Backed out changeset 2dbf8f6bd2aa (bug 1092446) for suspicion of adding a hazard

dom/base/test/chrome/cpows_child.js

@@ -87,15 +87,6 @@ function parent_test()
   addMessageListener("cpows:from_parent", (msg) => {
     let obj = msg.objects.obj;
     ok(obj.a == 1, "correct value from parent");
-
-    // Test that a CPOW reference to a function in the chrome process
-    // is callable from unprivileged content. Greasemonkey uses this
-    // functionality.
-    let func = msg.objects.func;
-    let sb = Cu.Sandbox('http://www.example.com', {});
-    sb.func = func;
-    ok(sb.eval('func()') == 101, "can call parent's function in child");
-
     done_count++;
     if (done_count == 2)
       sendSyncMessage("cpows:done", {});

dom/base/test/chrome/cpows_parent.xul

@@ -181,11 +181,8 @@
       let func = message.objects.func;
       let result = func(n => 2*n);
       ok(result == 20, "result == 20");
-      function f() {
-        return 101;
-      }
       let obj = {a:1, __exposedProps__: {"a": "r"}};
-      savedMM.sendAsyncMessage("cpows:from_parent", {}, {obj: obj, func: f});
+      savedMM.sendAsyncMessage("cpows:from_parent", {}, {obj: obj});
     }
 
     // Make sure errors in this file actually hit window.onerror.

js/xpconnect/wrappers/WrapperFactory.cpp

@@ -16,11 +16,9 @@
 #include "xpcprivate.h"
 #include "XPCMaps.h"
 #include "mozilla/dom/BindingUtils.h"
-#include "JavaScriptParent.h"
 #include "jsfriendapi.h"
 #include "mozilla/Likely.h"
 #include "nsContentUtils.h"
-#include "nsXULAppAPI.h"
 
 using namespace JS;
 using namespace js;
@@ -425,12 +423,9 @@ WrapperFactory::Rewrap(JSContext *cx, HandleObject existing, HandleObject obj,
     }
 
     // If this is a chrome function being exposed to content, we need to allow
-    // call (but nothing else). We allow CPOWs that purport to be function's
-    // here, but only in the content process.
+    // call (but nothing else).
     else if (originIsChrome && !targetIsChrome &&
-             (IdentifyStandardInstance(obj) == JSProto_Function ||
-              (jsipc::IsCPOW(obj) && JS::IsCallable(obj) &&
-               XRE_GetProcessType() == GeckoProcessType_Content)))
+             IdentifyStandardInstance(obj) == JSProto_Function)
     {
         wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper, OpaqueWithCall>::singleton;
     }