Disallow sending JS functions to a different thread (608142, r=jst). a=beta7+

js/src/xpconnect/src/xpc.msg

@@ -215,6 +215,7 @@ XPC_MSG_DEF(NS_ERROR_CACHE_IN_USE                   , "Cache is currently in use
 XPC_MSG_DEF(NS_ERROR_DOCUMENT_NOT_CACHED            , "Document does not exist in cache")
 XPC_MSG_DEF(NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS     , "The requested number of domain levels exceeds those present in the host string")
 XPC_MSG_DEF(NS_ERROR_HOST_IS_IP_ADDRESS             , "The host string is an IP address")
+XPC_MSG_DEF(NS_ERROR_NOT_SAME_THREAD                , "Can't access a wrapped JS object from a different thread")
 
 /* storage related codes (from mozStorage.h) */
 XPC_MSG_DEF(NS_ERROR_STORAGE_BUSY                   , "SQLite database connection is busy")

js/src/xpconnect/src/xpcprivate.h

@@ -3071,6 +3071,7 @@ private:
     nsXPCWrappedJS* mRoot;
     nsXPCWrappedJS* mNext;
     nsISupports* mOuter;    // only set in root
+    nsCOMPtr<nsIThread> mThread;
 };
 
 /***************************************************************************/

js/src/xpconnect/src/xpcwrappedjs.cpp

@@ -43,6 +43,7 @@
 
 #include "xpcprivate.h"
 #include "nsAtomicRefcnt.h"
+#include "nsThreadUtils.h"
 
 // NOTE: much of the fancy footwork is done in xpcstubs.cpp
 
@@ -290,6 +291,7 @@ nsXPCWrappedJS::GetJSObject(JSObject** aJSObj)
 {
     NS_PRECONDITION(aJSObj, "bad param");
     NS_PRECONDITION(mJSObj, "bad wrapper");
+
     if(!(*aJSObj = mJSObj))
         return NS_ERROR_OUT_OF_MEMORY;
     return NS_OK;
@@ -433,7 +435,8 @@ nsXPCWrappedJS::nsXPCWrappedJS(XPCCallContext& ccx,
       mClass(aClass),
       mRoot(root ? root : this),
       mNext(nsnull),
-      mOuter(root ? nsnull : aOuter)
+      mOuter(root ? nsnull : aOuter),
+      mThread(do_GetCurrentThread())
 {
 #ifdef DEBUG_stats_jband
     static int count = 0;
@@ -568,6 +571,8 @@ nsXPCWrappedJS::CallMethod(PRUint16 methodIndex,
 {
     if(!IsValid())
         return NS_ERROR_UNEXPECTED;
+    if (NS_GetCurrentThread() != mThread)
+        return NS_ERROR_NOT_SAME_THREAD;
     return GetClass()->CallMethod(this, methodIndex, info, params);
 }
 

js/src/xpconnect/tests/unit/test_bug608142.js

@@ -0,0 +1,51 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: sw=4 ts=4 sts=4 et
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Necko Test Code.
+ *
+ * The Initial Developer of the Original Code is the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Andreas Gal <gal@uci.edu>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+function run_test() { 
+    var tm = Components.classes["@mozilla.org/thread-manager;1"].getService();
+    var thr = tm.newThread(0);
+
+    thr.dispatch({
+        run: function() {
+            do_check_true(false);
+        }
+    }, Components.interfaces.nsIThread.DISPATCH_NORMAL);
+
+    thr.shutdown();
+}
+

xpcom/base/nsError.h

@@ -307,6 +307,10 @@ inline int NS_SUCCEEDED(nsresult _nsresult) {
 
 #define NS_SUCCESS_LOSS_OF_INSIGNIFICANT_DATA   NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_XPCOM,  1)
 
+/* Result codes used by nsIThreadManager */
+
+#define NS_ERROR_NOT_SAME_THREAD                NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_XPCOM,  4)
+
 /**
  * Various operations are not permitted during XPCOM shutdown and will fail
  * with this exception.