Bug 1746650 - Port cross-compartment wrapping test, and fix bug with cross compartment sources. r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D135291

dom/streams/ReadableStreamBYOBReader.cpp

@@ -104,9 +104,17 @@ struct Read_ReadIntoRequest final : public ReadIntoRequest {
     //
     // chunk steps, given chunk:
     //         Resolve promise with «[ "value" → chunk, "done" → false ]».
+
+    // We need to wrap this as the chunk could have come from
+    // another compartment.
+    JS::RootedObject chunk(aCx, &aChunk.toObject());
+    if (!JS_WrapObject(aCx, &chunk)) {
+      return;
+    }
+
     ReadableStreamBYOBReadResult result;
     result.mValue.Construct();
-    result.mValue.Value().Init(&aChunk.toObject());
+    result.mValue.Value().Init(chunk);
     result.mDone.Construct(false);
 
     mPromise->MaybeResolve(result);
@@ -119,9 +127,17 @@ struct Read_ReadIntoRequest final : public ReadIntoRequest {
     //
     // close steps, given chunk:
     // Resolve promise with «[ "value" → chunk, "done" → true ]».
+
+    // We need to wrap this as the chunk could have come from
+    // another compartment.
+    JS::RootedObject chunk(aCx, &aChunk.toObject());
+    if (!JS_WrapObject(aCx, &chunk)) {
+      return;
+    }
+
     ReadableStreamBYOBReadResult result;
     result.mValue.Construct();
-    result.mValue.Value().Init(&aChunk.toObject());
+    result.mValue.Value().Init(chunk);
     result.mDone.Construct(true);
 
     mPromise->MaybeResolve(result);

dom/streams/ReadableStreamDefaultReader.cpp

@@ -138,7 +138,15 @@ static bool CreateValueDonePair(JSContext* aCx, bool forAuthorCode,
   if (!obj) {
     return false;
   }
-  if (!JS_DefineProperty(aCx, obj, "value", aValue, JSPROP_ENUMERATE)) {
+
+  // Value may need to be wrapped if stream and reader are in different
+  // compartments.
+  JS::RootedValue value(aCx, aValue);
+  if (!JS_WrapValue(aCx, &value)) {
+    return false;
+  }
+
+  if (!JS_DefineProperty(aCx, obj, "value", value, JSPROP_ENUMERATE)) {
     return false;
   }
   JS::RootedValue done(aCx, JS::BooleanValue(aDone));

dom/streams/test/xpcshell/bug-1503406.js

@@ -0,0 +1,20 @@
+let read;
+let reader;
+
+add_task(async function test() {
+  let g = newGlobal({ wantGlobalProperties: ["ReadableStream"] });
+  reader = g.eval(`
+    let stream = new ReadableStream({
+        start(controller) {
+            controller.enqueue([]);
+        },
+    });
+    let [b1, b2] = stream.tee();
+    b1.getReader();
+`);
+  read = new ReadableStream({}).getReader().read;
+});
+
+add_task(async function test2() {
+  read.call(reader);
+});

dom/streams/test/xpcshell/xpcshell.ini

@@ -10,3 +10,4 @@ support-files =
 [bug-1387503-1.js]
 prefs=
   security.allow_parent_unrestricted_js_loads=true
+[bug-1503406.js]