEvent = 0x00000000, class nsIDOMEvent ** aDOMEvent = 0x0012d128, unsigned int aFlags = 2, nsEventStatus * aEventStatus = 0x0012d438)+0x623 (FPO: [Uses EBP] [5,127,0]) (CONV: thiscall) 23 gklayout!nsGenericElement::HandleDOMEvent(class nsPresContext * aPresContext = 0x0b2f5aa8, class nsEvent * aEvent = 0x00000000, class nsIDOMEvent ** aDOMEvent = 0x0012d128, unsigned int aFlags = 7, nsEventStatus * aEventStatus = 0x0012d438)+0x435 (FPO: [Uses EBP] [5,47,0]) (CONV: thiscall) 24 gklayout!nsHTMLInputElement::HandleDOMEvent(class nsPresContext * aPresContext = 0x0b2f5aa8, class nsEvent * aEvent = 0x0012d4e8, class nsIDOMEvent ** aDOMEvent = 0x00000000, unsigned int aFlags = 1, nsEventStatus * aEventStatus = 0x0012d438)+0x22e (FPO: [Uses EBP] [5,89,0]) (CONV: thiscall) 25 gklayout!PresShell::HandleEventInternal(class nsEvent * aEvent = 0x00000000, class nsIView * aView = 0x0b366b18, unsigned int aFlags = 1, nsEventStatus * aStatus = 0x0012d438)+0x1dc (FPO: [Non-Fpo]) (CONV: thiscall) 26 gklayout!PresShell::HandleEvent(class nsIView * aView = 0x0b366b18, class nsGUIEvent * aEvent = 0x0012d4e8, nsEventStatus * aEventStatus = 0x0012d438, int aForceHandle = 1, int * aHandled = 0x0012d434)+0x210 (FPO: [Non-Fpo]) (CONV: stdcall) 27 gklayout!nsViewManager::HandleEvent(class nsView * aView = 0x00000001, class nsGUIEvent * aEvent = 0x00000000, int aCaptured = 0)+0x2bc (FPO: [Non-Fpo]) (CONV: thiscall) 28 gklayout!nsViewManager::DispatchEvent(class nsGUIEvent * aEvent = 0x3d888889, nsEventStatus * aStatus = 0x0012d4ac)+0x63a (FPO: [Non-Fpo]) (CONV: stdcall) 29 gklayout!HandleEvent(class nsGUIEvent * aEvent = 0x0012d4e8)+0x27 (FPO: [Non-Fpo]) (CONV: cdecl) 2a gkwidget!nsWindow::DispatchEvent(class nsGUIEvent * event = 0x00000000, nsEventStatus * aStatus = 0x0b2de270)+0x35 (FPO: [3,0,0]) (CONV: stdcall) 2b gkwidget!nsWindow::DispatchWindowEvent(class nsGUIEvent * event = 0x00000000)+0x16 (FPO: [Non-Fpo]) (CONV: thiscall) 2c gkwidget!nsWindow::DispatchKeyEvent(unsigned int aEventType = 0x83, unsigned short aCharCode = 0, unsigned int aVirtualCharCode = 0xd, long aKeyData = 0x1c0001, unsigned int aFlags = 0)+0xa4 (FPO: [Non-Fpo]) (CONV: thiscall) 2d gkwidget!nsWindow::OnKeyDown(unsigned int aVirtualKeyCode = 0xd, unsigned int aScanCode = 0x1c, long aKeyData = 0x1c0001)+0x30e (FPO: [Non-Fpo]) (CONV: thiscall) 2e gkwidget!nsWindow::ProcessMessage(unsigned int msg = 0x100, unsigned int wParam = 0xd, long lParam = 0x1c0001, long * aRetValue = 0x0012d870)+0xa62 (FPO: [Non-Fpo]) (CONV: thiscall) 2f gkwidget!nsWindow::WindowProc(struct HWND__ * hWnd = 0x0004024e, unsigned int msg = 0x100, unsigned int wParam = 0xd, long lParam = 0xb2de274)+0x9c (FPO: [Non-Fpo]) (CONV: stdcall) 30 USER32!InternalCallWinProc+0x28 31 USER32!UserCallWinProcCheckWow+0x150 (FPO: [Non-Fpo]) 32 USER32!DispatchMessageWorker+0x306 (FPO: [Non-Fpo]) 33 USER32!DispatchMessageW+0xf (FPO: [Non-Fpo]) 34 gkwidget!nsAppShell::DispatchNativeEvent(int aRealEvent = 1, void * aEvent = 0x00000000)+0xa (FPO: [3,0,0]) (CONV: stdcall) 35 jsd3250!jsdService::EnterNestedEventLoop(class jsdINestCallback * callback = 0x00000000, unsigned int * _rval = 0x0012da2c)+0x127 (FPO: [Non-Fpo]) (CONV: stdcall) 36 xpcom_core!XPTC_InvokeByIndex(class nsISupports * that = 0x00a2e6b0, unsigned int methodIndex = 0x31, unsigned int paramCount = 2, struct nsXPTCVariant * params = 0x0012da1c)+0x27 (CONV: cdecl) 37 xpc3250!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x0012dbc0, XPCWrappedNative::CallMode mode = CALL_METHOD (0))+0x6c4 (FPO: [Non-Fpo]) (CONV: cdecl) 38 xpc3250!XPC_WN_CallMethod(struct JSContext * cx = 0x0b212148, struct JSObject * obj = 0x0b837ff0, unsigned int argc = 1, long * argv = 0x02edcdb4, long * vp = 0x0012dc80)+0x8e (FPO: [Non-Fpo]) (CONV: cdecl) 39 js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 1, unsigned int flags = 0)+0x556 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 3a js3250!js_Interpret(struct JSContext * cx = 0x0b212148, unsigned char * pc = 0x0b4163bf ":", long * result = 0x0012df08)+0x4fb5 (FPO: [Uses EBP] [3,85,0]) (CONV: cdecl) 3b js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 3, unsigned int flags = 2)+0x597 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 3c xpc3250!nsXPCWrappedJSClass::CallMethod(class nsXPCWrappedJS * wrapper = 0x03844810, unsigned short methodIndex = 3, class nsXPTMethodInfo * info = 0x0b417e60, struct nsXPTCMiniVariant * nativeParams = 0x0012e0b0)+0x6b1 (FPO: [Uses EBP] [5,82,0]) (CONV: stdcall) 3d xpc3250!nsXPCWrappedJS::CallMethod(unsigned short methodIndex = 0x4810, class nsXPTMethodInfo * info = 0x00000003, struct nsXPTCMiniVariant * params = 0x0012e16c)+0x27 (FPO: [4,0,0]) (CONV: stdcall) 3e xpcom_core!PrepareAndDispatch(class nsXPTCStubBase * self = 0x0b844810, unsigned int methodIndex = 3, unsigned int * args = 0x0012e16c, unsigned int * stackBytesToPop = 0x0012e15c)+0xee (FPO: [Non-Fpo]) (CONV: stdcall) 3f xpcom_core!SharedStub(void)+0x16 (CONV: cdecl) 40 jsd3250!jsds_ExecutionHookProc(struct JSDContext * jsdc = 0x00a2f7e0, struct JSDThreadState * jsdthreadstate = 0x131dee20, unsigned int type = 0, void * callerdata = 0x00000000, long * rval = 0x0012e36c)+0x182 (FPO: [Non-Fpo]) (CONV: cdecl) 41 jsd3250!jsd_CallExecutionHook(struct JSDContext * jsdc = 0x00a2f7e0, struct JSContext * cx = 0x0b212148, unsigned int type = 1, <function> * hook = 0x00e17eb1, void * hookData = 0x00000000, long * rval = 0x0012e36c)+0x56 (FPO: [Non-Fpo]) (CONV: cdecl) 42 jsd3250!jsd_InterruptHandler(struct JSContext * cx = 0x0b212148, struct JSScript * script = 0x01e6cd98, unsigned char * pc = 0x01e6ce3d "u", long * rval = 0x0012e36c, void * closure = 0x01e6d028)+0x83 (FPO: [Non-Fpo]) (CONV: cdecl) 43 js3250!js_Interpret(struct JSContext * cx = 0x0b212148, unsigned char * pc = 0x01e6ce3d "u", long * result = 0x0012e418)+0x114 (FPO: [Uses EBP] [3,85,0]) (CONV: cdecl) 44 js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 1, unsigned int flags = 1)+0x597 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 45 js3250!js_Interpret(struct JSContext * cx = 0x0b212148, unsigned char * pc = 0x0169cb70 "#", long * result = 0x0012e638)+0x6ede (FPO: [Uses EBP] [3,85,0]) (CONV: cdecl) 46 js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 3, unsigned int flags = 2)+0x597 (FPO: [Uses EBP] [3,35,0]) (CONV: cdecl) 47 xpc3250!nsXPCWrappedJSClass::CallMethod(class nsXPCWrappedJS * wrapper = 0x036206a0, unsigned short methodIndex = 3, class nsXPTMethodInfo * info = 0x00a3d5a8, struct nsXPTCMiniVariant * nativeParams = 0x0012e7e0)+0x6b1 (FPO: [Uses EBP] [5,82,0]) (CONV: stdcall) 48 xpc3250!nsXPCWrappedJS::CallMethod(unsigned short methodIndex = 0x6a0, class nsXPTMethodInfo * info = 0x00000003, struct nsXPTCMiniVariant * params = 0x0012e89c)+0x27 (FPO: [4,0,0]) (CONV: stdcall) 49 xpcom_core!PrepareAndDispatch(class nsXPTCStubBase * self = 0x016206a0, unsigned int methodIndex = 3, unsigned int * args = 0x0012e89c, unsigned int * stackBytesToPop = 0x0012e88c)+0xee (FPO: [Non-Fpo]) (CONV: stdcall) 4a xpcom_core!SharedStub(void)+0x16 (CONV: cdecl) 4b xpcom_core!nsObserverService::NotifyObservers(class nsISupports * aSubject = 0x12a3bda4, char * aTopic = 0x00ba6770 "http-on-modify-request", unsigned short * someData = 0x00000000 "")+0xbf (FPO: [Non-Fpo]) (CONV: stdcall) 4c necko!nsHttpHandler::NotifyObservers(class nsIHttpChannel * chan = 0x0ce34fb4, char * event = 0x12a3bd78 "???")+0x40 (FPO: [2,0,0]) (CONV: thiscall) 4d necko!nsHttpChannel::AsyncOpen(class nsIStreamListener * listener = 0x11d231a8, class nsISupports * context = 0x00000000)+0x10b (FPO: [Non-Fpo]) (CONV: stdcall) 4e xmlextras!nsXMLHttpRequest::Send(class nsIVariant * aBody = 0x12a3bda4)+0x514 (FPO: [Uses EBP] [2,69,0]) (CONV: stdcall) nsresult XPCWrappedNative::InitTearOff(XPCCallContext& ccx, XPCWrappedNativeTearOff* aTearOff, XPCNativeInterface* aInterface, JSBool needJSObject) { // This is only called while locked (during XPCWrappedNative::FindTearOff). // Determine if the object really does this interface... const nsIID* iid = aInterface->GetIID(); nsISupports* identity = GetIdentityObject(); nsISupports* obj; // If the scriptable helper forbids us from reflecting additional // interfaces, then don't even try the QI, just fail. if(mScriptableInfo && mScriptableInfo->GetFlags().ClassInfoInterfacesOnly() && !mSet->HasInterface(aInterface) && !mSet->HasInterfaceWithAncestor(aInterface)) { return NS_ERROR_NO_INTERFACE; } ok, this is a classinfo induced bug. it should be fixed shortly. (the patch is trivial) Testcase is basically 1. create an object: > Foo.prototype.observe = > function observe (theSubject, theTopic, theData) > { > switch (theTopic) > { > case "http-on-modify-request": > var channel = > theSubject.QueryInterface(Components.interfaces.nsIChannel); > var nCallbacks = channel.notificationCallbacks; > } 2. register it for http-on-modify-request. 3. visit apple's sample xmlhttprequest app 4. clicking on any of the items in the ‘Category’ dropdown (e.g. ‘Top 10 Songs’) fires an AJAX request. fire two and have some debuggers handy.

the cause is basically a macro chain starting in http://bonsai.mozilla.org/cvsguess.cgi?file=nsXMLExtrasModule.cpprev=1.49#88 and ending at: 393 #define DOM_DEFAULT_SCRIPTABLE_FLAGS \ 394 (DEFAULT_SCRIPTABLE_FLAGS | \ 395 nsIXPCScriptable::DONT_ENUM_QUERY_INTERFACE | \ 396 nsIXPCScriptable::CLASSINFO_INTERFACES_ONLY)

Start of chain is at http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/extensions/xmlextras/build/src/nsXMLExtrasModule.cpp&rev=1.49#88

So we can fix this by just adding this interface to classinfo, but the fact that XPConnect ends up being inconsistent here is a little troubling...

Comment on attachment 203999 [details] [diff] [review] Like so r+sr=jst

Does nsXMLHttpRequest::GetInterface need some security checks now?

> Does nsXMLHttpRequest::GetInterface need some security checks now? Maybe you need to define a caps pref like this: pref("capability.policy.default.XMLHttpRequest.getInterface", "noAccess"); Same for "mailnews" too.

For which interfaces? Patch checked in, by the way.

But yeah, perhaps we should just block that to be sure...

> pref("capability.policy.default.XMLHttpRequest.getInterface", "noAccess"); That wouldn't allow calling getInterface from code with UniversalXPConnect privileges, which seems unfortunate to me.

Comment on attachment 203999 [details] [diff] [review] Like so we'd like this in the next 1.8.x release (not sure how to ask for that, the closest flag i see is 1.8.0.1, it'd be nice to have there since this hurts extensions that might want to use xmlhttprequest)

Bz/Darin - any final thoughts on the security cred issue?

> That wouldn't allow calling getInterface from code with UniversalXPConnect > privileges, which seems unfortunate to me. That's okay. We apply "noAccess" restrictions for XMLHttpRequest.channel as well. We should just do the same for this guy, and then file a bug on changing it to something better to give UniversalXPConnect-privileged scripts the ability to play.

I'll post a patch for that security pref change when I get back (and post a both-parts branch patch then too).

Comment on attachment 203999 [details] [diff] [review] Like so a-, re-request approval when you get the promised branch patch (but probably looking like 1.8.0.2 at this point)

Comment on attachment 207650 [details] [diff] [review] roll-up patch Please re-request the approvals when this new patch has been re-reviewed as a sanity check.

Daniel, that patch is just exactly the text darin suggested concatenated onto my original patch. I probably won't be in a position to request approval before the freeze, so whenever this is acceptable to request approval for, could someone do that and land the patch?

Comment on attachment 207650 [details] [diff] [review] roll-up patch darin's away... :(

Comment on attachment 207650 [details] [diff] [review] roll-up patch Channeling jst, r=me. /be

Comment on attachment 207650 [details] [diff] [review] roll-up patch a=dveditz for drivers

*** Committing to MOZILLA_1_8_BRANCH... /cvsroot/mozilla/extensions/xmlextras/build/src/nsXMLExtrasModule.cpp,v <-- nsXMLExtrasModule.cpp new revision: 1.49.24.1; previous revision: 1.49 /cvsroot/mozilla/modules/libpref/src/init/all.js,v <-- all.js new revision: 3.585.2.18; previous revision: 3.585.2.17 *** Committing extensions/xmlextras/build/src/nsXMLExtrasModule.cpp on MOZILLA_1_8_0_BRANCH... /cvsroot/mozilla/extensions/xmlextras/build/src/nsXMLExtrasModule.cpp,v <-- nsXMLExtrasModule.cpp new revision: 1.49.32.1; previous revision: 1.49 *** Committing modules/libpref/src/init/all.js on MOZILLA_1_8_0_BRANCH... /cvsroot/mozilla/modules/libpref/src/init/all.js,v <-- all.js new revision: 3.585.2.17.2.1; previous revision: 3.585.2.17

Is it related to the behaviour I am seeing in our cookiepie extension? Debugging a Firefox extension with HTTP observers we found in some requests that notificationCallbacks on a channel returns the same channel instead of a notification callback, in other words channel.notificationCallbacks === channel. We have observed this issue in the specific case of Google gmail XMLHttpRequest's for creating a chat channel inside the browser, this hasn't happened with other XMLHttpRequest's created for gmail. It will be helpful if somebody can clear if it's a bug or not.

I checked in a test for this.