gecko-dev/js/xpconnect/tests/unit/test_xray_instanceof.js

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

const {Services} = ChromeUtils.import("resource://gre/modules/Services.jsm");

add_task(function instanceof_xrays() {
  let sandbox = Cu.Sandbox(null);
  Cu.evalInSandbox(`
    this.proxy = new Proxy([], {
      getPrototypeOf() {
        return Date.prototype;
      },
    });

    this.inheritedProxy = Object.create(this.proxy);

    this.FunctionProxy = new Proxy(function() {}, {});
    this.functionProxyInstance = new this.FunctionProxy();

    this.CustomClass = class {};
    this.customClassInstance = new this.CustomClass();
  `, sandbox);

  {
    // Sanity check that instanceof still works with standard constructors when xrays are present.
    Assert.ok(Cu.evalInSandbox(`new Date()`, sandbox) instanceof sandbox.Date,
              "async function result in sandbox instanceof sandbox.Date");
    Assert.ok(new sandbox.Date() instanceof sandbox.Date,
              "sandbox.Date() instanceof sandbox.Date");

    Assert.ok(sandbox.CustomClass instanceof sandbox.Function,
              "Class constructor instanceof sandbox.Function");
    Assert.ok(sandbox.CustomClass instanceof sandbox.Object,
              "Class constructor instanceof sandbox.Object");

    // Both operands must have the same kind of Xray vision.
    Assert.equal(Cu.waiveXrays(sandbox.CustomClass) instanceof sandbox.Function, false,
                 "Class constructor with waived xrays instanceof sandbox.Function");
    Assert.equal(Cu.waiveXrays(sandbox.CustomClass) instanceof sandbox.Object, false,
                 "Class constructor with waived xrays instanceof sandbox.Object");
  }

  {
    let {proxy} = sandbox;
    Assert.equal(proxy instanceof sandbox.Date, false,
                 "instanceof should ignore the proxy trap");
    Assert.equal(proxy instanceof sandbox.Array, false,
                 "instanceof should ignore the proxy target");
    Assert.equal(Cu.waiveXrays(proxy) instanceof sandbox.Date, false,
                 "instanceof should ignore the proxy trap despite the waived xrays on the proxy");
    Assert.equal(Cu.waiveXrays(proxy) instanceof sandbox.Array, false,
                 "instanceof should ignore the proxy target despite the waived xrays on the proxy");

    Assert.equal(proxy instanceof Cu.waiveXrays(sandbox.Date), false,
                 "instanceof should ignore the proxy trap despite the waived xrays on the constructor");
    Assert.equal(proxy instanceof Cu.waiveXrays(sandbox.Array), false,
                 "instanceof should ignore the proxy target despite the waived xrays on the constructor");

    Assert.ok(Cu.waiveXrays(proxy) instanceof Cu.waiveXrays(sandbox.Date),
              "instanceof should trigger the proxy trap after waiving both Xrays");
  }


  {
    let {inheritedProxy} = sandbox;
    Assert.equal(inheritedProxy instanceof sandbox.Date, false,
                 "instanceof should ignore the inherited proxy trap");
    Assert.equal(Cu.waiveXrays(inheritedProxy) instanceof sandbox.Date, false,
                 "instanceof should ignore the inherited proxy trap despite the waived xrays on the proxy");

    Assert.equal(inheritedProxy instanceof Cu.waiveXrays(sandbox.Date), false,
                 "instanceof should ignore the inherited proxy trap despite the waived xrays on the constructor");

    Assert.ok(Cu.waiveXrays(inheritedProxy) instanceof Cu.waiveXrays(sandbox.Date),
              "instanceof should trigger the inherited proxy trap after waiving both Xrays");
  }

  {
    let {FunctionProxy, functionProxyInstance} = sandbox;

    // Ideally, the next two test cases should both throw "... not a function".
    // However, because the opaque XrayWrapper does not override isCallable, an
    // opaque XrayWrapper is still considered callable if the proxy target is,
    // and "instanceof" will try to look up the prototype of the wrapper (and
    // fail because opaque XrayWrappers hide the properties).
    Assert.throws(
      () => functionProxyInstance instanceof FunctionProxy,
      /'prototype' property of FunctionProxy is not an object/,
      "Opaque constructor proxy should be hidden by Xrays");
    Assert.throws(
      () => functionProxyInstance instanceof sandbox.proxy,
      /sandbox.proxy is not a function/,
      "Opaque non-constructor proxy should be hidden by Xrays");

    Assert.equal(functionProxyInstance instanceof Cu.waiveXrays(FunctionProxy), false,
                 "Waiver on opaque constructor proxy should be ignored for XrayWrapped functionProxyInstance");
    Assert.ok(Cu.waiveXrays(functionProxyInstance) instanceof Cu.waiveXrays(FunctionProxy),
              "instanceof should get through the proxy after waiving both Xrays");
  }

  {
    let {CustomClass, customClassInstance} = sandbox;
    // Under Xray vision, every JS object is either a plain object or array.
    // Prototypical inheritance is invisible when the constructor is wrapped.
    Assert.throws(
      () => customClassInstance instanceof CustomClass,
      /TypeError: 'prototype' property of CustomClass is not an object/,
      "instanceof on a custom JS class with xrays should fail");
    Assert.equal(customClassInstance instanceof Cu.waiveXrays(CustomClass), false,
                 "instanceof should return false if the instance and constructor have distinct Xray vision");
    Assert.ok(Cu.waiveXrays(customClassInstance) instanceof Cu.waiveXrays(CustomClass),
              "instanceof should see the true prototype of CustomClass after waiving Xrays");
  }
});

add_task(function instanceof_dom_xrays_hasInstance() {
  const principal = Services.scriptSecurityManager.createNullPrincipal({});
  const webnav = Services.appShell.createWindowlessBrowser(false);
  webnav.docShell.createAboutBlankContentViewer(principal);
  let window = webnav.document.defaultView;

  let sandbox = Cu.Sandbox(principal);
  sandbox.DOMObjectWithHasInstance = window.document;
  Cu.evalInSandbox(`
    this.DOMObjectWithHasInstance[Symbol.hasInstance] = function() {
      return true;
    };
    this.ObjectWithHasInstance = {
      [Symbol.hasInstance](v) {
        v.throwsIfVCannotBeAccessed;
        return true;
      },
    };
  `, sandbox);

  // Override the hasInstance handler in the window, so that we can detect when
  // we end up triggering hasInstance in the window's compartment.
  window.eval(`
    document[Symbol.hasInstance] = function() {
      throw "hasInstance_in_window";
    };
  `);

  sandbox.domobj = window.document.body;
  Assert.ok(sandbox.eval(`domobj.wrappedJSObject`),
            "DOM object is a XrayWrapper");
  Assert.ok(sandbox.eval(`DOMObjectWithHasInstance.wrappedJSObject`),
            "DOM object with Symbol.hasInstance is a XrayWrapper");

  for (let Obj of ["ObjectWithHasInstance", "DOMObjectWithHasInstance"]) {
    // Tests Xray vision *inside* the sandbox. The Symbol.hasInstance member
    // is a property / expando object in the sandbox's compartment, so the
    // "instanceof" operator should always trigger the hasInstance function.
    Assert.ok(sandbox.eval(`[] instanceof ${Obj}`),
              `Should call ${Obj}[Symbol.hasInstance] when left operand has no Xrays`);
    Assert.ok(sandbox.eval(`domobj instanceof ${Obj}`),
              `Should call ${Obj}[Symbol.hasInstance] when left operand has Xrays`);
    Assert.ok(sandbox.eval(`domobj.wrappedJSObject instanceof ${Obj}`),
              `Should call ${Obj}[Symbol.hasInstance] when left operand has waived Xrays`);

    // Tests Xray vision *outside* the sandbox. The Symbol.hasInstance member
    // should be hidden by Xrays.
    let sandboxObjWithHasInstance = sandbox[Obj];
    Assert.ok(Cu.isXrayWrapper(sandboxObjWithHasInstance),
              `sandbox.${Obj} is a XrayWrapper`);
    Assert.throws(
      () => sandbox.Object() instanceof sandboxObjWithHasInstance,
      /sandboxObjWithHasInstance is not a function/,
      `sandbox.${Obj}[Symbol.hasInstance] should be hidden by Xrays`);

    Assert.throws(
      () => Cu.waiveXrays(sandbox.Object()) instanceof sandboxObjWithHasInstance,
      /sandboxObjWithHasInstance is not a function/,
      `sandbox.${Obj}[Symbol.hasInstance] should be hidden by Xrays, despite the waived Xrays at the left`);

    // The Xay waiver on the right operand should be ignored if the left
    // operand still has Xrays.
    Assert.throws(
      () => sandbox.Object() instanceof Cu.waiveXrays(sandboxObjWithHasInstance),
      /Cu.waiveXrays\(\.\.\.\) is not a function/,
      `Waiver on sandbox.${Obj} should be ignored when the left operand has Xrays`);
    // (Cases where the left operand has no Xrays are checked below.)
  }

  // hasInstance is expected to be called, but still trigger an error because
  // properties of the object from the current context should not be readable
  // by the hasInstance function in the sandbox with a different principal.
  Assert.throws(
    () => [] instanceof Cu.waiveXrays(sandbox.ObjectWithHasInstance),
    /Permission denied to access property "throwsIfVCannotBeAccessed"/,
    `Should call (waived) sandbox.ObjectWithHasInstance[Symbol.hasInstance] when the left operand has no Xrays`);

  Assert.ok(Cu.waiveXrays(sandbox.Object()) instanceof Cu.waiveXrays(sandbox.ObjectWithHasInstance),
            `Should call (waived) sandbox.ObjectWithHasInstance[Symbol.hasInstance] when the left operand has waived Xrays`);

  // When Xrays of the DOM object are waived, we end up in the owner document's
  // compartment (instead of the sandbox).
  Assert.throws(
    () => [] instanceof Cu.waiveXrays(sandbox.DOMObjectWithHasInstance),
    /hasInstance_in_window/,
    "Should call (waived) sandbox.DOMObjectWithHasInstance[Symbol.hasInstance] when the left operand has no Xrays");

  Assert.throws(
    () => Cu.waiveXrays(sandbox.Object()) instanceof Cu.waiveXrays(sandbox.DOMObjectWithHasInstance),
    /hasInstance_in_window/,
    "Should call (waived) sandbox.DOMObjectWithHasInstance[Symbol.hasInstance] when the left operand has waived Xrays");

  webnav.close();
});