With a new patch for bug 319768 (JS-based XPathGenerator), I found myself triggering lots of these: ************************************************************ * Call to xpconnect wrapped JSObject produced this error: * [Exception... "'Permission denied to get property Object.flags' when calling method: [nsIClassInfo::flags]" nsresult: "0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)" location: "JS frame :: https://bugzilla.mozilla.org/attachment.cgi?id=212851 :: runTest :: line 216" data: no] ************************************************************ A similar problem arises for "Object.classDescription". These exceptions don't interfere with the operation of the XPathGenerator, but they do make for a lot of error console noise. At nsScriptSecurityManager.cpp#686, bz asked me to find out what objectPrincipal was: <bz> WeirdAl: That's nsSystemPrincipal WeirdAl: so that object is a chrome object as far as security is concerned. WeirdAl: hence your troubles... Stack at breakpoint (line 747) : caps.dll!nsScriptSecurityManager::CheckPropertyAccessImpl(unsigned int aAction=0x00000001, nsIXPCNativeCallContext * aCallContext=0x00000000, JSContext * cx=0x03621610, JSObject * aJSObject=0x00a4f3b0, nsISupports * aObj=0x00000000, nsIURI * aTargetURI=0x00000000, nsIClassInfo * aClassInfo=0x00000000, const char * aClassName=0x00ec065c, long aProperty=0x00a4f064, void * * aCachedClassPolicy=0x00000000) Line 747 C++ caps.dll!nsScriptSecurityManager::CheckPropertyAccess(JSContext * cx=0x03621610, JSObject * aJSObject=0x00a4f3b0, const char * aClassName=0x00ec065c, long aProperty=0x00a4f064, unsigned int aAction=0x00000001) Line 499 C++ caps.dll!nsScriptSecurityManager::CheckObjectAccess(JSContext * cx=0x03621610, JSObject * obj=0x0389be70, long id=0x00a4f064, JSAccessMode mode=JSACC_READ, long * vp=0x0012d370) Line 481 + 0x3e bytes C++ js3250.dll!js_InternalGetOrSet(JSContext * cx=0x03621610, JSObject * obj=0x0389be70, long id=0x00ac9170, long fval=0x00a4f3b0, JSAccessMode mode=JSACC_READ, unsigned int argc=0x00000000, long * argv=0x00000000, long * rval=0x0012d638) Line 1546 + 0x1cc bytes C js3250.dll!js_GetProperty(JSContext * cx=0x03621610, JSObject * obj=0x0389be70, long id=0x00ac9170, long * vp=0x0012d638) Line 3476 + 0x30 bytes C js3250.dll!JS_GetProperty(JSContext * cx=0x03621610, JSObject * obj=0x0389be70, const char * name=0x00acf330, long * vp=0x0012d638) Line 2853 + 0x1d bytes C xpc3250.dll!nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS * wrapper=0x036c93a0, unsigned short methodIndex=0x0009, const nsXPTMethodInfo * info=0x00acf228, nsXPTCMiniVariant * nativeParams=0x0012d798) Line 1397 + 0x22 bytes C++ xpc3250.dll!nsXPCWrappedJS::CallMethod(unsigned short methodIndex=0x0009, const nsXPTMethodInfo * info=0x00acf228, nsXPTCMiniVariant * params=0x0012d798) Line 478 C++ xpcom_core.dll!PrepareAndDispatch(nsXPTCStubBase * self=0x036c93a0, unsigned int methodIndex=0x00000009, unsigned int * args=0x0012d860, unsigned int * stackBytesToPop=0x0012d850) Line 117 + 0x1e bytes C++ xpcom_core.dll!SharedStub() Line 147 C++ caps.dll!ClassInfoData::GetFlags() Line 168 + 0x19 bytes C++ caps.dll!ClassInfoData::GetFlags() Line 168 + 0x19 bytes C++ caps.dll!ClassInfoData::IsDOMClass() Line 184 + 0x8 bytes C++ > caps.dll!nsScriptSecurityManager::CanCreateWrapper(JSContext * cx=0x03621610, const nsID & aIID={...}, nsISupports * aObj=0x039d9278, nsIClassInfo * aClassInfo=0x036c93a0, void * * aPolicy=0x03901db4) Line 2693 + 0x8 bytes C++ xpc3250.dll!XPCWrappedNative::InitTearOff(XPCCallContext & ccx={...}, XPCWrappedNativeTearOff * aTearOff=0x036d5468, XPCNativeInterface * aInterface=0x03901e60, int needJSObject=0x00000000) Line 1563 + 0x37 bytes C++ xpc3250.dll!XPCWrappedNative::FindTearOff(XPCCallContext & ccx={...}, XPCNativeInterface * aInterface=0x03901e60, int needJSObject=0x00000000, unsigned int * pError=0x0012da98) Line 1389 + 0x18 bytes C++ xpc3250.dll!XPCCallContext::CanCallNow() Line 263 + 0x1c bytes C++ xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=CALL_METHOD) Line 1723 + 0x8 bytes C++ xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x03621610, JSObject * obj=0x0389c080, unsigned int argc=0x00000002, long * argv=0x05740050, long * vp=0x0012dea8) Line 1455 + 0xe bytes C++ js3250.dll!js_Invoke(JSContext * cx=0x03621610, unsigned int argc=0x00000002, unsigned int flags=0x00000000) Line 1396 + 0x20 bytes C js3250.dll!js_Interpret(JSContext * cx=0x03621610, unsigned char * pc=0x03971e7c, long * result=0x0012e9fc) Line 3948 + 0xf bytes C js3250.dll!js_Invoke(JSContext * cx=0x03621610, unsigned int argc=0x00000001, unsigned int flags=0x00000002) Line 1415 + 0x13 bytes C js3250.dll!js_InternalInvoke(JSContext * cx=0x03621610, JSObject * obj=0x03854ba8, long fval=0x038561f0, unsigned int flags=0x00000000, unsigned int argc=0x00000001, long * argv=0x0573fec8, long * rval=0x0012eb78) Line 1490 + 0x14 bytes C js3250.dll!JS_CallFunctionValue(JSContext * cx=0x03621610, JSObject * obj=0x03854ba8, long fval=0x038561f0, unsigned int argc=0x00000001, long * argv=0x0573fec8, long * rval=0x0012eb78) Line 4357 + 0x1f bytes C gklayout.dll!nsJSContext::CallEventHandler(nsISupports * aTarget=0x05529ef8, void * aScope=0x0366ef50, void * aHandler=0x038561f0, nsIArray * aargv=0x054d0f70, nsIVariant * * arv=0x0012ece8) Line 1750 + 0x24 bytes C++ gklayout.dll!nsJSEventListener::HandleEvent(nsIDOMEvent * aEvent=0x09e01fb8) Line 212 + 0x62 bytes C++ gklayout.dll!nsEventListenerManager::HandleEventSubType(nsListenerStruct * aListenerStruct=0x0552a0a8, nsIDOMEventListener * aListener=0x0552a058, nsIDOMEvent * aDOMEvent=0x09e01fb8, nsISupports * aCurrentTarget=0x05529ef8, unsigned int aPhaseFlags=0x00000006) Line 1310 + 0x12 bytes C++ gklayout.dll!nsEventListenerManager::HandleEvent(nsPresContext * aPresContext=0x03afaac8, nsEvent * aEvent=0x0012f10c, nsIDOMEvent * * aDOMEvent=0x0012efb0, nsISupports * aCurrentTarget=0x05529ef8, unsigned int aFlags=0x00000006, nsEventStatus * aEventStatus=0x0012efb4) Line 1432 C++ gklayout.dll!nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor & aVisitor={...}, unsigned int aFlags=0x00000006) Line 356 C++ gklayout.dll!nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor & aVisitor={...}, unsigned int aFlags=0x00000006, nsDispatchingCallback * aCallback=0x0012f04c) Line 433 C++ gklayout.dll!nsEventDispatcher::Dispatch(nsISupports * aTarget=0x05529ef8, nsPresContext * aPresContext=0x03afaac8, nsEvent * aEvent=0x0012f10c, nsIDOMEvent * aDOMEvent=0x00000000, nsEventStatus * aEventStatus=0x0012f56c, nsDispatchingCallback * aCallback=0x0012f04c, int aTargetIsChromeHandler=0x00000000) Line 639 + 0x12 bytes C++ gklayout.dll!PresShell::HandleEventInternal(nsEvent * aEvent=0x0012f10c, nsIView * aView=0x00000000, nsEventStatus * aStatus=0x0012f56c) Line 6176 + 0x2b bytes C++ gklayout.dll!PresShell::HandleEventWithTarget(nsEvent * aEvent=0x0012f10c, nsIFrame * aFrame=0x055b6484, nsIContent * aContent=0x05529ef8, nsEventStatus * aStatus=0x0012f56c) Line 6080 + 0x12 bytes C++ gklayout.dll!nsEventStateManager::CheckForAndDispatchClick(nsPresContext * aPresContext=0x03afaac8, nsMouseEvent * aEvent=0x0012f7a8, nsEventStatus * aStatus=0x0012f56c) Line 3230 + 0x45 bytes C++ gklayout.dll!nsEventStateManager::PostHandleEvent(nsPresContext * aPresContext=0x03afaac8, nsEvent * aEvent=0x0012f7a8, nsIFrame * aTargetFrame=0x055b6484, nsEventStatus * aStatus=0x0012f56c, nsIView * aView=0x03768bf0) Line 2194 + 0x1c bytes C++ gklayout.dll!PresShell::HandleEventInternal(nsEvent * aEvent=0x0012f7a8, nsIView * aView=0x03768bf0, nsEventStatus * aStatus=0x0012f56c) Line 6194 + 0x36 bytes C++ gklayout.dll!PresShell::HandlePositionedEvent(nsIView * aView=0x03768bf0, nsIFrame * aTargetFrame=0x055b6484, nsGUIEvent * aEvent=0x0012f7a8, nsEventStatus * aEventStatus=0x0012f56c) Line 6063 + 0x14 bytes C++ gklayout.dll!PresShell::HandleEvent(nsIView * aView=0x03768bf0, nsGUIEvent * aEvent=0x0012f7a8, nsEventStatus * aEventStatus=0x0012f56c) Line 5891 + 0x1b bytes C++ gklayout.dll!nsViewManager::HandleEvent(nsView * aView=0x03768bf0, nsPoint aPoint={...}, nsGUIEvent * aEvent=0x0012f7a8, int aCaptured=0x00000000) Line 1668 C++ gklayout.dll!nsViewManager::DispatchEvent(nsGUIEvent * aEvent=0x0012f7a8, nsEventStatus * aStatus=0x0012f694) Line 1621 + 0x22 bytes C++ gklayout.dll!HandleEvent(nsGUIEvent * aEvent=0x0012f7a8) Line 174 C++ gkwidget.dll!nsWindow::DispatchEvent(nsGUIEvent * event=0x0012f7a8, nsEventStatus & aStatus=nsEventStatus_eIgnore) Line 1108 + 0xc bytes C++ gkwidget.dll!nsWindow::DispatchWindowEvent(nsGUIEvent * event=0x0012f7a8) Line 1129 C++ gkwidget.dll!nsWindow::DispatchMouseEvent(unsigned int aEventType=0x0000012d, unsigned int wParam=0x00000000, long lParam=0x004700aa) Line 6200 + 0x1a bytes C++ gkwidget.dll!ChildWindow::DispatchMouseEvent(unsigned int aEventType=0x0000012d, unsigned int wParam=0x00000000, long lParam=0x004700aa) Line 6383 C++ gkwidget.dll!nsWindow::ProcessMessage(unsigned int msg=0x00000202, unsigned int wParam=0x00000000, long lParam=0x004700aa, long * aRetValue=0x0012fc18) Line 4664 + 0x20 bytes C++ gkwidget.dll!nsWindow::WindowProc(HWND__ * hWnd=0x0001062c, unsigned int msg=0x00000202, unsigned int wParam=0x00000000, long lParam=0x004700aa) Line 1297 + 0x1d bytes C++ user32.dll!77d48734() [Frames below may be incorrect and/or missing, no symbols loaded for user32.dll] user32.dll!77d48816() user32.dll!77d489cd() user32.dll!77d49402() user32.dll!77d48a10() gkwidget.dll!nsAppShell::ProcessNextNativeEvent(int mayWait=0x00000001) Line 149 C++ gkwidget.dll!nsBaseAppShell::DoProcessNextNativeEvent(int mayWait=0x00000001) Line 136 + 0x11 bytes C++ gkwidget.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr=0x003d91c8, int mayWait=0x00000001, unsigned int recursionDepth=0x00000000) Line 231 + 0xf bytes C++ xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=0x00000001, int * result=0x0012fe04) Line 472 C++ xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x003d91c8, int mayWait=0x00000001) Line 225 + 0x16 bytes C++ gkwidget.dll!nsBaseAppShell::Run() Line 153 + 0xc bytes C++ appcomps.dll!nsAppStartup::Run() Line 219 C++ seamonkey.exe!main1(int argc=0x00000003, char * * argv=0x003d4db8, nsISupports * nativeApp=0x00a78028) Line 1245 + 0x22 bytes C++ seamonkey.exe!main(int argc=0x00000003, char * * argv=0x003d4db8) Line 1747 + 0x25 bytes C++ seamonkey.exe!__tmainCRTStartup() Line 586 + 0x19 bytes C seamonkey.exe!mainCRTStartup() Line 403 C kernel32.dll!7c816fd7() gklayout.dll!nsHTMLDocument::ScriptWriteCommon(int aNewlineTerminate=0x00000001) Line 2352 + 0x1a bytes C++ gklayout.dll!nsHTMLDocument::ScriptWriteCommon(int aNewlineTerminate=) Line 2352 + 0x1a bytes C++

So the problem is that CAPS is doing a security check on an nsXPCWrappedJS. To do this it QIs it to nsIClassInfo, then tries to get the "flags" property function off it. The object in question has: get flags() { return Components.interfaces.nsIClassInfo.DOM_OBJECT; }, so in js_InternalGetOrSet we discover that we're getting a scripted function and we do a security check by calling nsScriptSecurityManager::CheckObjectAccess. This ends up calling back into the main CAPS code, but just passes in the JSObject in question (the chrome one), since that's all it has. Since the subject principal on the stack is still whatever content code is trying to use the double-wrapped object, the security check fails. And since there's no nsISupports object in sight, there's no way to allow this through via nsISecurityCheckedComponent or whatever.

I converted my searchFlags property into a getter/setter combination, and now this bug prevents me from getting the searchFlags property... which the canGetProperty and canSetProperty methods of nsISecurityCheckedComponent both return "AllAccess" for.

*** This bug has been marked as a duplicate of 304048 ***

You know... this bug has a much clearer description of the problem than bug 304048 does. Imo. So reopening and marking dependent. I agree that they cover the same problem, but I think the chances of this bug getting fixed are higher, frankly.

Not going to block on this as this doesn't block any features critical for 1.9 that I know of. Fixing this, or bug 304048 (which I still need to review), would be awesome though.

(In reply to comment #5) > Not going to block on this as this doesn't block any features critical for 1.9 > that I know of. Fixing this, or bug 304048 (which I still need to review), > would be awesome though. This causes bug 472396, and may also be responsible for failure of any JS component code accessed from C++ code triggered from web content script (see bug 472396 comment 31). That bug is a P1 blocker, so I'm requesting the blocking flag on this bug as well, which would fix bug 472396.

I'll happily write a xpcshell test for this, upon demand.

(In reply to comment #7) > I'll happily write a xpcshell test for this, upon demand. It would be awesome if you can do that. Thanks!

Not blocking on this.

I don't think I can get to this any time soon.

CheckPropertyAccessImpl doesn't exist any more.