in a snippet like this: this.sandbox = new Cu.Sandbox(this._window); this.sandbox.window = this._window; this.sandbox.__proto__ = this._window.wrappedJSObject; when running: Cu.evalInSandbox(str, this.sandbox); The wrappedJSObject is ignored.

Ignored in what sense?

As part of bug 386635, content sandbox objects are returned in SJOWs. SJOWs wrap objects across boundaries, so if GreaseMonkey did: sandbox.__proto__ = new XPCNativeWrapper(contentWindow); sandbox's proto would end up being a XOW around the content window instead of the intended XPCNW. In order to fix that, I detect that case and "fix" it. Unfortunately, if you're not GreaseMonkey, it has very unexpected behavior. We need to come up with a clean way of setting up a sandbox whose wrapping behavior is well-defined.

TODO: When this bug is fixed, remove the workaround introduced in bug 574033.

Doesn't sound like something that must be fixed for Firefox 4.

we do have a work around, so unless further testing shows otherwise we can do without. Our workaround is a bit hacky, perhaps someone can take a peek at bug 574033 and let us know if we are being insecure?

Is this still relevant after the compartments landing, with the evalInSandbox API changes etc?

We just have to test with the new API. Our current code looks like: http://mxr.mozilla.org/mozilla-central/source/toolkit/components/console/hudservice/HUDService.jsm?force=1#4142 4142 createSandbox: function JST_setupSandbox() 4143 { 4144 // create a JS Sandbox out of this.context 4145 this.sandbox = new Cu.Sandbox(this._window); 4146 this.sandbox.window = this._window; 4147 this.sandbox.console = this.console; 4148 this.sandbox.__helperFunctions__ = JSTermHelper(this); 4149 this.sandbox.__proto__ = this._window.wrappedJSObject; 4150 }, I think mrbkap said to do it like this instead: this.sandbox = new Cu.Sandbox(this._window, this._window, false); this.sandbox.window = this._window; this.sandbox.console = this.console; Is that right?

We need this for beta7 per mrbkap.

Though this was actually fixed by peterv's changes in bug 604957 and the changes to make the webconsole use the correct sandbox constructor.