summaryrefslogtreecommitdiffstats
path: root/dom/base/nsGlobalWindowOuter.cpp
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--dom/base/nsGlobalWindowOuter.cpp7600
1 files changed, 7600 insertions, 0 deletions
diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp
new file mode 100644
index 0000000000..1dc31e8c3b
--- /dev/null
+++ b/dom/base/nsGlobalWindowOuter.cpp
@@ -0,0 +1,7600 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/Assertions.h"
+#include "mozilla/ScopeExit.h"
+#include "nsGlobalWindow.h"
+
+#include <algorithm>
+
+#include "mozilla/MemoryReporting.h"
+
+// Local Includes
+#include "Navigator.h"
+#include "mozilla/Encoding.h"
+#include "nsContentSecurityManager.h"
+#include "nsGlobalWindowOuter.h"
+#include "nsScreen.h"
+#include "nsHistory.h"
+#include "nsDOMNavigationTiming.h"
+#include "nsIDOMStorageManager.h"
+#include "nsISecureBrowserUI.h"
+#include "nsIWebProgressListener.h"
+#include "mozilla/AntiTrackingUtils.h"
+#include "mozilla/dom/AutoPrintEventDispatcher.h"
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/BrowserChild.h"
+#include "mozilla/dom/BrowsingContextBinding.h"
+#include "mozilla/dom/CanonicalBrowsingContext.h"
+#include "mozilla/dom/ContentChild.h"
+#include "mozilla/dom/ContentFrameMessageManager.h"
+#include "mozilla/dom/DocumentInlines.h"
+#include "mozilla/dom/EventTarget.h"
+#include "mozilla/dom/HTMLIFrameElement.h"
+#include "mozilla/dom/LocalStorage.h"
+#include "mozilla/dom/LSObject.h"
+#include "mozilla/dom/Storage.h"
+#include "mozilla/dom/MaybeCrossOriginObject.h"
+#include "mozilla/dom/Performance.h"
+#include "mozilla/dom/ProxyHandlerUtils.h"
+#include "mozilla/dom/StorageEvent.h"
+#include "mozilla/dom/StorageEventBinding.h"
+#include "mozilla/dom/StorageNotifierService.h"
+#include "mozilla/dom/StorageUtils.h"
+#include "mozilla/dom/Timeout.h"
+#include "mozilla/dom/TimeoutHandler.h"
+#include "mozilla/dom/TimeoutManager.h"
+#include "mozilla/dom/WindowContext.h"
+#include "mozilla/dom/WindowFeatures.h" // WindowFeatures
+#include "mozilla/dom/WindowProxyHolder.h"
+#include "mozilla/IntegerPrintfMacros.h"
+#include "mozilla/StorageAccessAPIHelper.h"
+#include "nsBaseCommandController.h"
+#include "nsError.h"
+#include "nsICookieService.h"
+#include "nsISizeOfEventTarget.h"
+#include "nsDOMJSUtils.h"
+#include "nsArrayUtils.h"
+#include "nsIDocShellTreeOwner.h"
+#include "nsIInterfaceRequestorUtils.h"
+#include "nsIPermissionManager.h"
+#include "nsIScriptContext.h"
+#include "nsWindowMemoryReporter.h"
+#include "nsWindowSizes.h"
+#include "WindowNamedPropertiesHandler.h"
+#include "nsFrameSelection.h"
+#include "nsNetUtil.h"
+#include "nsVariant.h"
+#include "nsPrintfCString.h"
+#include "mozilla/intl/LocaleService.h"
+#include "WindowDestroyedEvent.h"
+#include "nsDocShellLoadState.h"
+#include "mozilla/dom/WindowGlobalChild.h"
+
+// Helper Classes
+#include "nsJSUtils.h"
+#include "jsapi.h"
+#include "jsfriendapi.h"
+#include "js/CallAndConstruct.h" // JS::Call
+#include "js/friend/StackLimits.h" // js::AutoCheckRecursionLimit
+#include "js/friend/WindowProxy.h" // js::IsWindowProxy, js::SetWindowProxy
+#include "js/PropertyAndElement.h" // JS_DefineObject, JS_GetProperty
+#include "js/PropertySpec.h"
+#include "js/RealmIterators.h"
+#include "js/Wrapper.h"
+#include "nsLayoutUtils.h"
+#include "nsReadableUtils.h"
+#include "nsJSEnvironment.h"
+#include "mozilla/dom/ScriptSettings.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/Likely.h"
+#include "mozilla/SpinEventLoopUntil.h"
+#include "mozilla/Sprintf.h"
+#include "mozilla/Unused.h"
+
+// Other Classes
+#include "mozilla/dom/BarProps.h"
+#include "nsContentCID.h"
+#include "nsLayoutStatics.h"
+#include "nsCCUncollectableMarker.h"
+#include "mozilla/dom/WorkerCommon.h"
+#include "mozilla/dom/ToJSValue.h"
+#include "nsJSPrincipals.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/Components.h"
+#include "mozilla/Debug.h"
+#include "mozilla/EventListenerManager.h"
+#include "mozilla/MouseEvents.h"
+#include "mozilla/PresShell.h"
+#include "mozilla/ProcessHangMonitor.h"
+#include "mozilla/StaticPrefs_dom.h"
+#include "mozilla/StaticPrefs_full_screen_api.h"
+#include "mozilla/StaticPrefs_print.h"
+#include "mozilla/StaticPrefs_fission.h"
+#include "mozilla/ThrottledEventQueue.h"
+#include "AudioChannelService.h"
+#include "nsAboutProtocolUtils.h"
+#include "nsCharTraits.h" // NS_IS_HIGH/LOW_SURROGATE
+#include "PostMessageEvent.h"
+#include "mozilla/dom/DocGroup.h"
+#include "mozilla/net/CookieJarSettings.h"
+
+// Interfaces Needed
+#include "nsIFrame.h"
+#include "nsCanvasFrame.h"
+#include "nsIWidget.h"
+#include "nsIWidgetListener.h"
+#include "nsIBaseWindow.h"
+#include "nsIDeviceSensors.h"
+#include "nsIContent.h"
+#include "nsIDocShell.h"
+#include "mozilla/dom/Document.h"
+#include "Crypto.h"
+#include "nsDOMString.h"
+#include "nsThreadUtils.h"
+#include "nsILoadContext.h"
+#include "nsIScrollableFrame.h"
+#include "nsView.h"
+#include "nsViewManager.h"
+#include "nsIPrompt.h"
+#include "nsIPromptService.h"
+#include "nsIPromptFactory.h"
+#include "nsIWritablePropertyBag2.h"
+#include "nsIWebNavigation.h"
+#include "nsIWebBrowserChrome.h"
+#include "nsIWebBrowserFind.h" // For window.find()
+#include "nsComputedDOMStyle.h"
+#include "nsDOMCID.h"
+#include "nsDOMWindowUtils.h"
+#include "nsIWindowWatcher.h"
+#include "nsPIWindowWatcher.h"
+#include "nsIContentViewer.h"
+#include "nsIScriptError.h"
+#include "nsISHistory.h"
+#include "nsIControllers.h"
+#include "nsGlobalWindowCommands.h"
+#include "nsQueryObject.h"
+#include "nsContentUtils.h"
+#include "nsCSSProps.h"
+#include "nsIURIFixup.h"
+#include "nsIURIMutator.h"
+#include "mozilla/EventDispatcher.h"
+#include "mozilla/EventStateManager.h"
+#include "nsIObserverService.h"
+#include "nsFocusManager.h"
+#include "nsIAppWindow.h"
+#include "nsServiceManagerUtils.h"
+#include "mozilla/dom/CustomEvent.h"
+#include "nsIScreenManager.h"
+#include "nsIClassifiedChannel.h"
+#include "nsIXULRuntime.h"
+#include "xpcprivate.h"
+
+#ifdef NS_PRINTING
+# include "nsIPrintSettings.h"
+# include "nsIPrintSettingsService.h"
+# include "nsIWebBrowserPrint.h"
+#endif
+
+#include "nsWindowRoot.h"
+#include "nsNetCID.h"
+#include "nsIArray.h"
+
+#include "nsIDOMXULCommandDispatcher.h"
+
+#include "mozilla/GlobalKeyListener.h"
+
+#include "nsIDragService.h"
+#include "mozilla/dom/Element.h"
+#include "mozilla/dom/Selection.h"
+#include "nsFrameLoader.h"
+#include "nsFrameLoaderOwner.h"
+#include "nsXPCOMCID.h"
+#include "mozilla/Logging.h"
+#include "mozilla/ProfilerMarkers.h"
+#include "prenv.h"
+
+#include "mozilla/dom/IDBFactory.h"
+#include "mozilla/dom/MessageChannel.h"
+#include "mozilla/dom/Promise.h"
+
+#include "mozilla/dom/Gamepad.h"
+#include "mozilla/dom/GamepadManager.h"
+
+#include "gfxVR.h"
+#include "VRShMem.h"
+#include "FxRWindowManager.h"
+#include "mozilla/dom/VRDisplay.h"
+#include "mozilla/dom/VRDisplayEvent.h"
+#include "mozilla/dom/VRDisplayEventBinding.h"
+#include "mozilla/dom/VREventObserver.h"
+
+#include "nsRefreshDriver.h"
+
+#include "mozilla/extensions/WebExtensionPolicy.h"
+
+#include "mozilla/BasePrincipal.h"
+#include "mozilla/Services.h"
+#include "mozilla/Telemetry.h"
+#include "mozilla/dom/Location.h"
+#include "nsHTMLDocument.h"
+#include "nsWrapperCacheInlines.h"
+#include "mozilla/DOMEventTargetHelper.h"
+#include "prrng.h"
+#include "nsSandboxFlags.h"
+#include "nsXULControllers.h"
+#include "mozilla/dom/AudioContext.h"
+#include "mozilla/dom/BrowserElementDictionariesBinding.h"
+#include "mozilla/dom/BrowsingContextGroup.h"
+#include "mozilla/dom/cache/CacheStorage.h"
+#include "mozilla/dom/Console.h"
+#include "mozilla/dom/Fetch.h"
+#include "mozilla/dom/FunctionBinding.h"
+#include "mozilla/dom/HashChangeEvent.h"
+#include "mozilla/dom/IntlUtils.h"
+#include "mozilla/dom/PopStateEvent.h"
+#include "mozilla/dom/PopupBlockedEvent.h"
+#include "mozilla/dom/PrimitiveConversions.h"
+#include "mozilla/dom/WindowBinding.h"
+#include "nsIBrowserChild.h"
+#include "mozilla/dom/MediaQueryList.h"
+#include "mozilla/dom/NavigatorBinding.h"
+#include "mozilla/dom/ImageBitmap.h"
+#include "mozilla/dom/ImageBitmapBinding.h"
+#include "mozilla/dom/ServiceWorkerRegistration.h"
+#include "mozilla/dom/WebIDLGlobalNameHash.h"
+#include "mozilla/dom/Worklet.h"
+#include "AccessCheck.h"
+
+#ifdef MOZ_WEBSPEECH
+# include "mozilla/dom/SpeechSynthesis.h"
+#endif
+
+#ifdef ANDROID
+# include <android/log.h>
+#endif
+
+#ifdef XP_WIN
+# include <process.h>
+# define getpid _getpid
+#else
+# include <unistd.h> // for getpid()
+#endif
+
+using namespace mozilla;
+using namespace mozilla::dom;
+using namespace mozilla::dom::ipc;
+using mozilla::BasePrincipal;
+using mozilla::OriginAttributes;
+using mozilla::TimeStamp;
+using mozilla::layout::RemotePrintJobChild;
+
+#define FORWARD_TO_INNER(method, args, err_rval) \
+ PR_BEGIN_MACRO \
+ if (!mInnerWindow) { \
+ NS_WARNING("No inner window available!"); \
+ return err_rval; \
+ } \
+ return GetCurrentInnerWindowInternal()->method args; \
+ PR_END_MACRO
+
+#define FORWARD_TO_INNER_VOID(method, args) \
+ PR_BEGIN_MACRO \
+ if (!mInnerWindow) { \
+ NS_WARNING("No inner window available!"); \
+ return; \
+ } \
+ GetCurrentInnerWindowInternal()->method args; \
+ return; \
+ PR_END_MACRO
+
+// Same as FORWARD_TO_INNER, but this will create a fresh inner if an
+// inner doesn't already exists.
+#define FORWARD_TO_INNER_CREATE(method, args, err_rval) \
+ PR_BEGIN_MACRO \
+ if (!mInnerWindow) { \
+ if (mIsClosed) { \
+ return err_rval; \
+ } \
+ nsCOMPtr<Document> kungFuDeathGrip = GetDoc(); \
+ ::mozilla::Unused << kungFuDeathGrip; \
+ if (!mInnerWindow) { \
+ return err_rval; \
+ } \
+ } \
+ return GetCurrentInnerWindowInternal()->method args; \
+ PR_END_MACRO
+
+static LazyLogModule gDOMLeakPRLogOuter("DOMLeakOuter");
+extern LazyLogModule gPageCacheLog;
+
+#ifdef DEBUG
+static LazyLogModule gDocShellAndDOMWindowLeakLogging(
+ "DocShellAndDOMWindowLeak");
+#endif
+
+nsGlobalWindowOuter::OuterWindowByIdTable*
+ nsGlobalWindowOuter::sOuterWindowsById = nullptr;
+
+/* static */
+nsPIDOMWindowOuter* nsPIDOMWindowOuter::GetFromCurrentInner(
+ nsPIDOMWindowInner* aInner) {
+ if (!aInner) {
+ return nullptr;
+ }
+
+ nsPIDOMWindowOuter* outer = aInner->GetOuterWindow();
+ if (!outer || outer->GetCurrentInnerWindow() != aInner) {
+ return nullptr;
+ }
+
+ return outer;
+}
+
+//*****************************************************************************
+// nsOuterWindowProxy: Outer Window Proxy
+//*****************************************************************************
+
+// Give OuterWindowProxyClass 2 reserved slots, like the other wrappers, so
+// JSObject::swap can swap it with CrossCompartmentWrappers without requiring
+// malloc.
+//
+// We store the nsGlobalWindowOuter* in our first slot.
+//
+// We store our holder weakmap in the second slot.
+const JSClass OuterWindowProxyClass = PROXY_CLASS_DEF(
+ "Proxy", JSCLASS_HAS_RESERVED_SLOTS(2)); /* additional class flags */
+
+static const size_t OUTER_WINDOW_SLOT = 0;
+static const size_t HOLDER_WEAKMAP_SLOT = 1;
+
+class nsOuterWindowProxy : public MaybeCrossOriginObject<js::Wrapper> {
+ using Base = MaybeCrossOriginObject<js::Wrapper>;
+
+ public:
+ constexpr nsOuterWindowProxy() : Base(0) {}
+
+ bool finalizeInBackground(const JS::Value& priv) const override {
+ return false;
+ }
+
+ // Standard internal methods
+ /**
+ * Implementation of [[GetOwnProperty]] as defined at
+ * https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-getownproperty
+ *
+ * "proxy" is the WindowProxy object involved. It may not be same-compartment
+ * with cx.
+ */
+ bool getOwnPropertyDescriptor(
+ JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
+ JS::MutableHandle<Maybe<JS::PropertyDescriptor>> desc) const override;
+
+ /*
+ * Implementation of the same-origin case of
+ * <https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-getownproperty>.
+ */
+ bool definePropertySameOrigin(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::Handle<jsid> id,
+ JS::Handle<JS::PropertyDescriptor> desc,
+ JS::ObjectOpResult& result) const override;
+
+ /**
+ * Implementation of [[OwnPropertyKeys]] as defined at
+ *
+ * https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-ownpropertykeys
+ *
+ * "proxy" is the WindowProxy object involved. It may not be same-compartment
+ * with cx.
+ */
+ bool ownPropertyKeys(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::MutableHandleVector<jsid> props) const override;
+ /**
+ * Implementation of [[Delete]] as defined at
+ * https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-delete
+ *
+ * "proxy" is the WindowProxy object involved. It may not be same-compartment
+ * with cx.
+ */
+ bool delete_(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
+ JS::ObjectOpResult& result) const override;
+
+ /**
+ * Implementaton of hook for superclass getPrototype() method.
+ */
+ JSObject* getSameOriginPrototype(JSContext* cx) const override;
+
+ /**
+ * Implementation of [[HasProperty]] internal method as defined at
+ * https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots-hasproperty-p
+ *
+ * "proxy" is the WindowProxy object involved. It may not be same-compartment
+ * with cx.
+ *
+ * Note that the HTML spec does not define an override for this internal
+ * method, so we just want the "normal object" behavior. We have to override
+ * it, because js::Wrapper also overrides, with "not normal" behavior.
+ */
+ bool has(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
+ bool* bp) const override;
+
+ /**
+ * Implementation of [[Get]] internal method as defined at
+ * <https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-get>.
+ *
+ * "proxy" is the WindowProxy object involved. It may or may not be
+ * same-compartment with "cx".
+ *
+ * "receiver" is the receiver ("this") for the get. It will be
+ * same-compartment with "cx".
+ *
+ * "vp" is the return value. It will be same-compartment with "cx".
+ */
+ bool get(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::Handle<JS::Value> receiver, JS::Handle<jsid> id,
+ JS::MutableHandle<JS::Value> vp) const override;
+
+ /**
+ * Implementation of [[Set]] internal method as defined at
+ * <https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-set>.
+ *
+ * "proxy" is the WindowProxy object involved. It may or may not be
+ * same-compartment with "cx".
+ *
+ * "v" is the value being set. It will be same-compartment with "cx".
+ *
+ * "receiver" is the receiver ("this") for the set. It will be
+ * same-compartment with "cx".
+ */
+ bool set(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
+ JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver,
+ JS::ObjectOpResult& result) const override;
+
+ // SpiderMonkey extensions
+ /**
+ * Implementation of SpiderMonkey extension which just checks whether this
+ * object has the property. Basically Object.getOwnPropertyDescriptor(obj,
+ * prop) !== undefined. but does not require reifying the descriptor.
+ *
+ * We have to override this because js::Wrapper overrides it, but we want
+ * different behavior from js::Wrapper.
+ *
+ * "proxy" is the WindowProxy object involved. It may not be same-compartment
+ * with cx.
+ */
+ bool hasOwn(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
+ bool* bp) const override;
+
+ /**
+ * Implementation of SpiderMonkey extension which is used as a fast path for
+ * enumerating.
+ *
+ * We have to override this because js::Wrapper overrides it, but we want
+ * different behavior from js::Wrapper.
+ *
+ * "proxy" is the WindowProxy object involved. It may not be same-compartment
+ * with cx.
+ */
+ bool getOwnEnumerablePropertyKeys(
+ JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::MutableHandleVector<jsid> props) const override;
+
+ /**
+ * Hook used by SpiderMonkey to implement Object.prototype.toString.
+ */
+ const char* className(JSContext* cx,
+ JS::Handle<JSObject*> wrapper) const override;
+
+ void finalize(JS::GCContext* gcx, JSObject* proxy) const override;
+ size_t objectMoved(JSObject* proxy, JSObject* old) const override;
+
+ bool isCallable(JSObject* obj) const override { return false; }
+ bool isConstructor(JSObject* obj) const override { return false; }
+
+ static const nsOuterWindowProxy singleton;
+
+ static nsGlobalWindowOuter* GetOuterWindow(JSObject* proxy) {
+ nsGlobalWindowOuter* outerWindow =
+ nsGlobalWindowOuter::FromSupports(static_cast<nsISupports*>(
+ js::GetProxyReservedSlot(proxy, OUTER_WINDOW_SLOT).toPrivate()));
+ return outerWindow;
+ }
+
+ protected:
+ // False return value means we threw an exception. True return value
+ // but false "found" means we didn't have a subframe at that index.
+ bool GetSubframeWindow(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp,
+ bool& found) const;
+
+ // Returns a non-null window only if id is an index and we have a
+ // window at that index.
+ Nullable<WindowProxyHolder> GetSubframeWindow(JSContext* cx,
+ JS::Handle<JSObject*> proxy,
+ JS::Handle<jsid> id) const;
+
+ bool AppendIndexedPropertyNames(JSObject* proxy,
+ JS::MutableHandleVector<jsid> props) const;
+
+ using MaybeCrossOriginObjectMixins::EnsureHolder;
+ bool EnsureHolder(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::MutableHandle<JSObject*> holder) const override;
+
+ // Helper method for creating a special "print" method that allows printing
+ // our PDF-viewer documents even if you're not same-origin with them.
+ //
+ // aProxy must be our nsOuterWindowProxy. It will not be same-compartment
+ // with aCx, since we only use this on the different-origin codepath!
+ //
+ // Can return true without filling in aDesc, which corresponds to not exposing
+ // a "print" method.
+ static bool MaybeGetPDFJSPrintMethod(
+ JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::MutableHandle<Maybe<JS::PropertyDescriptor>> desc);
+
+ // The actual "print" method we use for the PDFJS case.
+ static bool PDFJSPrintMethod(JSContext* cx, unsigned argc, JS::Value* vp);
+
+ // Helper method to get the pre-PDF-viewer-messing-with-it principal from an
+ // inner window. Will return null if this is not a PDF-viewer inner or if the
+ // principal could not be found for some reason.
+ static already_AddRefed<nsIPrincipal> GetNoPDFJSPrincipal(
+ nsGlobalWindowInner* inner);
+};
+
+const char* nsOuterWindowProxy::className(JSContext* cx,
+ JS::Handle<JSObject*> proxy) const {
+ MOZ_ASSERT(js::IsProxy(proxy));
+
+ if (!IsPlatformObjectSameOrigin(cx, proxy)) {
+ return "Object";
+ }
+
+ return "Window";
+}
+
+void nsOuterWindowProxy::finalize(JS::GCContext* gcx, JSObject* proxy) const {
+ nsGlobalWindowOuter* outerWindow = GetOuterWindow(proxy);
+ if (outerWindow) {
+ outerWindow->ClearWrapper(proxy);
+ BrowsingContext* bc = outerWindow->GetBrowsingContext();
+ if (bc) {
+ bc->ClearWindowProxy();
+ }
+
+ // Ideally we would use OnFinalize here, but it's possible that
+ // EnsureScriptEnvironment will later be called on the window, and we don't
+ // want to create a new script object in that case. Therefore, we need to
+ // write a non-null value that will reliably crash when dereferenced.
+ outerWindow->PoisonOuterWindowProxy(proxy);
+ }
+}
+
+bool nsOuterWindowProxy::getOwnPropertyDescriptor(
+ JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
+ JS::MutableHandle<Maybe<JS::PropertyDescriptor>> desc) const {
+ // First check for indexed access. This is
+ // https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-getownproperty
+ // step 2, mostly.
+ JS::Rooted<JS::Value> subframe(cx);
+ bool found;
+ if (!GetSubframeWindow(cx, proxy, id, &subframe, found)) {
+ return false;
+ }
+ if (found) {
+ // Step 2.4.
+
+ desc.set(Some(JS::PropertyDescriptor::Data(
+ subframe, {
+ JS::PropertyAttribute::Configurable,
+ JS::PropertyAttribute::Enumerable,
+ })));
+ return true;
+ }
+
+ bool isSameOrigin = IsPlatformObjectSameOrigin(cx, proxy);
+
+ // If we did not find a subframe, we could still have an indexed property
+ // access. In that case we should throw a SecurityError in the cross-origin
+ // case.
+ if (!isSameOrigin && IsArrayIndex(GetArrayIndexFromId(id))) {
+ // Step 2.5.2.
+ return ReportCrossOriginDenial(cx, id, "access"_ns);
+ }
+
+ // Step 2.5.1 is handled via the forwarding to js::Wrapper; it saves us an
+ // IsArrayIndex(GetArrayIndexFromId(id)) here. We'll never have a property on
+ // the Window whose name is an index, because our defineProperty doesn't pass
+ // those on to the Window.
+
+ // Step 3.
+ if (isSameOrigin) {
+ if (StaticPrefs::dom_missing_prop_counters_enabled() && id.isAtom()) {
+ Window_Binding::CountMaybeMissingProperty(proxy, id);
+ }
+
+ // Fall through to js::Wrapper.
+ { // Scope for JSAutoRealm while we are dealing with js::Wrapper.
+ // When forwarding to js::Wrapper, we should just enter the Realm of proxy
+ // for now. That's what js::Wrapper expects, and since we're same-origin
+ // anyway this is not changing any security behavior.
+ JSAutoRealm ar(cx, proxy);
+ JS_MarkCrossZoneId(cx, id);
+ bool ok = js::Wrapper::getOwnPropertyDescriptor(cx, proxy, id, desc);
+ if (!ok) {
+ return false;
+ }
+
+#if 0
+ // See https://github.com/tc39/ecma262/issues/672 for more information.
+ if (desc.isSome() &&
+ !IsNonConfigurableReadonlyPrimitiveGlobalProp(cx, id)) {
+ (*desc).setConfigurable(true);
+ }
+#endif
+ }
+
+ // Now wrap our descriptor back into the Realm that asked for it.
+ return JS_WrapPropertyDescriptor(cx, desc);
+ }
+
+ // Step 4.
+ if (!CrossOriginGetOwnPropertyHelper(cx, proxy, id, desc)) {
+ return false;
+ }
+
+ // Step 5
+ if (desc.isSome()) {
+ return true;
+ }
+
+ // Non-spec step for the PDF viewer's window.print(). This comes before we
+ // check for named subframes, because in the same-origin case print() would
+ // shadow those.
+ if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_PRINT)) {
+ if (!MaybeGetPDFJSPrintMethod(cx, proxy, desc)) {
+ return false;
+ }
+
+ if (desc.isSome()) {
+ return true;
+ }
+ }
+
+ // Step 6 -- check for named subframes.
+ if (id.isString()) {
+ nsAutoJSString name;
+ if (!name.init(cx, id.toString())) {
+ return false;
+ }
+ nsGlobalWindowOuter* win = GetOuterWindow(proxy);
+ if (RefPtr<BrowsingContext> childDOMWin = win->GetChildWindow(name)) {
+ JS::Rooted<JS::Value> childValue(cx);
+ if (!ToJSValue(cx, WindowProxyHolder(childDOMWin), &childValue)) {
+ return false;
+ }
+ desc.set(Some(JS::PropertyDescriptor::Data(
+ childValue, {JS::PropertyAttribute::Configurable})));
+ return true;
+ }
+ }
+
+ // And step 7.
+ return CrossOriginPropertyFallback(cx, proxy, id, desc);
+}
+
+bool nsOuterWindowProxy::definePropertySameOrigin(
+ JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
+ JS::Handle<JS::PropertyDescriptor> desc, JS::ObjectOpResult& result) const {
+ if (IsArrayIndex(GetArrayIndexFromId(id))) {
+ // Spec says to Reject whether this is a supported index or not,
+ // since we have no indexed setter or indexed creator. It is up
+ // to the caller to decide whether to throw a TypeError.
+ return result.failCantDefineWindowElement();
+ }
+
+ JS::ObjectOpResult ourResult;
+ bool ok = js::Wrapper::defineProperty(cx, proxy, id, desc, ourResult);
+ if (!ok) {
+ return false;
+ }
+
+ if (!ourResult.ok()) {
+ // It's possible that this failed because the page got the existing
+ // descriptor (which we force to claim to be configurable) and then tried to
+ // redefine the property with the descriptor it got but a different value.
+ // We want to allow this case to succeed, so check for it and if we're in
+ // that case try again but now with an attempt to define a non-configurable
+ // property.
+ if (!desc.hasConfigurable() || !desc.configurable()) {
+ // The incoming descriptor was not explicitly marked "configurable: true",
+ // so it failed for some other reason. Just propagate that reason out.
+ result = ourResult;
+ return true;
+ }
+
+ JS::Rooted<Maybe<JS::PropertyDescriptor>> existingDesc(cx);
+ ok = js::Wrapper::getOwnPropertyDescriptor(cx, proxy, id, &existingDesc);
+ if (!ok) {
+ return false;
+ }
+ if (existingDesc.isNothing() || existingDesc->configurable()) {
+ // We have no existing property, or its descriptor is already configurable
+ // (on the Window itself, where things really can be non-configurable).
+ // So we failed for some other reason, which we should propagate out.
+ result = ourResult;
+ return true;
+ }
+
+ JS::Rooted<JS::PropertyDescriptor> updatedDesc(cx, desc);
+ updatedDesc.setConfigurable(false);
+
+ JS::ObjectOpResult ourNewResult;
+ ok = js::Wrapper::defineProperty(cx, proxy, id, updatedDesc, ourNewResult);
+ if (!ok) {
+ return false;
+ }
+
+ if (!ourNewResult.ok()) {
+ // Twiddling the configurable flag didn't help. Just return this failure
+ // out to the caller.
+ result = ourNewResult;
+ return true;
+ }
+ }
+
+#if 0
+ // See https://github.com/tc39/ecma262/issues/672 for more information.
+ if (desc.hasConfigurable() && !desc.configurable() &&
+ !IsNonConfigurableReadonlyPrimitiveGlobalProp(cx, id)) {
+ // Give callers a way to detect that they failed to "really" define a
+ // non-configurable property.
+ result.failCantDefineWindowNonConfigurable();
+ return true;
+ }
+#endif
+
+ result.succeed();
+ return true;
+}
+
+bool nsOuterWindowProxy::ownPropertyKeys(
+ JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::MutableHandleVector<jsid> props) const {
+ // Just our indexed stuff followed by our "normal" own property names.
+ if (!AppendIndexedPropertyNames(proxy, props)) {
+ return false;
+ }
+
+ if (IsPlatformObjectSameOrigin(cx, proxy)) {
+ // When forwarding to js::Wrapper, we should just enter the Realm of proxy
+ // for now. That's what js::Wrapper expects, and since we're same-origin
+ // anyway this is not changing any security behavior.
+ JS::RootedVector<jsid> innerProps(cx);
+ { // Scope for JSAutoRealm so we can mark the ids once we exit it
+ JSAutoRealm ar(cx, proxy);
+ if (!js::Wrapper::ownPropertyKeys(cx, proxy, &innerProps)) {
+ return false;
+ }
+ }
+ for (auto& id : innerProps) {
+ JS_MarkCrossZoneId(cx, id);
+ }
+ return js::AppendUnique(cx, props, innerProps);
+ }
+
+ // In the cross-origin case we purposefully exclude subframe names from the
+ // list of property names we report here.
+ JS::Rooted<JSObject*> holder(cx);
+ if (!EnsureHolder(cx, proxy, &holder)) {
+ return false;
+ }
+
+ JS::RootedVector<jsid> crossOriginProps(cx);
+ if (!js::GetPropertyKeys(cx, holder,
+ JSITER_OWNONLY | JSITER_HIDDEN | JSITER_SYMBOLS,
+ &crossOriginProps) ||
+ !js::AppendUnique(cx, props, crossOriginProps)) {
+ return false;
+ }
+
+ // Add the "print" property if needed.
+ nsGlobalWindowOuter* outer = GetOuterWindow(proxy);
+ nsGlobalWindowInner* inner =
+ nsGlobalWindowInner::Cast(outer->GetCurrentInnerWindow());
+ if (inner) {
+ nsCOMPtr<nsIPrincipal> targetPrincipal = GetNoPDFJSPrincipal(inner);
+ if (targetPrincipal &&
+ nsContentUtils::SubjectPrincipal(cx)->Equals(targetPrincipal)) {
+ JS::RootedVector<jsid> printProp(cx);
+ if (!printProp.append(GetJSIDByIndex(cx, XPCJSContext::IDX_PRINT)) ||
+ !js::AppendUnique(cx, props, printProp)) {
+ return false;
+ }
+ }
+ }
+
+ return xpc::AppendCrossOriginWhitelistedPropNames(cx, props);
+}
+
+bool nsOuterWindowProxy::delete_(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::Handle<jsid> id,
+ JS::ObjectOpResult& result) const {
+ if (!IsPlatformObjectSameOrigin(cx, proxy)) {
+ return ReportCrossOriginDenial(cx, id, "delete"_ns);
+ }
+
+ if (!GetSubframeWindow(cx, proxy, id).IsNull()) {
+ // Fail (which means throw if strict, else return false).
+ return result.failCantDeleteWindowElement();
+ }
+
+ if (IsArrayIndex(GetArrayIndexFromId(id))) {
+ // Indexed, but not supported. Spec says return true.
+ return result.succeed();
+ }
+
+ // We're same-origin, so it should be safe to enter the Realm of "proxy".
+ // Let's do that, just in case, to avoid cross-compartment issues in our
+ // js::Wrapper caller..
+ JSAutoRealm ar(cx, proxy);
+ JS_MarkCrossZoneId(cx, id);
+ return js::Wrapper::delete_(cx, proxy, id, result);
+}
+
+JSObject* nsOuterWindowProxy::getSameOriginPrototype(JSContext* cx) const {
+ return Window_Binding::GetProtoObjectHandle(cx);
+}
+
+bool nsOuterWindowProxy::has(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::Handle<jsid> id, bool* bp) const {
+ // We could just directly forward this method to js::BaseProxyHandler, but
+ // that involves reifying the actual property descriptor, which might be more
+ // work than we have to do for has() on the Window.
+
+ if (!IsPlatformObjectSameOrigin(cx, proxy)) {
+ // In the cross-origin case we only have own properties. Just call hasOwn
+ // directly.
+ return hasOwn(cx, proxy, id, bp);
+ }
+
+ if (!GetSubframeWindow(cx, proxy, id).IsNull()) {
+ *bp = true;
+ return true;
+ }
+
+ // Just to be safe in terms of compartment asserts, enter the Realm of
+ // "proxy". We're same-origin with it, so this should be safe.
+ JSAutoRealm ar(cx, proxy);
+ JS_MarkCrossZoneId(cx, id);
+ return js::Wrapper::has(cx, proxy, id, bp);
+}
+
+bool nsOuterWindowProxy::hasOwn(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::Handle<jsid> id, bool* bp) const {
+ // We could just directly forward this method to js::BaseProxyHandler, but
+ // that involves reifying the actual property descriptor, which might be more
+ // work than we have to do for hasOwn() on the Window.
+
+ if (!IsPlatformObjectSameOrigin(cx, proxy)) {
+ // Avoiding reifying the property descriptor here would require duplicating
+ // a bunch of "is this property exposed cross-origin" logic, which is
+ // probably not worth it. Just forward this along to the base
+ // implementation.
+ //
+ // It's very important to not forward this to js::Wrapper, because that will
+ // not do the right security and cross-origin checks and will pass through
+ // the call to the Window.
+ //
+ // The BaseProxyHandler code is OK with this happening without entering the
+ // compartment of "proxy".
+ return js::BaseProxyHandler::hasOwn(cx, proxy, id, bp);
+ }
+
+ if (!GetSubframeWindow(cx, proxy, id).IsNull()) {
+ *bp = true;
+ return true;
+ }
+
+ // Just to be safe in terms of compartment asserts, enter the Realm of
+ // "proxy". We're same-origin with it, so this should be safe.
+ JSAutoRealm ar(cx, proxy);
+ JS_MarkCrossZoneId(cx, id);
+ return js::Wrapper::hasOwn(cx, proxy, id, bp);
+}
+
+bool nsOuterWindowProxy::get(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::Handle<JS::Value> receiver,
+ JS::Handle<jsid> id,
+ JS::MutableHandle<JS::Value> vp) const {
+ if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_WRAPPED_JSOBJECT) &&
+ xpc::AccessCheck::isChrome(js::GetContextCompartment(cx))) {
+ vp.set(JS::ObjectValue(*proxy));
+ return MaybeWrapValue(cx, vp);
+ }
+
+ if (!IsPlatformObjectSameOrigin(cx, proxy)) {
+ return CrossOriginGet(cx, proxy, receiver, id, vp);
+ }
+
+ bool found;
+ if (!GetSubframeWindow(cx, proxy, id, vp, found)) {
+ return false;
+ }
+
+ if (found) {
+ return true;
+ }
+
+ if (StaticPrefs::dom_missing_prop_counters_enabled() && id.isAtom()) {
+ Window_Binding::CountMaybeMissingProperty(proxy, id);
+ }
+
+ { // Scope for JSAutoRealm
+ // Enter "proxy"'s Realm. We're in the same-origin case, so this should be
+ // safe.
+ JSAutoRealm ar(cx, proxy);
+
+ JS_MarkCrossZoneId(cx, id);
+
+ JS::Rooted<JS::Value> wrappedReceiver(cx, receiver);
+ if (!MaybeWrapValue(cx, &wrappedReceiver)) {
+ return false;
+ }
+
+ // Fall through to js::Wrapper.
+ if (!js::Wrapper::get(cx, proxy, wrappedReceiver, id, vp)) {
+ return false;
+ }
+ }
+
+ // Make sure our return value is in the caller compartment.
+ return MaybeWrapValue(cx, vp);
+}
+
+bool nsOuterWindowProxy::set(JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::Handle<jsid> id, JS::Handle<JS::Value> v,
+ JS::Handle<JS::Value> receiver,
+ JS::ObjectOpResult& result) const {
+ if (!IsPlatformObjectSameOrigin(cx, proxy)) {
+ return CrossOriginSet(cx, proxy, id, v, receiver, result);
+ }
+
+ if (IsArrayIndex(GetArrayIndexFromId(id))) {
+ // Reject the set. It's up to the caller to decide whether to throw a
+ // TypeError. If the caller is strict mode JS code, it'll throw.
+ return result.failReadOnly();
+ }
+
+ // Do the rest in the Realm of "proxy", since we're in the same-origin case.
+ JSAutoRealm ar(cx, proxy);
+ JS::Rooted<JS::Value> wrappedArg(cx, v);
+ if (!MaybeWrapValue(cx, &wrappedArg)) {
+ return false;
+ }
+ JS::Rooted<JS::Value> wrappedReceiver(cx, receiver);
+ if (!MaybeWrapValue(cx, &wrappedReceiver)) {
+ return false;
+ }
+
+ JS_MarkCrossZoneId(cx, id);
+
+ return js::Wrapper::set(cx, proxy, id, wrappedArg, wrappedReceiver, result);
+}
+
+bool nsOuterWindowProxy::getOwnEnumerablePropertyKeys(
+ JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::MutableHandleVector<jsid> props) const {
+ // We could just stop overring getOwnEnumerablePropertyKeys and let our
+ // superclasses deal (by falling back on the BaseProxyHandler implementation
+ // that uses a combination of ownPropertyKeys and getOwnPropertyDescriptor to
+ // only return the enumerable ones. But maybe there's value in having
+ // somewhat faster for-in iteration on Window objects...
+
+ // Like ownPropertyKeys, our indexed stuff followed by our "normal" enumerable
+ // own property names.
+ if (!AppendIndexedPropertyNames(proxy, props)) {
+ return false;
+ }
+
+ if (!IsPlatformObjectSameOrigin(cx, proxy)) {
+ // All the cross-origin properties other than the indexed props are
+ // non-enumerable, so we're done here.
+ return true;
+ }
+
+ // When forwarding to js::Wrapper, we should just enter the Realm of proxy
+ // for now. That's what js::Wrapper expects, and since we're same-origin
+ // anyway this is not changing any security behavior.
+ JS::RootedVector<jsid> innerProps(cx);
+ { // Scope for JSAutoRealm so we can mark the ids once we exit it.
+ JSAutoRealm ar(cx, proxy);
+ if (!js::Wrapper::getOwnEnumerablePropertyKeys(cx, proxy, &innerProps)) {
+ return false;
+ }
+ }
+
+ for (auto& id : innerProps) {
+ JS_MarkCrossZoneId(cx, id);
+ }
+
+ return js::AppendUnique(cx, props, innerProps);
+}
+
+bool nsOuterWindowProxy::GetSubframeWindow(JSContext* cx,
+ JS::Handle<JSObject*> proxy,
+ JS::Handle<jsid> id,
+ JS::MutableHandle<JS::Value> vp,
+ bool& found) const {
+ Nullable<WindowProxyHolder> frame = GetSubframeWindow(cx, proxy, id);
+ if (frame.IsNull()) {
+ found = false;
+ return true;
+ }
+
+ found = true;
+ return WrapObject(cx, frame.Value(), vp);
+}
+
+Nullable<WindowProxyHolder> nsOuterWindowProxy::GetSubframeWindow(
+ JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id) const {
+ uint32_t index = GetArrayIndexFromId(id);
+ if (!IsArrayIndex(index)) {
+ return nullptr;
+ }
+
+ nsGlobalWindowOuter* win = GetOuterWindow(proxy);
+ return win->IndexedGetterOuter(index);
+}
+
+bool nsOuterWindowProxy::AppendIndexedPropertyNames(
+ JSObject* proxy, JS::MutableHandleVector<jsid> props) const {
+ uint32_t length = GetOuterWindow(proxy)->Length();
+ MOZ_ASSERT(int32_t(length) >= 0);
+ if (!props.reserve(props.length() + length)) {
+ return false;
+ }
+ for (int32_t i = 0; i < int32_t(length); ++i) {
+ if (!props.append(JS::PropertyKey::Int(i))) {
+ return false;
+ }
+ }
+
+ return true;
+}
+
+bool nsOuterWindowProxy::EnsureHolder(
+ JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::MutableHandle<JSObject*> holder) const {
+ return EnsureHolder(cx, proxy, HOLDER_WEAKMAP_SLOT,
+ Window_Binding::sCrossOriginProperties, holder);
+}
+
+size_t nsOuterWindowProxy::objectMoved(JSObject* obj, JSObject* old) const {
+ nsGlobalWindowOuter* outerWindow = GetOuterWindow(obj);
+ if (outerWindow) {
+ outerWindow->UpdateWrapper(obj, old);
+ BrowsingContext* bc = outerWindow->GetBrowsingContext();
+ if (bc) {
+ bc->UpdateWindowProxy(obj, old);
+ }
+ }
+ return 0;
+}
+
+enum { PDFJS_SLOT_CALLEE = 0 };
+
+// static
+bool nsOuterWindowProxy::MaybeGetPDFJSPrintMethod(
+ JSContext* cx, JS::Handle<JSObject*> proxy,
+ JS::MutableHandle<Maybe<JS::PropertyDescriptor>> desc) {
+ MOZ_ASSERT(proxy);
+ MOZ_ASSERT(!desc.isSome());
+
+ nsGlobalWindowOuter* outer = GetOuterWindow(proxy);
+ nsGlobalWindowInner* inner =
+ nsGlobalWindowInner::Cast(outer->GetCurrentInnerWindow());
+ if (!inner) {
+ // No print method to expose.
+ return true;
+ }
+
+ nsCOMPtr<nsIPrincipal> targetPrincipal = GetNoPDFJSPrincipal(inner);
+ if (!targetPrincipal) {
+ // Nothing special to be done.
+ return true;
+ }
+
+ if (!nsContentUtils::SubjectPrincipal(cx)->Equals(targetPrincipal)) {
+ // Not our origin's PDF document.
+ return true;
+ }
+
+ // Get the function we plan to actually call.
+ JS::Rooted<JSObject*> innerObj(cx, inner->GetGlobalJSObject());
+ if (!innerObj) {
+ // Really should not happen, but ok, let's just return.
+ return true;
+ }
+
+ JS::Rooted<JS::Value> targetFunc(cx);
+ {
+ JSAutoRealm ar(cx, innerObj);
+ if (!JS_GetProperty(cx, innerObj, "print", &targetFunc)) {
+ return false;
+ }
+ }
+
+ if (!targetFunc.isObject()) {
+ // Who knows what's going on. Just return.
+ return true;
+ }
+
+ // The Realm of cx is the realm our caller is in and the realm we
+ // should create our function in. Note that we can't use the
+ // standard XPConnect function forwarder machinery because our
+ // "this" is cross-origin, so we have to do thus by hand.
+
+ // Make sure targetFunc is wrapped into the right compartment.
+ if (!MaybeWrapValue(cx, &targetFunc)) {
+ return false;
+ }
+
+ JSFunction* fun =
+ js::NewFunctionWithReserved(cx, PDFJSPrintMethod, 0, 0, "print");
+ if (!fun) {
+ return false;
+ }
+
+ JS::Rooted<JSObject*> funObj(cx, JS_GetFunctionObject(fun));
+ js::SetFunctionNativeReserved(funObj, PDFJS_SLOT_CALLEE, targetFunc);
+
+ // { value: <print>, writable: true, enumerable: true, configurable: true }
+ // because that's what it would have been in the same-origin case without
+ // the PDF viewer messing with things.
+ desc.set(Some(JS::PropertyDescriptor::Data(
+ JS::ObjectValue(*funObj),
+ {JS::PropertyAttribute::Configurable, JS::PropertyAttribute::Enumerable,
+ JS::PropertyAttribute::Writable})));
+ return true;
+}
+
+// static
+bool nsOuterWindowProxy::PDFJSPrintMethod(JSContext* cx, unsigned argc,
+ JS::Value* vp) {
+ JS::CallArgs args = CallArgsFromVp(argc, vp);
+
+ JS::Rooted<JSObject*> realCallee(
+ cx, &js::GetFunctionNativeReserved(&args.callee(), PDFJS_SLOT_CALLEE)
+ .toObject());
+ // Unchecked unwrap, because we want to extract the thing we really had
+ // before.
+ realCallee = js::UncheckedUnwrap(realCallee);
+
+ JS::Rooted<JS::Value> thisv(cx, args.thisv());
+ if (thisv.isNullOrUndefined()) {
+ // Replace it with the global of our stashed callee, simulating the
+ // global-assuming behavior of DOM methods.
+ JS::Rooted<JSObject*> global(cx, JS::GetNonCCWObjectGlobal(realCallee));
+ if (!MaybeWrapObject(cx, &global)) {
+ return false;
+ }
+ thisv.setObject(*global);
+ } else if (!thisv.isObject()) {
+ return ThrowInvalidThis(cx, args, false, prototypes::id::Window);
+ }
+
+ // We want to do an UncheckedUnwrap here, because we're going to directly
+ // examine the principal of the inner window, if we have an inner window.
+ JS::Rooted<JSObject*> unwrappedObj(cx,
+ js::UncheckedUnwrap(&thisv.toObject()));
+ nsGlobalWindowInner* inner = nullptr;
+ {
+ // Do the unwrap in the Realm of the object we're looking at.
+ JSAutoRealm ar(cx, unwrappedObj);
+ UNWRAP_MAYBE_CROSS_ORIGIN_OBJECT(Window, &unwrappedObj, inner, cx);
+ }
+ if (!inner) {
+ return ThrowInvalidThis(cx, args, false, prototypes::id::Window);
+ }
+
+ nsIPrincipal* callerPrincipal = nsContentUtils::SubjectPrincipal(cx);
+ if (!callerPrincipal->SubsumesConsideringDomain(inner->GetPrincipal())) {
+ // Check whether it's a PDF viewer from our origin.
+ nsCOMPtr<nsIPrincipal> pdfPrincipal = GetNoPDFJSPrincipal(inner);
+ if (!pdfPrincipal || !callerPrincipal->Equals(pdfPrincipal)) {
+ // Security error.
+ return ThrowInvalidThis(cx, args, true, prototypes::id::Window);
+ }
+ }
+
+ // Go ahead and enter the Realm of our real callee to call it. We'll pass it
+ // our "thisv", just in case someone grabs a "print" method off one PDF
+ // document and .call()s it on another one.
+ {
+ JSAutoRealm ar(cx, realCallee);
+ if (!MaybeWrapValue(cx, &thisv)) {
+ return false;
+ }
+
+ // Don't bother passing through the args; they will get ignored anyway.
+
+ if (!JS::Call(cx, thisv, realCallee, JS::HandleValueArray::empty(),
+ args.rval())) {
+ return false;
+ }
+ }
+
+ // Wrap the return value (not that there should be any!) into the right
+ // compartment.
+ return MaybeWrapValue(cx, args.rval());
+}
+
+// static
+already_AddRefed<nsIPrincipal> nsOuterWindowProxy::GetNoPDFJSPrincipal(
+ nsGlobalWindowInner* inner) {
+ if (!nsContentUtils::IsPDFJS(inner->GetPrincipal())) {
+ return nullptr;
+ }
+
+ if (Document* doc = inner->GetExtantDoc()) {
+ if (nsCOMPtr<nsIPropertyBag2> propBag =
+ do_QueryInterface(doc->GetChannel())) {
+ nsCOMPtr<nsIPrincipal> principal(
+ do_GetProperty(propBag, u"noPDFJSPrincipal"_ns));
+ return principal.forget();
+ }
+ }
+ return nullptr;
+}
+
+const nsOuterWindowProxy nsOuterWindowProxy::singleton;
+
+class nsChromeOuterWindowProxy : public nsOuterWindowProxy {
+ public:
+ constexpr nsChromeOuterWindowProxy() : nsOuterWindowProxy() {}
+
+ const char* className(JSContext* cx,
+ JS::Handle<JSObject*> wrapper) const override;
+
+ static const nsChromeOuterWindowProxy singleton;
+};
+
+const char* nsChromeOuterWindowProxy::className(
+ JSContext* cx, JS::Handle<JSObject*> proxy) const {
+ MOZ_ASSERT(js::IsProxy(proxy));
+
+ return "ChromeWindow";
+}
+
+const nsChromeOuterWindowProxy nsChromeOuterWindowProxy::singleton;
+
+static JSObject* NewOuterWindowProxy(JSContext* cx,
+ JS::Handle<JSObject*> global,
+ bool isChrome) {
+ MOZ_ASSERT(JS_IsGlobalObject(global));
+
+ JSAutoRealm ar(cx, global);
+
+ js::WrapperOptions options;
+ options.setClass(&OuterWindowProxyClass);
+ JSObject* obj =
+ js::Wrapper::New(cx, global,
+ isChrome ? &nsChromeOuterWindowProxy::singleton
+ : &nsOuterWindowProxy::singleton,
+ options);
+ MOZ_ASSERT_IF(obj, js::IsWindowProxy(obj));
+ return obj;
+}
+
+//*****************************************************************************
+//*** nsGlobalWindowOuter: Object Management
+//*****************************************************************************
+
+nsGlobalWindowOuter::nsGlobalWindowOuter(uint64_t aWindowID)
+ : nsPIDOMWindowOuter(aWindowID),
+ mFullscreenHasChangedDuringProcessing(false),
+ mForceFullScreenInWidget(false),
+ mIsClosed(false),
+ mInClose(false),
+ mHavePendingClose(false),
+ mBlockScriptedClosingFlag(false),
+ mWasOffline(false),
+ mCreatingInnerWindow(false),
+ mIsChrome(false),
+ mAllowScriptsToClose(false),
+ mTopLevelOuterContentWindow(false),
+ mDelayedPrintUntilAfterLoad(false),
+ mDelayedCloseForPrinting(false),
+ mShouldDelayPrintUntilAfterLoad(false),
+#ifdef DEBUG
+ mSerial(0),
+ mSetOpenerWindowCalled(false),
+#endif
+ mCleanedUp(false),
+ mCanSkipCCGeneration(0),
+ mAutoActivateVRDisplayID(0) {
+ AssertIsOnMainThread();
+
+ nsLayoutStatics::AddRef();
+
+ // Initialize the PRCList (this).
+ PR_INIT_CLIST(this);
+
+ // |this| is an outer window. Outer windows start out frozen and
+ // remain frozen until they get an inner window.
+ MOZ_ASSERT(IsFrozen());
+
+ // We could have failed the first time through trying
+ // to create the entropy collector, so we should
+ // try to get one until we succeed.
+
+#ifdef DEBUG
+ mSerial = nsContentUtils::InnerOrOuterWindowCreated();
+
+ MOZ_LOG(gDocShellAndDOMWindowLeakLogging, LogLevel::Info,
+ ("++DOMWINDOW == %d (%p) [pid = %d] [serial = %d] [outer = %p]\n",
+ nsContentUtils::GetCurrentInnerOrOuterWindowCount(),
+ static_cast<void*>(ToCanonicalSupports(this)), getpid(), mSerial,
+ nullptr));
+#endif
+
+ MOZ_LOG(gDOMLeakPRLogOuter, LogLevel::Debug,
+ ("DOMWINDOW %p created outer=nullptr", this));
+
+ // Add ourselves to the outer windows list.
+ MOZ_ASSERT(sOuterWindowsById, "Outer Windows hash table must be created!");
+
+ // |this| is an outer window, add to the outer windows list.
+ MOZ_ASSERT(!sOuterWindowsById->Contains(mWindowID),
+ "This window shouldn't be in the hash table yet!");
+ // We seem to see crashes in release builds because of null
+ // |sOuterWindowsById|.
+ if (sOuterWindowsById) {
+ sOuterWindowsById->InsertOrUpdate(mWindowID, this);
+ }
+}
+
+#ifdef DEBUG
+
+/* static */
+void nsGlobalWindowOuter::AssertIsOnMainThread() {
+ MOZ_ASSERT(NS_IsMainThread());
+}
+
+#endif // DEBUG
+
+/* static */
+void nsGlobalWindowOuter::Init() {
+ AssertIsOnMainThread();
+
+ NS_ASSERTION(gDOMLeakPRLogOuter,
+ "gDOMLeakPRLogOuter should have been initialized!");
+
+ sOuterWindowsById = new OuterWindowByIdTable();
+}
+
+nsGlobalWindowOuter::~nsGlobalWindowOuter() {
+ AssertIsOnMainThread();
+
+ if (sOuterWindowsById) {
+ sOuterWindowsById->Remove(mWindowID);
+ }
+
+ nsContentUtils::InnerOrOuterWindowDestroyed();
+
+#ifdef DEBUG
+ if (MOZ_LOG_TEST(gDocShellAndDOMWindowLeakLogging, LogLevel::Info)) {
+ nsAutoCString url;
+ if (mLastOpenedURI) {
+ url = mLastOpenedURI->GetSpecOrDefault();
+
+ // Data URLs can be very long, so truncate to avoid flooding the log.
+ const uint32_t maxURLLength = 1000;
+ if (url.Length() > maxURLLength) {
+ url.Truncate(maxURLLength);
+ }
+ }
+
+ MOZ_LOG(
+ gDocShellAndDOMWindowLeakLogging, LogLevel::Info,
+ ("--DOMWINDOW == %d (%p) [pid = %d] [serial = %d] [outer = %p] [url = "
+ "%s]\n",
+ nsContentUtils::GetCurrentInnerOrOuterWindowCount(),
+ static_cast<void*>(ToCanonicalSupports(this)), getpid(), mSerial,
+ nullptr, url.get()));
+ }
+#endif
+
+ MOZ_LOG(gDOMLeakPRLogOuter, LogLevel::Debug,
+ ("DOMWINDOW %p destroyed", this));
+
+ JSObject* proxy = GetWrapperMaybeDead();
+ if (proxy) {
+ if (mBrowsingContext && mBrowsingContext->GetUnbarrieredWindowProxy()) {
+ nsGlobalWindowOuter* outer = nsOuterWindowProxy::GetOuterWindow(
+ mBrowsingContext->GetUnbarrieredWindowProxy());
+ // Check that the current WindowProxy object corresponds to this
+ // nsGlobalWindowOuter, because we don't want to clear the WindowProxy if
+ // we've replaced it with a cross-process WindowProxy.
+ if (outer == this) {
+ mBrowsingContext->ClearWindowProxy();
+ }
+ }
+ js::SetProxyReservedSlot(proxy, OUTER_WINDOW_SLOT,
+ JS::PrivateValue(nullptr));
+ }
+
+ // An outer window is destroyed with inner windows still possibly
+ // alive, iterate through the inner windows and null out their
+ // back pointer to this outer, and pull them out of the list of
+ // inner windows.
+ //
+ // Our linked list of inner windows both contains (an nsGlobalWindowOuter),
+ // and our inner windows (nsGlobalWindowInners). This means that we need to
+ // use PRCList*. We can then compare that PRCList* to `this` to see if its an
+ // inner or outer window.
+ PRCList* w;
+ while ((w = PR_LIST_HEAD(this)) != this) {
+ PR_REMOVE_AND_INIT_LINK(w);
+ }
+
+ DropOuterWindowDocs();
+
+ // Outer windows are always supposed to call CleanUp before letting themselves
+ // be destroyed.
+ MOZ_ASSERT(mCleanedUp);
+
+ nsCOMPtr<nsIDeviceSensors> ac = do_GetService(NS_DEVICE_SENSORS_CONTRACTID);
+ if (ac) ac->RemoveWindowAsListener(this);
+
+ nsLayoutStatics::Release();
+}
+
+// static
+void nsGlobalWindowOuter::ShutDown() {
+ AssertIsOnMainThread();
+
+ delete sOuterWindowsById;
+ sOuterWindowsById = nullptr;
+}
+
+void nsGlobalWindowOuter::DropOuterWindowDocs() {
+ MOZ_ASSERT_IF(mDoc, !mDoc->EventHandlingSuppressed());
+ mDoc = nullptr;
+ mSuspendedDocs.Clear();
+}
+
+void nsGlobalWindowOuter::CleanUp() {
+ // Guarantee idempotence.
+ if (mCleanedUp) return;
+ mCleanedUp = true;
+
+ StartDying();
+
+ mWindowUtils = nullptr;
+
+ ClearControllers();
+
+ mContext = nullptr; // Forces Release
+ mChromeEventHandler = nullptr; // Forces Release
+ mParentTarget = nullptr;
+ mMessageManager = nullptr;
+
+ mArguments = nullptr;
+}
+
+void nsGlobalWindowOuter::ClearControllers() {
+ if (mControllers) {
+ uint32_t count;
+ mControllers->GetControllerCount(&count);
+
+ while (count--) {
+ nsCOMPtr<nsIController> controller;
+ mControllers->GetControllerAt(count, getter_AddRefs(controller));
+
+ nsCOMPtr<nsIControllerContext> context = do_QueryInterface(controller);
+ if (context) context->SetCommandContext(nullptr);
+ }
+
+ mControllers = nullptr;
+ }
+}
+
+//*****************************************************************************
+// nsGlobalWindowOuter::nsISupports
+//*****************************************************************************
+
+// QueryInterface implementation for nsGlobalWindowOuter
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsGlobalWindowOuter)
+ NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+ NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, EventTarget)
+ NS_INTERFACE_MAP_ENTRY(nsIDOMWindow)
+ NS_INTERFACE_MAP_ENTRY(nsIGlobalObject)
+ NS_INTERFACE_MAP_ENTRY(nsIScriptGlobalObject)
+ NS_INTERFACE_MAP_ENTRY(nsIScriptObjectPrincipal)
+ NS_INTERFACE_MAP_ENTRY(mozilla::dom::EventTarget)
+ NS_INTERFACE_MAP_ENTRY(nsPIDOMWindowOuter)
+ NS_INTERFACE_MAP_ENTRY(mozIDOMWindowProxy)
+ NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIDOMChromeWindow, IsChromeWindow())
+ NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
+ NS_INTERFACE_MAP_ENTRY(nsIInterfaceRequestor)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsGlobalWindowOuter)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsGlobalWindowOuter)
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsGlobalWindowOuter)
+ if (tmp->IsBlackForCC(false)) {
+ if (nsCCUncollectableMarker::InGeneration(tmp->mCanSkipCCGeneration)) {
+ return true;
+ }
+ tmp->mCanSkipCCGeneration = nsCCUncollectableMarker::sGeneration;
+ if (EventListenerManager* elm = tmp->GetExistingListenerManager()) {
+ elm->MarkForCC();
+ }
+ return true;
+ }
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_BEGIN(nsGlobalWindowOuter)
+ return tmp->IsBlackForCC(true);
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_END
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_BEGIN(nsGlobalWindowOuter)
+ return tmp->IsBlackForCC(false);
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_END
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(nsGlobalWindowOuter)
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsGlobalWindowOuter)
+ if (MOZ_UNLIKELY(cb.WantDebugInfo())) {
+ char name[512];
+ nsAutoCString uri;
+ if (tmp->mDoc && tmp->mDoc->GetDocumentURI()) {
+ uri = tmp->mDoc->GetDocumentURI()->GetSpecOrDefault();
+ }
+ SprintfLiteral(name, "nsGlobalWindowOuter # %" PRIu64 " outer %s",
+ tmp->mWindowID, uri.get());
+ cb.DescribeRefCountedNode(tmp->mRefCnt.get(), name);
+ } else {
+ NS_IMPL_CYCLE_COLLECTION_DESCRIBE(nsGlobalWindowOuter, tmp->mRefCnt.get())
+ }
+
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mContext)
+
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mControllers)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mArguments)
+
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mLocalStorage)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSuspendedDocs)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocumentPrincipal)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocumentCookiePrincipal)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocumentStoragePrincipal)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocumentPartitionedPrincipal)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDoc)
+
+ // Traverse stuff from nsPIDOMWindow
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChromeEventHandler)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mParentTarget)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mMessageManager)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFrameElement)
+
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocShell)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mBrowsingContext)
+
+ tmp->TraverseObjectsInGlobal(cb);
+
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChromeFields.mBrowserDOMWindow)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGlobalWindowOuter)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK_WEAK_REFERENCE
+ if (sOuterWindowsById) {
+ sOuterWindowsById->Remove(tmp->mWindowID);
+ }
+
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mContext)
+
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mControllers)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mArguments)
+
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mLocalStorage)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mSuspendedDocs)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocumentPrincipal)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocumentCookiePrincipal)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocumentStoragePrincipal)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocumentPartitionedPrincipal)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mDoc)
+
+ // Unlink stuff from nsPIDOMWindow
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mChromeEventHandler)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mParentTarget)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mMessageManager)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mFrameElement)
+
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocShell)
+ if (tmp->mBrowsingContext) {
+ if (tmp->mBrowsingContext->GetUnbarrieredWindowProxy()) {
+ nsGlobalWindowOuter* outer = nsOuterWindowProxy::GetOuterWindow(
+ tmp->mBrowsingContext->GetUnbarrieredWindowProxy());
+ // Check that the current WindowProxy object corresponds to this
+ // nsGlobalWindowOuter, because we don't want to clear the WindowProxy if
+ // we've replaced it with a cross-process WindowProxy.
+ if (outer == tmp) {
+ tmp->mBrowsingContext->ClearWindowProxy();
+ }
+ }
+ tmp->mBrowsingContext = nullptr;
+ }
+
+ tmp->UnlinkObjectsInGlobal();
+
+ if (tmp->IsChromeWindow()) {
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mChromeFields.mBrowserDOMWindow)
+ }
+
+ NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsGlobalWindowOuter)
+ NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+bool nsGlobalWindowOuter::IsBlackForCC(bool aTracingNeeded) {
+ if (!nsCCUncollectableMarker::sGeneration) {
+ return false;
+ }
+
+ // Unlike most wrappers, the outer window wrapper is not a wrapper for
+ // the outer window. Instead, the outer window wrapper holds the inner
+ // window binding object, which in turn holds the nsGlobalWindowInner, which
+ // has a strong reference to the nsGlobalWindowOuter. We're using the
+ // mInnerWindow pointer as a flag for that whole chain.
+ return (nsCCUncollectableMarker::InGeneration(GetMarkedCCGeneration()) ||
+ (mInnerWindow && HasKnownLiveWrapper())) &&
+ (!aTracingNeeded || HasNothingToTrace(ToSupports(this)));
+}
+
+//*****************************************************************************
+// nsGlobalWindowOuter::nsIScriptGlobalObject
+//*****************************************************************************
+
+bool nsGlobalWindowOuter::ShouldResistFingerprinting(RFPTarget aTarget) const {
+ if (mDoc) {
+ return mDoc->ShouldResistFingerprinting(aTarget);
+ }
+ return nsContentUtils::ShouldResistFingerprinting(
+ "If we do not have a document then we do not have any context"
+ "to make an informed RFP choice, so we fall back to the global pref",
+ aTarget);
+}
+
+OriginTrials nsGlobalWindowOuter::Trials() const {
+ return mInnerWindow ? nsGlobalWindowInner::Cast(mInnerWindow)->Trials()
+ : OriginTrials();
+}
+
+FontFaceSet* nsGlobalWindowOuter::GetFonts() {
+ if (mDoc) {
+ return mDoc->Fonts();
+ }
+ return nullptr;
+}
+
+nsresult nsGlobalWindowOuter::EnsureScriptEnvironment() {
+ if (GetWrapperPreserveColor()) {
+ return NS_OK;
+ }
+
+ NS_ENSURE_STATE(!mCleanedUp);
+
+ NS_ASSERTION(!GetCurrentInnerWindowInternal(),
+ "No cached wrapper, but we have an inner window?");
+ NS_ASSERTION(!mContext, "Will overwrite mContext!");
+
+ // If this window is an [i]frame, don't bother GC'ing when the frame's context
+ // is destroyed since a GC will happen when the frameset or host document is
+ // destroyed anyway.
+ mContext = new nsJSContext(mBrowsingContext->IsTop(), this);
+ return NS_OK;
+}
+
+nsIScriptContext* nsGlobalWindowOuter::GetScriptContext() { return mContext; }
+
+bool nsGlobalWindowOuter::WouldReuseInnerWindow(Document* aNewDocument) {
+ // We reuse the inner window when:
+ // a. We are currently at our original document.
+ // b. At least one of the following conditions are true:
+ // -- The new document is the same as the old document. This means that we're
+ // getting called from document.open().
+ // -- The new document has the same origin as what we have loaded right now.
+
+ if (!mDoc || !aNewDocument) {
+ return false;
+ }
+
+ if (!mDoc->IsInitialDocument()) {
+ return false;
+ }
+
+#ifdef DEBUG
+ {
+ nsCOMPtr<nsIURI> uri;
+ NS_GetURIWithoutRef(mDoc->GetDocumentURI(), getter_AddRefs(uri));
+ NS_ASSERTION(NS_IsAboutBlank(uri), "How'd this happen?");
+ }
+#endif
+
+ // Great, we're the original document, check for one of the other
+ // conditions.
+
+ if (mDoc == aNewDocument) {
+ return true;
+ }
+
+ if (aNewDocument->IsStaticDocument()) {
+ return false;
+ }
+
+ if (BasePrincipal::Cast(mDoc->NodePrincipal())
+ ->FastEqualsConsideringDomain(aNewDocument->NodePrincipal())) {
+ // The origin is the same.
+ return true;
+ }
+
+ return false;
+}
+
+void nsGlobalWindowOuter::SetInitialPrincipal(
+ nsIPrincipal* aNewWindowPrincipal, nsIContentSecurityPolicy* aCSP,
+ const Maybe<nsILoadInfo::CrossOriginEmbedderPolicy>& aCOEP) {
+ // We should never create windows with an expanded principal.
+ // If we have a system principal, make sure we're not using it for a content
+ // docshell.
+ // NOTE: Please keep this logic in sync with
+ // nsAppShellService::JustCreateTopWindow
+ if (nsContentUtils::IsExpandedPrincipal(aNewWindowPrincipal) ||
+ (aNewWindowPrincipal->IsSystemPrincipal() &&
+ GetBrowsingContext()->IsContent())) {
+ aNewWindowPrincipal = nullptr;
+ }
+
+ // If there's an existing document, bail if it either:
+ if (mDoc) {
+ // (a) is not an initial about:blank document, or
+ if (!mDoc->IsInitialDocument()) return;
+ // (b) already has the correct principal.
+ if (mDoc->NodePrincipal() == aNewWindowPrincipal) return;
+
+#ifdef DEBUG
+ // If we have a document loaded at this point, it had better be about:blank.
+ // Otherwise, something is really weird. An about:blank page has a
+ // NullPrincipal.
+ bool isNullPrincipal;
+ MOZ_ASSERT(NS_SUCCEEDED(mDoc->NodePrincipal()->GetIsNullPrincipal(
+ &isNullPrincipal)) &&
+ isNullPrincipal);
+#endif
+ }
+
+ // Use the subject (or system) principal as the storage principal too until
+ // the new window finishes navigating and gets a real storage principal.
+ nsDocShell::Cast(GetDocShell())
+ ->CreateAboutBlankContentViewer(aNewWindowPrincipal, aNewWindowPrincipal,
+ aCSP, nullptr,
+ /* aIsInitialDocument */ true, aCOEP);
+
+ if (mDoc) {
+ MOZ_ASSERT(mDoc->IsInitialDocument(),
+ "document should be initial document");
+ }
+
+ RefPtr<PresShell> presShell = GetDocShell()->GetPresShell();
+ if (presShell && !presShell->DidInitialize()) {
+ // Ensure that if someone plays with this document they will get
+ // layout happening.
+ presShell->Initialize();
+ }
+}
+
+#define WINDOWSTATEHOLDER_IID \
+ { \
+ 0x0b917c3e, 0xbd50, 0x4683, { \
+ 0xaf, 0xc9, 0xc7, 0x81, 0x07, 0xae, 0x33, 0x26 \
+ } \
+ }
+
+class WindowStateHolder final : public nsISupports {
+ public:
+ NS_DECLARE_STATIC_IID_ACCESSOR(WINDOWSTATEHOLDER_IID)
+ NS_DECL_ISUPPORTS
+
+ explicit WindowStateHolder(nsGlobalWindowInner* aWindow);
+
+ nsGlobalWindowInner* GetInnerWindow() { return mInnerWindow; }
+
+ void DidRestoreWindow() {
+ mInnerWindow = nullptr;
+ mInnerWindowReflector = nullptr;
+ }
+
+ protected:
+ ~WindowStateHolder();
+
+ nsGlobalWindowInner* mInnerWindow;
+ // We hold onto this to make sure the inner window doesn't go away. The outer
+ // window ends up recalculating it anyway.
+ JS::PersistentRooted<JSObject*> mInnerWindowReflector;
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(WindowStateHolder, WINDOWSTATEHOLDER_IID)
+
+WindowStateHolder::WindowStateHolder(nsGlobalWindowInner* aWindow)
+ : mInnerWindow(aWindow),
+ mInnerWindowReflector(RootingCx(), aWindow->GetWrapper()) {
+ MOZ_ASSERT(aWindow, "null window");
+
+ aWindow->Suspend();
+
+ // When a global goes into the bfcache, we disable script.
+ xpc::Scriptability::Get(mInnerWindowReflector).SetWindowAllowsScript(false);
+}
+
+WindowStateHolder::~WindowStateHolder() {
+ if (mInnerWindow) {
+ // This window was left in the bfcache and is now going away. We need to
+ // free it up.
+ // Note that FreeInnerObjects may already have been called on the
+ // inner window if its outer has already had SetDocShell(null)
+ // called.
+ mInnerWindow->FreeInnerObjects();
+ }
+}
+
+NS_IMPL_ISUPPORTS(WindowStateHolder, WindowStateHolder)
+
+bool nsGlobalWindowOuter::ComputeIsSecureContext(Document* aDocument,
+ SecureContextFlags aFlags) {
+ nsCOMPtr<nsIPrincipal> principal = aDocument->NodePrincipal();
+ if (principal->IsSystemPrincipal()) {
+ return true;
+ }
+
+ // Implement https://w3c.github.io/webappsec-secure-contexts/#settings-object
+ // With some modifications to allow for aFlags.
+
+ bool hadNonSecureContextCreator = false;
+
+ if (WindowContext* parentWindow =
+ GetBrowsingContext()->GetParentWindowContext()) {
+ hadNonSecureContextCreator = !parentWindow->GetIsSecureContext();
+ }
+
+ if (hadNonSecureContextCreator) {
+ return false;
+ }
+
+ if (nsContentUtils::HttpsStateIsModern(aDocument)) {
+ return true;
+ }
+
+ if (principal->GetIsNullPrincipal()) {
+ // If the NullPrincipal has a valid precursor URI we want to use it to
+ // construct the principal otherwise we fall back to the original document
+ // URI.
+ nsCOMPtr<nsIPrincipal> precursorPrin = principal->GetPrecursorPrincipal();
+ nsCOMPtr<nsIURI> uri = precursorPrin ? precursorPrin->GetURI() : nullptr;
+ if (!uri) {
+ uri = aDocument->GetOriginalURI();
+ }
+ // IsOriginPotentiallyTrustworthy doesn't care about origin attributes so
+ // it doesn't actually matter what we use here, but reusing the document
+ // principal's attributes is convenient.
+ const OriginAttributes& attrs = principal->OriginAttributesRef();
+ // CreateContentPrincipal correctly gets a useful principal for blob: and
+ // other URI_INHERITS_SECURITY_CONTEXT URIs.
+ principal = BasePrincipal::CreateContentPrincipal(uri, attrs);
+ if (NS_WARN_IF(!principal)) {
+ return false;
+ }
+ }
+
+ return principal->GetIsOriginPotentiallyTrustworthy();
+}
+
+static bool InitializeLegacyNetscapeObject(JSContext* aCx,
+ JS::Handle<JSObject*> aGlobal) {
+ JSAutoRealm ar(aCx, aGlobal);
+
+ // Note: MathJax depends on window.netscape being exposed. See bug 791526.
+ JS::Rooted<JSObject*> obj(aCx);
+ obj = JS_DefineObject(aCx, aGlobal, "netscape", nullptr);
+ NS_ENSURE_TRUE(obj, false);
+
+ obj = JS_DefineObject(aCx, obj, "security", nullptr);
+ NS_ENSURE_TRUE(obj, false);
+
+ return true;
+}
+
+struct MOZ_STACK_CLASS CompartmentFinderState {
+ explicit CompartmentFinderState(nsIPrincipal* aPrincipal)
+ : principal(aPrincipal), compartment(nullptr) {}
+
+ // Input: we look for a compartment which is same-origin with the
+ // given principal.
+ nsIPrincipal* principal;
+
+ // Output: We set this member if we find a compartment.
+ JS::Compartment* compartment;
+};
+
+static JS::CompartmentIterResult FindSameOriginCompartment(
+ JSContext* aCx, void* aData, JS::Compartment* aCompartment) {
+ auto* data = static_cast<CompartmentFinderState*>(aData);
+ MOZ_ASSERT(!data->compartment, "Why are we getting called?");
+
+ // If this compartment is not safe to share across globals, don't do
+ // anything with it; in particular we should not be getting a
+ // CompartmentPrivate from such a compartment, because it may be in
+ // the middle of being collected and its CompartmentPrivate may no
+ // longer be valid.
+ if (!js::IsSharableCompartment(aCompartment)) {
+ return JS::CompartmentIterResult::KeepGoing;
+ }
+
+ auto* compartmentPrivate = xpc::CompartmentPrivate::Get(aCompartment);
+ if (!compartmentPrivate->CanShareCompartmentWith(data->principal)) {
+ // Can't reuse this one, keep going.
+ return JS::CompartmentIterResult::KeepGoing;
+ }
+
+ // We have a winner!
+ data->compartment = aCompartment;
+ return JS::CompartmentIterResult::Stop;
+}
+
+static JS::RealmCreationOptions& SelectZone(
+ JSContext* aCx, nsIPrincipal* aPrincipal, nsGlobalWindowInner* aNewInner,
+ JS::RealmCreationOptions& aOptions) {
+ // Use the shared system compartment for chrome windows.
+ if (aPrincipal->IsSystemPrincipal()) {
+ return aOptions.setExistingCompartment(xpc::PrivilegedJunkScope());
+ }
+
+ BrowsingContext* bc = aNewInner->GetBrowsingContext();
+ if (bc->IsTop()) {
+ // We're a toplevel load. Use a new zone. This way, when we do
+ // zone-based compartment sharing we won't share compartments
+ // across navigations.
+ return aOptions.setNewCompartmentAndZone();
+ }
+
+ // Find the in-process ancestor highest in the hierarchy.
+ nsGlobalWindowInner* ancestor = nullptr;
+ for (WindowContext* wc = bc->GetParentWindowContext(); wc;
+ wc = wc->GetParentWindowContext()) {
+ if (nsGlobalWindowInner* win = wc->GetInnerWindow()) {
+ ancestor = win;
+ }
+ }
+
+ // If we have an ancestor window, use its zone.
+ if (ancestor && ancestor->GetGlobalJSObject()) {
+ JS::Zone* zone = JS::GetObjectZone(ancestor->GetGlobalJSObject());
+ // Now try to find an existing compartment that's same-origin
+ // with our principal.
+ CompartmentFinderState data(aPrincipal);
+ JS_IterateCompartmentsInZone(aCx, zone, &data, FindSameOriginCompartment);
+ if (data.compartment) {
+ return aOptions.setExistingCompartment(data.compartment);
+ }
+ return aOptions.setNewCompartmentInExistingZone(
+ ancestor->GetGlobalJSObject());
+ }
+
+ return aOptions.setNewCompartmentAndZone();
+}
+
+/**
+ * Create a new global object that will be used for an inner window.
+ * Return the native global and an nsISupports 'holder' that can be used
+ * to manage the lifetime of it.
+ */
+static nsresult CreateNativeGlobalForInner(
+ JSContext* aCx, nsGlobalWindowInner* aNewInner, Document* aDocument,
+ JS::MutableHandle<JSObject*> aGlobal, bool aIsSecureContext,
+ bool aDefineSharedArrayBufferConstructor) {
+ MOZ_ASSERT(aCx);
+ MOZ_ASSERT(aNewInner);
+
+ nsCOMPtr<nsIURI> uri = aDocument->GetDocumentURI();
+ nsCOMPtr<nsIPrincipal> principal = aDocument->NodePrincipal();
+ MOZ_ASSERT(principal);
+
+ // DOMWindow with nsEP is not supported, we have to make sure
+ // no one creates one accidentally.
+ nsCOMPtr<nsIExpandedPrincipal> nsEP = do_QueryInterface(principal);
+ MOZ_RELEASE_ASSERT(!nsEP, "DOMWindow with nsEP is not supported");
+
+ JS::RealmOptions options;
+ JS::RealmCreationOptions& creationOptions = options.creationOptions();
+
+ SelectZone(aCx, principal, aNewInner, creationOptions);
+
+ creationOptions.setSecureContext(aIsSecureContext);
+
+ // Define the SharedArrayBuffer global constructor property only if shared
+ // memory may be used and structured-cloned (e.g. through postMessage).
+ //
+ // When the global constructor property isn't defined, the SharedArrayBuffer
+ // constructor can still be reached through Web Assembly. Omitting the global
+ // property just prevents feature-tests from being misled. See bug 1624266.
+ creationOptions.setDefineSharedArrayBufferConstructor(
+ aDefineSharedArrayBufferConstructor);
+
+ // TODO(bug 1834744) we will need some way of passing different targets to the
+ // JS engine
+ xpc::InitGlobalObjectOptions(options, principal->IsSystemPrincipal(),
+ aDocument->ShouldResistFingerprinting(
+ RFPTarget::IsAlwaysEnabledForPrecompute));
+
+ // Determine if we need the Components object.
+ bool needComponents = principal->IsSystemPrincipal();
+ uint32_t flags = needComponents ? 0 : xpc::OMIT_COMPONENTS_OBJECT;
+ flags |= xpc::DONT_FIRE_ONNEWGLOBALHOOK;
+
+ if (!Window_Binding::Wrap(aCx, aNewInner, aNewInner, options,
+ nsJSPrincipals::get(principal), false, aGlobal) ||
+ !xpc::InitGlobalObject(aCx, aGlobal, flags)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ MOZ_ASSERT(aNewInner->GetWrapperPreserveColor() == aGlobal);
+
+ // Set the location information for the new global, so that tools like
+ // about:memory may use that information
+ xpc::SetLocationForGlobal(aGlobal, uri);
+
+ if (!InitializeLegacyNetscapeObject(aCx, aGlobal)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ return NS_OK;
+}
+
+nsresult nsGlobalWindowOuter::SetNewDocument(Document* aDocument,
+ nsISupports* aState,
+ bool aForceReuseInnerWindow,
+ WindowGlobalChild* aActor) {
+ MOZ_ASSERT(mDocumentPrincipal == nullptr,
+ "mDocumentPrincipal prematurely set!");
+ MOZ_ASSERT(mDocumentCookiePrincipal == nullptr,
+ "mDocumentCookiePrincipal prematurely set!");
+ MOZ_ASSERT(mDocumentStoragePrincipal == nullptr,
+ "mDocumentStoragePrincipal prematurely set!");
+ MOZ_ASSERT(mDocumentPartitionedPrincipal == nullptr,
+ "mDocumentPartitionedPrincipal prematurely set!");
+ MOZ_ASSERT(aDocument);
+
+ // Bail out early if we're in process of closing down the window.
+ NS_ENSURE_STATE(!mCleanedUp);
+
+ NS_ASSERTION(!GetCurrentInnerWindow() ||
+ GetCurrentInnerWindow()->GetExtantDoc() == mDoc,
+ "Uh, mDoc doesn't match the current inner window "
+ "document!");
+ bool wouldReuseInnerWindow = WouldReuseInnerWindow(aDocument);
+ if (aForceReuseInnerWindow && !wouldReuseInnerWindow && mDoc &&
+ mDoc->NodePrincipal() != aDocument->NodePrincipal()) {
+ NS_ERROR("Attempted forced inner window reuse while changing principal");
+ return NS_ERROR_UNEXPECTED;
+ }
+
+ if (!mBrowsingContext->AncestorsAreCurrent()) {
+ return NS_ERROR_NOT_AVAILABLE;
+ }
+
+ RefPtr<Document> oldDoc = mDoc;
+ MOZ_RELEASE_ASSERT(oldDoc != aDocument);
+
+ AutoJSAPI jsapi;
+ jsapi.Init();
+ JSContext* cx = jsapi.cx();
+
+ // Check if we're anywhere near the stack limit before we reach the
+ // transplanting code, since it has no good way to handle errors. This uses
+ // the untrusted script limit, which is not strictly necessary since no
+ // actual script should run.
+ js::AutoCheckRecursionLimit recursion(cx);
+ if (!recursion.checkConservativeDontReport(cx)) {
+ NS_WARNING("Overrecursion in SetNewDocument");
+ return NS_ERROR_FAILURE;
+ }
+
+ if (!mDoc) {
+ // First document load.
+
+ // Get our private root. If it is equal to us, then we need to
+ // attach our global key bindings that handles browser scrolling
+ // and other browser commands.
+ nsPIDOMWindowOuter* privateRoot = GetPrivateRoot();
+
+ if (privateRoot == this) {
+ RootWindowGlobalKeyListener::AttachKeyHandler(mChromeEventHandler);
+ }
+ }
+
+ MaybeResetWindowName(aDocument);
+
+ /* No mDocShell means we're already been partially closed down. When that
+ happens, setting status isn't a big requirement, so don't. (Doesn't happen
+ under normal circumstances, but bug 49615 describes a case.) */
+
+ nsContentUtils::AddScriptRunner(
+ NewRunnableMethod("nsGlobalWindowOuter::ClearStatus", this,
+ &nsGlobalWindowOuter::ClearStatus));
+
+ // Sometimes, WouldReuseInnerWindow() returns true even if there's no inner
+ // window (see bug 776497). Be safe.
+ bool reUseInnerWindow = (aForceReuseInnerWindow || wouldReuseInnerWindow) &&
+ GetCurrentInnerWindowInternal();
+
+ nsresult rv;
+
+ // We set mDoc even though this is an outer window to avoid
+ // having to *always* reach into the inner window to find the
+ // document.
+ mDoc = aDocument;
+
+ nsDocShell::Cast(mDocShell)->MaybeRestoreWindowName();
+
+ // We drop the print request for the old document on the floor, it never made
+ // it. We don't close the window here either even if we were asked to.
+ mShouldDelayPrintUntilAfterLoad = true;
+ mDelayedCloseForPrinting = false;
+ mDelayedPrintUntilAfterLoad = false;
+
+ // Take this opportunity to clear mSuspendedDocs. Our old inner window is now
+ // responsible for unsuspending it.
+ mSuspendedDocs.Clear();
+
+#ifdef DEBUG
+ mLastOpenedURI = aDocument->GetDocumentURI();
+#endif
+
+ RefPtr<nsGlobalWindowInner> currentInner = GetCurrentInnerWindowInternal();
+
+ if (currentInner && currentInner->mNavigator) {
+ currentInner->mNavigator->OnNavigation();
+ }
+
+ RefPtr<nsGlobalWindowInner> newInnerWindow;
+ bool createdInnerWindow = false;
+
+ bool thisChrome = IsChromeWindow();
+
+ nsCOMPtr<WindowStateHolder> wsh = do_QueryInterface(aState);
+ NS_ASSERTION(!aState || wsh,
+ "What kind of weird state are you giving me here?");
+
+ bool doomCurrentInner = false;
+
+ // Only non-gray (i.e. exposed to JS) objects should be assigned to
+ // newInnerGlobal.
+ JS::Rooted<JSObject*> newInnerGlobal(cx);
+ if (reUseInnerWindow) {
+ // We're reusing the current inner window.
+ NS_ASSERTION(!currentInner->IsFrozen(),
+ "We should never be reusing a shared inner window");
+ newInnerWindow = currentInner;
+ newInnerGlobal = currentInner->GetWrapper();
+
+ // We're reusing the inner window, but this still counts as a navigation,
+ // so all expandos and such defined on the outer window should go away.
+ // Force all Xray wrappers to be recomputed.
+ JS::Rooted<JSObject*> rootedObject(cx, GetWrapper());
+ if (!JS_RefreshCrossCompartmentWrappers(cx, rootedObject)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // Inner windows are only reused for same-origin principals, but the
+ // principals don't necessarily match exactly. Update the principal on the
+ // realm to match the new document. NB: We don't just call
+ // currentInner->RefreshRealmPrincipals() here because we haven't yet set
+ // its mDoc to aDocument.
+ JS::Realm* realm = js::GetNonCCWObjectRealm(newInnerGlobal);
+#ifdef DEBUG
+ bool sameOrigin = false;
+ nsIPrincipal* existing = nsJSPrincipals::get(JS::GetRealmPrincipals(realm));
+ aDocument->NodePrincipal()->Equals(existing, &sameOrigin);
+ MOZ_ASSERT(sameOrigin);
+#endif
+ JS::SetRealmPrincipals(realm,
+ nsJSPrincipals::get(aDocument->NodePrincipal()));
+ } else {
+ if (aState) {
+ newInnerWindow = wsh->GetInnerWindow();
+ newInnerGlobal = newInnerWindow->GetWrapper();
+ } else {
+ newInnerWindow = nsGlobalWindowInner::Create(this, thisChrome, aActor);
+ if (StaticPrefs::dom_timeout_defer_during_load()) {
+ // ensure the initial loading state is known
+ newInnerWindow->SetActiveLoadingState(
+ aDocument->GetReadyStateEnum() ==
+ Document::ReadyState::READYSTATE_LOADING);
+ }
+
+ // The outer window is automatically treated as frozen when we
+ // null out the inner window. As a result, initializing classes
+ // on the new inner won't end up reaching into the old inner
+ // window for classes etc.
+ //
+ // [This happens with Object.prototype when XPConnect creates
+ // a temporary global while initializing classes; the reason
+ // being that xpconnect creates the temp global w/o a parent
+ // and proto, which makes the JS engine look up classes in
+ // cx->globalObject, i.e. this outer window].
+
+ mInnerWindow = nullptr;
+
+ mCreatingInnerWindow = true;
+
+ // The SharedArrayBuffer global constructor property should not be present
+ // in a fresh global object when shared memory objects aren't allowed
+ // (because COOP/COEP support isn't enabled, or because COOP/COEP don't
+ // act to isolate this page to a separate process).
+
+ // Every script context we are initialized with must create a
+ // new global.
+ rv = CreateNativeGlobalForInner(
+ cx, newInnerWindow, aDocument, &newInnerGlobal,
+ ComputeIsSecureContext(aDocument),
+ newInnerWindow->IsSharedMemoryAllowedInternal(
+ aDocument->NodePrincipal()));
+ NS_ASSERTION(
+ NS_SUCCEEDED(rv) && newInnerGlobal &&
+ newInnerWindow->GetWrapperPreserveColor() == newInnerGlobal,
+ "Failed to get script global");
+
+ mCreatingInnerWindow = false;
+ createdInnerWindow = true;
+
+ NS_ENSURE_SUCCESS(rv, rv);
+ }
+
+ if (currentInner && currentInner->GetWrapperPreserveColor()) {
+ // Don't free objects on our current inner window if it's going to be
+ // held in the bfcache.
+ if (!currentInner->IsFrozen()) {
+ doomCurrentInner = true;
+ }
+ }
+
+ mInnerWindow = newInnerWindow;
+ MOZ_ASSERT(mInnerWindow);
+ mInnerWindow->TryToCacheTopInnerWindow();
+
+ if (!GetWrapperPreserveColor()) {
+ JS::Rooted<JSObject*> outer(
+ cx, NewOuterWindowProxy(cx, newInnerGlobal, thisChrome));
+ NS_ENSURE_TRUE(outer, NS_ERROR_FAILURE);
+
+ mBrowsingContext->CleanUpDanglingRemoteOuterWindowProxies(cx, &outer);
+ MOZ_ASSERT(js::IsWindowProxy(outer));
+
+ js::SetProxyReservedSlot(outer, OUTER_WINDOW_SLOT,
+ JS::PrivateValue(ToSupports(this)));
+
+ // Inform the nsJSContext, which is the canonical holder of the outer.
+ mContext->SetWindowProxy(outer);
+
+ SetWrapper(mContext->GetWindowProxy());
+ } else {
+ JS::Rooted<JSObject*> outerObject(
+ cx, NewOuterWindowProxy(cx, newInnerGlobal, thisChrome));
+ if (!outerObject) {
+ NS_ERROR("out of memory");
+ return NS_ERROR_FAILURE;
+ }
+
+ JS::Rooted<JSObject*> obj(cx, GetWrapper());
+
+ MOZ_ASSERT(js::IsWindowProxy(obj));
+
+ js::SetProxyReservedSlot(obj, OUTER_WINDOW_SLOT,
+ JS::PrivateValue(nullptr));
+ js::SetProxyReservedSlot(outerObject, OUTER_WINDOW_SLOT,
+ JS::PrivateValue(nullptr));
+ js::SetProxyReservedSlot(obj, HOLDER_WEAKMAP_SLOT, JS::UndefinedValue());
+
+ outerObject = xpc::TransplantObjectNukingXrayWaiver(cx, obj, outerObject);
+
+ if (!outerObject) {
+ mBrowsingContext->ClearWindowProxy();
+ NS_ERROR("unable to transplant wrappers, probably OOM");
+ return NS_ERROR_FAILURE;
+ }
+
+ js::SetProxyReservedSlot(outerObject, OUTER_WINDOW_SLOT,
+ JS::PrivateValue(ToSupports(this)));
+
+ SetWrapper(outerObject);
+
+ MOZ_ASSERT(JS::GetNonCCWObjectGlobal(outerObject) == newInnerGlobal);
+
+ // Inform the nsJSContext, which is the canonical holder of the outer.
+ mContext->SetWindowProxy(outerObject);
+ }
+
+ // Enter the new global's realm.
+ JSAutoRealm ar(cx, GetWrapperPreserveColor());
+
+ {
+ JS::Rooted<JSObject*> outer(cx, GetWrapperPreserveColor());
+ js::SetWindowProxy(cx, newInnerGlobal, outer);
+ mBrowsingContext->SetWindowProxy(outer);
+ }
+
+ // Set scriptability based on the state of the WindowContext.
+ WindowContext* wc = mInnerWindow->GetWindowContext();
+ bool allow =
+ wc ? wc->CanExecuteScripts() : mBrowsingContext->CanExecuteScripts();
+ xpc::Scriptability::Get(GetWrapperPreserveColor())
+ .SetWindowAllowsScript(allow);
+
+ if (!aState) {
+ // Get the "window" property once so it will be cached on our inner. We
+ // have to do this here, not in binding code, because this has to happen
+ // after we've created the outer window proxy and stashed it in the outer
+ // nsGlobalWindowOuter, so GetWrapperPreserveColor() on that outer
+ // nsGlobalWindowOuter doesn't return null and
+ // nsGlobalWindowOuter::OuterObject works correctly.
+ JS::Rooted<JS::Value> unused(cx);
+ if (!JS_GetProperty(cx, newInnerGlobal, "window", &unused)) {
+ NS_ERROR("can't create the 'window' property");
+ return NS_ERROR_FAILURE;
+ }
+
+ // And same thing for the "self" property.
+ if (!JS_GetProperty(cx, newInnerGlobal, "self", &unused)) {
+ NS_ERROR("can't create the 'self' property");
+ return NS_ERROR_FAILURE;
+ }
+ }
+ }
+
+ JSAutoRealm ar(cx, GetWrapperPreserveColor());
+
+ if (!aState && !reUseInnerWindow) {
+ // Loading a new page and creating a new inner window, *not*
+ // restoring from session history.
+
+ // Now that both the the inner and outer windows are initialized
+ // let the script context do its magic to hook them together.
+ MOZ_ASSERT(mContext->GetWindowProxy() == GetWrapperPreserveColor());
+#ifdef DEBUG
+ JS::Rooted<JSObject*> rootedJSObject(cx, GetWrapperPreserveColor());
+ JS::Rooted<JSObject*> proto1(cx), proto2(cx);
+ JS_GetPrototype(cx, rootedJSObject, &proto1);
+ JS_GetPrototype(cx, newInnerGlobal, &proto2);
+ NS_ASSERTION(proto1 == proto2,
+ "outer and inner globals should have the same prototype");
+#endif
+
+ mInnerWindow->SyncStateFromParentWindow();
+ }
+
+ // Add an extra ref in case we release mContext during GC.
+ nsCOMPtr<nsIScriptContext> kungFuDeathGrip(mContext);
+
+ // Make sure the inner's document is set correctly before we call
+ // SetScriptGlobalObject, because that might try to examine document-dependent
+ // state. Unfortunately, we can't do some of the other clearing/resetting
+ // work we do below until after SetScriptGlobalObject(), because it might
+ // depend on the document having the right scope object.
+ if (aState) {
+ MOZ_RELEASE_ASSERT(newInnerWindow->mDoc == aDocument);
+ } else {
+ if (reUseInnerWindow) {
+ MOZ_RELEASE_ASSERT(newInnerWindow->mDoc != aDocument);
+ }
+ newInnerWindow->mDoc = aDocument;
+ }
+
+ aDocument->SetScriptGlobalObject(newInnerWindow);
+
+ MOZ_RELEASE_ASSERT(newInnerWindow->mDoc == aDocument);
+
+ if (!aState) {
+ if (reUseInnerWindow) {
+ // The StorageAccess state may have changed. Invalidate the cached
+ // StorageAllowed field, so that the next call to StorageAllowedForWindow
+ // recomputes it.
+ newInnerWindow->ClearStorageAllowedCache();
+
+ // The storage objects contain the URL of the window. We have to
+ // recreate them when the innerWindow is reused.
+ newInnerWindow->mLocalStorage = nullptr;
+ newInnerWindow->mSessionStorage = nullptr;
+ newInnerWindow->mPerformance = nullptr;
+
+ // This must be called after nullifying the internal objects because
+ // here we could recreate them, calling the getter methods, and store
+ // them into the JS slots. If we nullify them after, the slot values and
+ // the objects will be out of sync.
+ newInnerWindow->ClearDocumentDependentSlots(cx);
+ } else {
+ newInnerWindow->InitDocumentDependentState(cx);
+
+ // Initialize DOM classes etc on the inner window.
+ JS::Rooted<JSObject*> obj(cx, newInnerGlobal);
+ rv = kungFuDeathGrip->InitClasses(obj);
+ NS_ENSURE_SUCCESS(rv, rv);
+ }
+
+ // When replacing an initial about:blank document we call
+ // ExecutionReady again to update the client creation URL.
+ rv = newInnerWindow->ExecutionReady();
+ NS_ENSURE_SUCCESS(rv, rv);
+
+ if (mArguments) {
+ newInnerWindow->DefineArgumentsProperty(mArguments);
+ mArguments = nullptr;
+ }
+
+ // Give the new inner window our chrome event handler (since it
+ // doesn't have one).
+ newInnerWindow->mChromeEventHandler = mChromeEventHandler;
+ }
+
+ if (!aState && reUseInnerWindow) {
+ // Notify our WindowGlobalChild that it has a new document. If `aState` was
+ // passed, we're restoring the window from the BFCache, so the document
+ // hasn't changed.
+ // If we didn't have a window global child before, then initializing
+ // it will have set all the required state, so we don't need to do
+ // it again.
+ mInnerWindow->GetWindowGlobalChild()->OnNewDocument(aDocument);
+ }
+
+ // Update the current window for our BrowsingContext.
+ RefPtr<BrowsingContext> bc = GetBrowsingContext();
+
+ if (bc->IsOwnedByProcess()) {
+ MOZ_ALWAYS_SUCCEEDS(bc->SetCurrentInnerWindowId(mInnerWindow->WindowID()));
+ }
+
+ // We no longer need the old inner window. Start its destruction if
+ // its not being reused and clear our reference.
+ if (doomCurrentInner) {
+ currentInner->FreeInnerObjects();
+ }
+ currentInner = nullptr;
+
+ // We wait to fire the debugger hook until the window is all set up and hooked
+ // up with the outer. See bug 969156.
+ if (createdInnerWindow) {
+ nsContentUtils::AddScriptRunner(NewRunnableMethod(
+ "nsGlobalWindowInner::FireOnNewGlobalObject", newInnerWindow,
+ &nsGlobalWindowInner::FireOnNewGlobalObject));
+ }
+
+ if (newInnerWindow && !newInnerWindow->mHasNotifiedGlobalCreated && mDoc) {
+ // We should probably notify. However if this is the, arguably bad,
+ // situation when we're creating a temporary non-chrome-about-blank
+ // document in a chrome docshell, don't notify just yet. Instead wait
+ // until we have a real chrome doc.
+ const bool isContentAboutBlankInChromeDocshell = [&] {
+ if (!mDocShell) {
+ return false;
+ }
+
+ RefPtr<BrowsingContext> bc = mDocShell->GetBrowsingContext();
+ if (!bc || bc->GetType() != BrowsingContext::Type::Chrome) {
+ return false;
+ }
+
+ return !mDoc->NodePrincipal()->IsSystemPrincipal();
+ }();
+
+ if (!isContentAboutBlankInChromeDocshell) {
+ newInnerWindow->mHasNotifiedGlobalCreated = true;
+ nsContentUtils::AddScriptRunner(NewRunnableMethod(
+ "nsGlobalWindowOuter::DispatchDOMWindowCreated", this,
+ &nsGlobalWindowOuter::DispatchDOMWindowCreated));
+ }
+ }
+
+ PreloadLocalStorage();
+
+ // Do this here rather than in say the Document constructor, since
+ // we need a WindowContext available.
+ mDoc->InitUseCounters();
+
+ return NS_OK;
+}
+
+/* static */
+void nsGlobalWindowOuter::PrepareForProcessChange(JSObject* aProxy) {
+ JS::Rooted<JSObject*> localProxy(RootingCx(), aProxy);
+ MOZ_ASSERT(js::IsWindowProxy(localProxy));
+
+ RefPtr<nsGlobalWindowOuter> outerWindow =
+ nsOuterWindowProxy::GetOuterWindow(localProxy);
+ if (!outerWindow) {
+ return;
+ }
+
+ AutoJSAPI jsapi;
+ jsapi.Init();
+ JSContext* cx = jsapi.cx();
+
+ JSAutoRealm ar(cx, localProxy);
+
+ // Clear out existing references from the browsing context and outer window to
+ // the proxy, and from the proxy to the outer window. These references will
+ // become invalid once the proxy is transplanted. Clearing the window proxy
+ // from the browsing context is also necessary to indicate that it is for an
+ // out of process window.
+ outerWindow->ClearWrapper(localProxy);
+ RefPtr<BrowsingContext> bc = outerWindow->GetBrowsingContext();
+ MOZ_ASSERT(bc);
+ MOZ_ASSERT(bc->GetWindowProxy() == localProxy);
+ bc->ClearWindowProxy();
+ js::SetProxyReservedSlot(localProxy, OUTER_WINDOW_SLOT,
+ JS::PrivateValue(nullptr));
+ js::SetProxyReservedSlot(localProxy, HOLDER_WEAKMAP_SLOT,
+ JS::UndefinedValue());
+
+ // Create a new remote outer window proxy, and transplant to it.
+ JS::Rooted<JSObject*> remoteProxy(cx);
+
+ if (!mozilla::dom::GetRemoteOuterWindowProxy(cx, bc, localProxy,
+ &remoteProxy)) {
+ MOZ_CRASH("PrepareForProcessChange GetRemoteOuterWindowProxy");
+ }
+
+ if (!xpc::TransplantObjectNukingXrayWaiver(cx, localProxy, remoteProxy)) {
+ MOZ_CRASH("PrepareForProcessChange TransplantObject");
+ }
+}
+
+void nsGlobalWindowOuter::PreloadLocalStorage() {
+ if (!Storage::StoragePrefIsEnabled()) {
+ return;
+ }
+
+ if (IsChromeWindow()) {
+ return;
+ }
+
+ nsIPrincipal* principal = GetPrincipal();
+ nsIPrincipal* storagePrincipal = GetEffectiveStoragePrincipal();
+ if (!principal || !storagePrincipal) {
+ return;
+ }
+
+ nsresult rv;
+
+ nsCOMPtr<nsIDOMStorageManager> storageManager =
+ do_GetService("@mozilla.org/dom/localStorage-manager;1", &rv);
+ if (NS_FAILED(rv)) {
+ return;
+ }
+
+ // private browsing windows do not persist local storage to disk so we should
+ // only try to precache storage when we're not a private browsing window.
+ if (principal->GetPrivateBrowsingId() == 0) {
+ RefPtr<Storage> storage;
+ rv = storageManager->PrecacheStorage(principal, storagePrincipal,
+ getter_AddRefs(storage));
+ if (NS_SUCCEEDED(rv)) {
+ mLocalStorage = storage;
+ }
+ }
+}
+
+void nsGlobalWindowOuter::DispatchDOMWindowCreated() {
+ if (!mDoc) {
+ return;
+ }
+
+ // Fire DOMWindowCreated at chrome event listeners
+ nsContentUtils::DispatchChromeEvent(mDoc, ToSupports(mDoc),
+ u"DOMWindowCreated"_ns, CanBubble::eYes,
+ Cancelable::eNo);
+
+ nsCOMPtr<nsIObserverService> observerService =
+ mozilla::services::GetObserverService();
+
+ // The event dispatching could possibly cause docshell destory, and
+ // consequently cause mDoc to be set to nullptr by DropOuterWindowDocs(),
+ // so check it again here.
+ if (observerService && mDoc) {
+ nsAutoString origin;
+ nsIPrincipal* principal = mDoc->NodePrincipal();
+ nsContentUtils::GetUTFOrigin(principal, origin);
+ observerService->NotifyObservers(static_cast<nsIDOMWindow*>(this),
+ principal->IsSystemPrincipal()
+ ? "chrome-document-global-created"
+ : "content-document-global-created",
+ origin.get());
+ }
+}
+
+void nsGlobalWindowOuter::ClearStatus() { SetStatusOuter(u""_ns); }
+
+void nsGlobalWindowOuter::SetDocShell(nsDocShell* aDocShell) {
+ MOZ_ASSERT(aDocShell);
+
+ if (aDocShell == mDocShell) {
+ return;
+ }
+
+ mDocShell = aDocShell;
+ mBrowsingContext = aDocShell->GetBrowsingContext();
+
+ RefPtr<BrowsingContext> parentContext = mBrowsingContext->GetParent();
+
+ MOZ_RELEASE_ASSERT(!parentContext ||
+ GetBrowsingContextGroup() == parentContext->Group());
+
+ mTopLevelOuterContentWindow = mBrowsingContext->IsTopContent();
+
+ // Get our enclosing chrome shell and retrieve its global window impl, so
+ // that we can do some forwarding to the chrome document.
+ RefPtr<EventTarget> chromeEventHandler;
+ mDocShell->GetChromeEventHandler(getter_AddRefs(chromeEventHandler));
+ mChromeEventHandler = chromeEventHandler;
+ if (!mChromeEventHandler) {
+ // We have no chrome event handler. If we have a parent,
+ // get our chrome event handler from the parent. If
+ // we don't have a parent, then we need to make a new
+ // window root object that will function as a chrome event
+ // handler and receive all events that occur anywhere inside
+ // our window.
+ nsCOMPtr<nsPIDOMWindowOuter> parentWindow = GetInProcessParent();
+ if (parentWindow.get() != this) {
+ mChromeEventHandler = parentWindow->GetChromeEventHandler();
+ } else {
+ mChromeEventHandler = NS_NewWindowRoot(this);
+ mIsRootOuterWindow = true;
+ }
+ }
+
+ SetIsBackgroundInternal(!mBrowsingContext->IsActive());
+}
+
+void nsGlobalWindowOuter::DetachFromDocShell(bool aIsBeingDiscarded) {
+ // DetachFromDocShell means the window is being torn down. Drop our
+ // reference to the script context, allowing it to be deleted
+ // later. Meanwhile, keep our weak reference to the script object
+ // so that it can be retrieved later (until it is finalized by the JS GC).
+
+ if (mDoc && DocGroup::TryToLoadIframesInBackground()) {
+ DocGroup* docGroup = GetDocGroup();
+ RefPtr<nsIDocShell> docShell = GetDocShell();
+ RefPtr<nsDocShell> dShell = nsDocShell::Cast(docShell);
+ if (dShell) {
+ docGroup->TryFlushIframePostMessages(dShell->GetOuterWindowID());
+ }
+ }
+
+ // Call FreeInnerObjects on all inner windows, not just the current
+ // one, since some could be held by WindowStateHolder objects that
+ // are GC-owned.
+ RefPtr<nsGlobalWindowInner> inner;
+ for (PRCList* node = PR_LIST_HEAD(this); node != this;
+ node = PR_NEXT_LINK(inner)) {
+ // This cast is safe because `node != this`. Non-this nodes are inner
+ // windows.
+ inner = static_cast<nsGlobalWindowInner*>(node);
+ MOZ_ASSERT(!inner->mOuterWindow || inner->mOuterWindow == this);
+ inner->FreeInnerObjects();
+ }
+
+ // Don't report that we were detached to the nsWindowMemoryReporter, as it
+ // only tracks inner windows.
+
+ NotifyWindowIDDestroyed("outer-window-destroyed");
+
+ nsGlobalWindowInner* currentInner = GetCurrentInnerWindowInternal();
+
+ if (currentInner) {
+ NS_ASSERTION(mDoc, "Must have doc!");
+
+ // Remember the document's principal and URI.
+ mDocumentPrincipal = mDoc->NodePrincipal();
+ mDocumentCookiePrincipal = mDoc->EffectiveCookiePrincipal();
+ mDocumentStoragePrincipal = mDoc->EffectiveStoragePrincipal();
+ mDocumentPartitionedPrincipal = mDoc->PartitionedPrincipal();
+ mDocumentURI = mDoc->GetDocumentURI();
+
+ // Release our document reference
+ DropOuterWindowDocs();
+ }
+
+ ClearControllers();
+
+ mChromeEventHandler = nullptr; // force release now
+
+ if (mContext) {
+ // When we're about to destroy a top level content window
+ // (for example a tab), we trigger a full GC by passing null as the last
+ // param. We also trigger a full GC for chrome windows.
+ nsJSContext::PokeGC(JS::GCReason::SET_DOC_SHELL,
+ (mTopLevelOuterContentWindow || mIsChrome)
+ ? nullptr
+ : GetWrapperPreserveColor());
+ mContext = nullptr;
+ }
+
+ if (aIsBeingDiscarded) {
+ // If our BrowsingContext is being discarded, make a note that our current
+ // inner window was active at the time it went away.
+ if (GetCurrentInnerWindow()) {
+ GetCurrentInnerWindowInternal()->SetWasCurrentInnerWindow();
+ }
+ }
+
+ mDocShell = nullptr;
+ mBrowsingContext->ClearDocShell();
+
+ CleanUp();
+}
+
+void nsGlobalWindowOuter::UpdateParentTarget() {
+ // NOTE: This method is nearly identical to
+ // nsGlobalWindowInner::UpdateParentTarget(). IF YOU UPDATE THIS METHOD,
+ // UPDATE THE OTHER ONE TOO! The one difference is that this method updates
+ // mMessageManager as well, which inner windows don't have.
+
+ // Try to get our frame element's tab child global (its in-process message
+ // manager). If that fails, fall back to the chrome event handler's tab
+ // child global, and if it doesn't have one, just use the chrome event
+ // handler itself.
+
+ nsCOMPtr<Element> frameElement = GetFrameElementInternal();
+ mMessageManager = nsContentUtils::TryGetBrowserChildGlobal(frameElement);
+
+ if (!mMessageManager) {
+ nsGlobalWindowOuter* topWin = GetInProcessScriptableTopInternal();
+ if (topWin) {
+ frameElement = topWin->GetFrameElementInternal();
+ mMessageManager = nsContentUtils::TryGetBrowserChildGlobal(frameElement);
+ }
+ }
+
+ if (!mMessageManager) {
+ mMessageManager =
+ nsContentUtils::TryGetBrowserChildGlobal(mChromeEventHandler);
+ }
+
+ if (mMessageManager) {
+ mParentTarget = mMessageManager;
+ } else {
+ mParentTarget = mChromeEventHandler;
+ }
+}
+
+EventTarget* nsGlobalWindowOuter::GetTargetForEventTargetChain() {
+ return GetCurrentInnerWindowInternal();
+}
+
+void nsGlobalWindowOuter::GetEventTargetParent(EventChainPreVisitor& aVisitor) {
+ MOZ_CRASH("The outer window should not be part of an event path");
+}
+
+bool nsGlobalWindowOuter::ShouldPromptToBlockDialogs() {
+ if (!nsContentUtils::GetCurrentJSContext()) {
+ return false; // non-scripted caller.
+ }
+
+ BrowsingContextGroup* group = GetBrowsingContextGroup();
+ if (!group) {
+ return true;
+ }
+
+ return group->DialogsAreBeingAbused();
+}
+
+bool nsGlobalWindowOuter::AreDialogsEnabled() {
+ BrowsingContextGroup* group = mBrowsingContext->Group();
+ if (!group) {
+ NS_ERROR("AreDialogsEnabled() called without a browsing context group?");
+ return false;
+ }
+
+ // Dialogs are blocked if the content viewer is hidden
+ if (mDocShell) {
+ nsCOMPtr<nsIContentViewer> cv;
+ mDocShell->GetContentViewer(getter_AddRefs(cv));
+
+ bool isHidden;
+ cv->GetIsHidden(&isHidden);
+ if (isHidden) {
+ return false;
+ }
+ }
+
+ // Dialogs are also blocked if the document is sandboxed with SANDBOXED_MODALS
+ // (or if we have no document, of course). Which document? Who knows; the
+ // spec is daft. See <https://github.com/whatwg/html/issues/1206>. For now
+ // just go ahead and check mDoc, since in everything except edge cases in
+ // which a frame is allow-same-origin but not allow-scripts and is being poked
+ // at by some other window this should be the right thing anyway.
+ if (!mDoc || (mDoc->GetSandboxFlags() & SANDBOXED_MODALS)) {
+ return false;
+ }
+
+ return group->GetAreDialogsEnabled();
+}
+
+bool nsGlobalWindowOuter::ConfirmDialogIfNeeded() {
+ NS_ENSURE_TRUE(mDocShell, false);
+ nsCOMPtr<nsIPromptService> promptSvc =
+ do_GetService("@mozilla.org/prompter;1");
+
+ if (!promptSvc) {
+ return true;
+ }
+
+ // Reset popup state while opening a modal dialog, and firing events
+ // about the dialog, to prevent the current state from being active
+ // the whole time a modal dialog is open.
+ AutoPopupStatePusher popupStatePusher(PopupBlocker::openAbused, true);
+
+ bool disableDialog = false;
+ nsAutoString label, title;
+ nsContentUtils::GetLocalizedString(nsContentUtils::eCOMMON_DIALOG_PROPERTIES,
+ "ScriptDialogLabel", label);
+ nsContentUtils::GetLocalizedString(nsContentUtils::eCOMMON_DIALOG_PROPERTIES,
+ "ScriptDialogPreventTitle", title);
+ promptSvc->Confirm(this, title.get(), label.get(), &disableDialog);
+ if (disableDialog) {
+ DisableDialogs();
+ return false;
+ }
+
+ return true;
+}
+
+void nsGlobalWindowOuter::DisableDialogs() {
+ BrowsingContextGroup* group = mBrowsingContext->Group();
+ if (!group) {
+ NS_ERROR("DisableDialogs() called without a browsing context group?");
+ return;
+ }
+
+ if (group) {
+ group->SetAreDialogsEnabled(false);
+ }
+}
+
+void nsGlobalWindowOuter::EnableDialogs() {
+ BrowsingContextGroup* group = mBrowsingContext->Group();
+ if (!group) {
+ NS_ERROR("EnableDialogs() called without a browsing context group?");
+ return;
+ }
+
+ if (group) {
+ group->SetAreDialogsEnabled(true);
+ }
+}
+
+nsresult nsGlobalWindowOuter::PostHandleEvent(EventChainPostVisitor& aVisitor) {
+ MOZ_CRASH("The outer window should not be part of an event path");
+}
+
+void nsGlobalWindowOuter::PoisonOuterWindowProxy(JSObject* aObject) {
+ if (aObject == GetWrapperMaybeDead()) {
+ PoisonWrapper();
+ }
+}
+
+nsresult nsGlobalWindowOuter::SetArguments(nsIArray* aArguments) {
+ nsresult rv;
+
+ // We've now mostly separated them, but the difference is still opaque to
+ // nsWindowWatcher (the caller of SetArguments in this little back-and-forth
+ // embedding waltz we do here).
+ //
+ // So we need to demultiplex the two cases here.
+ nsGlobalWindowInner* currentInner = GetCurrentInnerWindowInternal();
+
+ mArguments = aArguments;
+ rv = currentInner->DefineArgumentsProperty(aArguments);
+ NS_ENSURE_SUCCESS(rv, rv);
+
+ return NS_OK;
+}
+
+//*****************************************************************************
+// nsGlobalWindowOuter::nsIScriptObjectPrincipal
+//*****************************************************************************
+
+nsIPrincipal* nsGlobalWindowOuter::GetPrincipal() {
+ if (mDoc) {
+ // If we have a document, get the principal from the document
+ return mDoc->NodePrincipal();
+ }
+
+ if (mDocumentPrincipal) {
+ return mDocumentPrincipal;
+ }
+
+ // If we don't have a principal and we don't have a document we
+ // ask the parent window for the principal. This can happen when
+ // loading a frameset that has a <frame src="javascript:xxx">, in
+ // that case the global window is used in JS before we've loaded
+ // a document into the window.
+
+ nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
+ do_QueryInterface(GetInProcessParentInternal());
+
+ if (objPrincipal) {
+ return objPrincipal->GetPrincipal();
+ }
+
+ return nullptr;
+}
+
+nsIPrincipal* nsGlobalWindowOuter::GetEffectiveCookiePrincipal() {
+ if (mDoc) {
+ // If we have a document, get the principal from the document
+ return mDoc->EffectiveCookiePrincipal();
+ }
+
+ if (mDocumentCookiePrincipal) {
+ return mDocumentCookiePrincipal;
+ }
+
+ // If we don't have a cookie principal and we don't have a document we ask
+ // the parent window for the cookie principal.
+
+ nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
+ do_QueryInterface(GetInProcessParentInternal());
+
+ if (objPrincipal) {
+ return objPrincipal->GetEffectiveCookiePrincipal();
+ }
+
+ return nullptr;
+}
+
+nsIPrincipal* nsGlobalWindowOuter::GetEffectiveStoragePrincipal() {
+ if (mDoc) {
+ // If we have a document, get the principal from the document
+ return mDoc->EffectiveStoragePrincipal();
+ }
+
+ if (mDocumentStoragePrincipal) {
+ return mDocumentStoragePrincipal;
+ }
+
+ // If we don't have a storage principal and we don't have a document we ask
+ // the parent window for the storage principal.
+
+ nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
+ do_QueryInterface(GetInProcessParentInternal());
+
+ if (objPrincipal) {
+ return objPrincipal->GetEffectiveStoragePrincipal();
+ }
+
+ return nullptr;
+}
+
+nsIPrincipal* nsGlobalWindowOuter::PartitionedPrincipal() {
+ if (mDoc) {
+ // If we have a document, get the principal from the document
+ return mDoc->PartitionedPrincipal();
+ }
+
+ if (mDocumentPartitionedPrincipal) {
+ return mDocumentPartitionedPrincipal;
+ }
+
+ // If we don't have a partitioned principal and we don't have a document we
+ // ask the parent window for the partitioned principal.
+
+ nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
+ do_QueryInterface(GetInProcessParentInternal());
+
+ if (objPrincipal) {
+ return objPrincipal->PartitionedPrincipal();
+ }
+
+ return nullptr;
+}
+
+//*****************************************************************************
+// nsGlobalWindowOuter::nsIDOMWindow
+//*****************************************************************************
+
+Element* nsPIDOMWindowOuter::GetFrameElementInternal() const {
+ return mFrameElement;
+}
+
+void nsPIDOMWindowOuter::SetFrameElementInternal(Element* aFrameElement) {
+ mFrameElement = aFrameElement;
+}
+
+Navigator* nsGlobalWindowOuter::GetNavigator() {
+ FORWARD_TO_INNER(Navigator, (), nullptr);
+}
+
+nsScreen* nsGlobalWindowOuter::GetScreen() {
+ FORWARD_TO_INNER(GetScreen, (IgnoreErrors()), nullptr);
+}
+
+void nsPIDOMWindowOuter::ActivateMediaComponents() {
+ if (!ShouldDelayMediaFromStart()) {
+ return;
+ }
+ MOZ_LOG(AudioChannelService::GetAudioChannelLog(), LogLevel::Debug,
+ ("nsPIDOMWindowOuter, ActiveMediaComponents, "
+ "no longer to delay media from start, this = %p\n",
+ this));
+ if (BrowsingContext* bc = GetBrowsingContext()) {
+ Unused << bc->Top()->SetShouldDelayMediaFromStart(false);
+ }
+ NotifyResumingDelayedMedia();
+}
+
+bool nsPIDOMWindowOuter::ShouldDelayMediaFromStart() const {
+ BrowsingContext* bc = GetBrowsingContext();
+ return bc && bc->Top()->GetShouldDelayMediaFromStart();
+}
+
+void nsPIDOMWindowOuter::NotifyResumingDelayedMedia() {
+ RefPtr<AudioChannelService> service = AudioChannelService::GetOrCreate();
+ if (service) {
+ service->NotifyResumingDelayedMedia(this);
+ }
+}
+
+bool nsPIDOMWindowOuter::GetAudioMuted() const {
+ BrowsingContext* bc = GetBrowsingContext();
+ return bc && bc->Top()->GetMuted();
+}
+
+void nsPIDOMWindowOuter::RefreshMediaElementsVolume() {
+ RefPtr<AudioChannelService> service = AudioChannelService::GetOrCreate();
+ if (service) {
+ // TODO: RefreshAgentsVolume can probably be simplified further.
+ service->RefreshAgentsVolume(this, 1.0f, GetAudioMuted());
+ }
+}
+
+mozilla::dom::BrowsingContextGroup*
+nsPIDOMWindowOuter::GetBrowsingContextGroup() const {
+ return mBrowsingContext ? mBrowsingContext->Group() : nullptr;
+}
+
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::GetParentOuter() {
+ BrowsingContext* bc = GetBrowsingContext();
+ return bc ? bc->GetParent(IgnoreErrors()) : nullptr;
+}
+
+/**
+ * GetInProcessScriptableParent used to be called when a script read
+ * window.parent. Under Fission, that is now handled by
+ * BrowsingContext::GetParent, and the result is a WindowProxyHolder rather than
+ * an actual global window. This method still exists for legacy callers which
+ * relied on the old logic, and require in-process windows. However, it only
+ * works correctly when no out-of-process frames exist between this window and
+ * the top-level window, so it should not be used in new code.
+ *
+ * In contrast to GetRealParent, GetInProcessScriptableParent respects <iframe
+ * mozbrowser> boundaries, so if |this| is contained by an <iframe
+ * mozbrowser>, we will return |this| as its own parent.
+ */
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetInProcessScriptableParent() {
+ if (!mDocShell) {
+ return nullptr;
+ }
+
+ if (BrowsingContext* parentBC = GetBrowsingContext()->GetParent()) {
+ if (nsCOMPtr<nsPIDOMWindowOuter> parent = parentBC->GetDOMWindow()) {
+ return parent;
+ }
+ }
+ return this;
+}
+
+/**
+ * Behavies identically to GetInProcessScriptableParent extept that it returns
+ * null if GetInProcessScriptableParent would return this window.
+ */
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetInProcessScriptableParentOrNull() {
+ nsPIDOMWindowOuter* parent = GetInProcessScriptableParent();
+ return (nsGlobalWindowOuter::Cast(parent) == this) ? nullptr : parent;
+}
+
+/**
+ * nsPIDOMWindow::GetParent (when called from C++) is just a wrapper around
+ * GetRealParent.
+ */
+already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::GetInProcessParent() {
+ if (!mDocShell) {
+ return nullptr;
+ }
+
+ nsCOMPtr<nsIDocShell> parent;
+ mDocShell->GetSameTypeInProcessParentIgnoreBrowserBoundaries(
+ getter_AddRefs(parent));
+
+ if (parent) {
+ nsCOMPtr<nsPIDOMWindowOuter> win = parent->GetWindow();
+ return win.forget();
+ }
+
+ nsCOMPtr<nsPIDOMWindowOuter> win(this);
+ return win.forget();
+}
+
+static nsresult GetTopImpl(nsGlobalWindowOuter* aWin, nsIURI* aURIBeingLoaded,
+ nsPIDOMWindowOuter** aTop, bool aScriptable,
+ bool aExcludingExtensionAccessibleContentFrames) {
+ *aTop = nullptr;
+
+ MOZ_ASSERT_IF(aExcludingExtensionAccessibleContentFrames, !aScriptable);
+
+ // Walk up the parent chain.
+
+ nsCOMPtr<nsPIDOMWindowOuter> prevParent = aWin;
+ nsCOMPtr<nsPIDOMWindowOuter> parent = aWin;
+ do {
+ if (!parent) {
+ break;
+ }
+
+ prevParent = parent;
+
+ if (aScriptable) {
+ parent = parent->GetInProcessScriptableParent();
+ } else {
+ parent = parent->GetInProcessParent();
+ }
+
+ if (aExcludingExtensionAccessibleContentFrames) {
+ if (auto* p = nsGlobalWindowOuter::Cast(parent)) {
+ nsGlobalWindowInner* currentInner = p->GetCurrentInnerWindowInternal();
+ nsIURI* uri = prevParent->GetDocumentURI();
+ if (!uri) {
+ // If our parent doesn't have a URI yet, we have a document that is in
+ // the process of being loaded. In that case, our caller is
+ // responsible for passing in the URI for the document that is being
+ // loaded, so we fall back to using that URI here.
+ uri = aURIBeingLoaded;
+ }
+
+ if (currentInner && uri) {
+ // If we find an inner window, we better find the uri for the current
+ // window we're looking at. If we can't find it directly, it is the
+ // responsibility of our caller to provide it to us.
+ MOZ_DIAGNOSTIC_ASSERT(uri);
+
+ // If the new parent has permission to load the current page, we're
+ // at a moz-extension:// frame which has a host permission that allows
+ // it to load the document that we've loaded. In that case, stop at
+ // this frame and consider it the top-level frame.
+ //
+ // Note that it's possible for the set of URIs accepted by
+ // AddonAllowsLoad() to change at runtime, but we don't need to cache
+ // the result of this check, since the important consumer of this code
+ // (which is nsIHttpChannelInternal.topWindowURI) already caches the
+ // result after computing it the first time.
+ if (BasePrincipal::Cast(p->GetPrincipal())
+ ->AddonAllowsLoad(uri, true)) {
+ parent = prevParent;
+ break;
+ }
+ }
+ }
+ }
+
+ } while (parent != prevParent);
+
+ if (parent) {
+ parent.swap(*aTop);
+ }
+
+ return NS_OK;
+}
+
+/**
+ * GetInProcessScriptableTop used to be called when a script read window.top.
+ * Under Fission, that is now handled by BrowsingContext::Top, and the result is
+ * a WindowProxyHolder rather than an actual global window. This method still
+ * exists for legacy callers which relied on the old logic, and require
+ * in-process windows. However, it only works correctly when no out-of-process
+ * frames exist between this window and the top-level window, so it should not
+ * be used in new code.
+ *
+ * In contrast to GetRealTop, GetInProcessScriptableTop respects <iframe
+ * mozbrowser> boundaries. If we encounter a window owned by an <iframe
+ * mozbrowser> while walking up the window hierarchy, we'll stop and return that
+ * window.
+ */
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetInProcessScriptableTop() {
+ nsCOMPtr<nsPIDOMWindowOuter> window;
+ GetTopImpl(this, /* aURIBeingLoaded = */ nullptr, getter_AddRefs(window),
+ /* aScriptable = */ true,
+ /* aExcludingExtensionAccessibleContentFrames = */ false);
+ return window.get();
+}
+
+already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::GetInProcessTop() {
+ nsCOMPtr<nsPIDOMWindowOuter> window;
+ GetTopImpl(this, /* aURIBeingLoaded = */ nullptr, getter_AddRefs(window),
+ /* aScriptable = */ false,
+ /* aExcludingExtensionAccessibleContentFrames = */ false);
+ return window.forget();
+}
+
+already_AddRefed<nsPIDOMWindowOuter>
+nsGlobalWindowOuter::GetTopExcludingExtensionAccessibleContentFrames(
+ nsIURI* aURIBeingLoaded) {
+ // There is a parent-process equivalent of this in DocumentLoadListener.cpp
+ // GetTopWindowExcludingExtensionAccessibleContentFrames
+ nsCOMPtr<nsPIDOMWindowOuter> window;
+ GetTopImpl(this, aURIBeingLoaded, getter_AddRefs(window),
+ /* aScriptable = */ false,
+ /* aExcludingExtensionAccessibleContentFrames = */ true);
+ return window.forget();
+}
+
+void nsGlobalWindowOuter::GetContentOuter(JSContext* aCx,
+ JS::MutableHandle<JSObject*> aRetval,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ RefPtr<BrowsingContext> content = GetContentInternal(aCallerType, aError);
+ if (aError.Failed()) {
+ return;
+ }
+
+ if (!content) {
+ aRetval.set(nullptr);
+ return;
+ }
+
+ JS::Rooted<JS::Value> val(aCx);
+ if (!ToJSValue(aCx, WindowProxyHolder{content}, &val)) {
+ aError.Throw(NS_ERROR_UNEXPECTED);
+ return;
+ }
+
+ MOZ_ASSERT(val.isObjectOrNull());
+ aRetval.set(val.toObjectOrNull());
+}
+
+already_AddRefed<BrowsingContext> nsGlobalWindowOuter::GetContentInternal(
+ CallerType aCallerType, ErrorResult& aError) {
+ // First check for a named frame named "content"
+ if (RefPtr<BrowsingContext> named = GetChildWindow(u"content"_ns)) {
+ return named.forget();
+ }
+
+ // If we're in the parent process, and being called by system code, `content`
+ // should return the current primary content frame (if it's in-process).
+ //
+ // We return `nullptr` if the current primary content frame is out-of-process,
+ // rather than a remote window proxy, as that is the existing behaviour as of
+ // bug 1597437.
+ if (XRE_IsParentProcess() && aCallerType == CallerType::System) {
+ nsCOMPtr<nsIDocShellTreeOwner> treeOwner = GetTreeOwner();
+ if (!treeOwner) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return nullptr;
+ }
+
+ nsCOMPtr<nsIDocShellTreeItem> primaryContent;
+ treeOwner->GetPrimaryContentShell(getter_AddRefs(primaryContent));
+ if (!primaryContent) {
+ return nullptr;
+ }
+
+ return do_AddRef(primaryContent->GetBrowsingContext());
+ }
+
+ // For legacy untrusted callers we always return the same value as
+ // `window.top`
+ if (mDoc && aCallerType != CallerType::System) {
+ mDoc->WarnOnceAbout(DeprecatedOperations::eWindowContentUntrusted);
+ }
+
+ MOZ_ASSERT(mBrowsingContext->IsContent());
+ return do_AddRef(mBrowsingContext->Top());
+}
+
+nsresult nsGlobalWindowOuter::GetPrompter(nsIPrompt** aPrompt) {
+ if (!mDocShell) return NS_ERROR_FAILURE;
+
+ nsCOMPtr<nsIPrompt> prompter(do_GetInterface(mDocShell));
+ NS_ENSURE_TRUE(prompter, NS_ERROR_NO_INTERFACE);
+
+ prompter.forget(aPrompt);
+ return NS_OK;
+}
+
+bool nsGlobalWindowOuter::GetClosedOuter() {
+ // If someone called close(), or if we don't have a docshell, we're closed.
+ return mIsClosed || !mDocShell;
+}
+
+bool nsGlobalWindowOuter::Closed() { return GetClosedOuter(); }
+
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::IndexedGetterOuter(
+ uint32_t aIndex) {
+ BrowsingContext* bc = GetBrowsingContext();
+ NS_ENSURE_TRUE(bc, nullptr);
+
+ Span<RefPtr<BrowsingContext>> children = bc->NonSyntheticChildren();
+
+ if (aIndex < children.Length()) {
+ return WindowProxyHolder(children[aIndex]);
+ }
+ return nullptr;
+}
+
+nsIControllers* nsGlobalWindowOuter::GetControllersOuter(ErrorResult& aError) {
+ if (!mControllers) {
+ mControllers = new nsXULControllers();
+ if (!mControllers) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return nullptr;
+ }
+
+ // Add in the default controller
+ RefPtr<nsBaseCommandController> commandController =
+ nsBaseCommandController::CreateWindowController();
+ if (!commandController) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return nullptr;
+ }
+
+ mControllers->InsertControllerAt(0, commandController);
+ commandController->SetCommandContext(static_cast<nsIDOMWindow*>(this));
+ }
+
+ return mControllers;
+}
+
+nsresult nsGlobalWindowOuter::GetControllers(nsIControllers** aResult) {
+ FORWARD_TO_INNER(GetControllers, (aResult), NS_ERROR_UNEXPECTED);
+}
+
+already_AddRefed<BrowsingContext>
+nsGlobalWindowOuter::GetOpenerBrowsingContext() {
+ RefPtr<BrowsingContext> opener = GetBrowsingContext()->GetOpener();
+ MOZ_DIAGNOSTIC_ASSERT(!opener ||
+ opener->Group() == GetBrowsingContext()->Group());
+ if (!opener || opener->Group() != GetBrowsingContext()->Group()) {
+ return nullptr;
+ }
+
+ // Catch the case where we're chrome but the opener is not...
+ if (nsContentUtils::LegacyIsCallerChromeOrNativeCode() &&
+ GetPrincipal() == nsContentUtils::GetSystemPrincipal()) {
+ auto* openerWin = nsGlobalWindowOuter::Cast(opener->GetDOMWindow());
+ if (!openerWin ||
+ openerWin->GetPrincipal() != nsContentUtils::GetSystemPrincipal()) {
+ return nullptr;
+ }
+ }
+
+ return opener.forget();
+}
+
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetSameProcessOpener() {
+ if (RefPtr<BrowsingContext> opener = GetOpenerBrowsingContext()) {
+ return opener->GetDOMWindow();
+ }
+ return nullptr;
+}
+
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::GetOpenerWindowOuter() {
+ if (RefPtr<BrowsingContext> opener = GetOpenerBrowsingContext()) {
+ return WindowProxyHolder(std::move(opener));
+ }
+ return nullptr;
+}
+
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::GetOpener() {
+ return GetOpenerWindowOuter();
+}
+
+void nsGlobalWindowOuter::GetStatusOuter(nsAString& aStatus) {
+ aStatus = mStatus;
+}
+
+void nsGlobalWindowOuter::SetStatusOuter(const nsAString& aStatus) {
+ mStatus = aStatus;
+
+ // We don't support displaying window.status in the UI, so there's nothing
+ // left to do here.
+}
+
+void nsGlobalWindowOuter::GetNameOuter(nsAString& aName) {
+ if (mDocShell) {
+ mDocShell->GetName(aName);
+ }
+}
+
+void nsGlobalWindowOuter::SetNameOuter(const nsAString& aName,
+ mozilla::ErrorResult& aError) {
+ if (mDocShell) {
+ aError = mDocShell->SetName(aName);
+ }
+}
+
+// NOTE: The idea of this function is that it should return the same as
+// nsPresContext::CSSToDeviceScale() if it was in aWindow synchronously. For
+// that, we use the UnscaledDevicePixelsPerCSSPixel() (which contains the device
+// scale and the OS zoom scale) and then account for the browsing context full
+// zoom. See the declaration of this function for context about why this is
+// needed.
+CSSToLayoutDeviceScale nsGlobalWindowOuter::CSSToDevScaleForBaseWindow(
+ nsIBaseWindow* aWindow) {
+ MOZ_ASSERT(aWindow);
+ auto scale = aWindow->UnscaledDevicePixelsPerCSSPixel();
+ if (mBrowsingContext) {
+ scale.scale *= mBrowsingContext->FullZoom();
+ }
+ return scale;
+}
+
+nsresult nsGlobalWindowOuter::GetInnerSize(CSSSize& aSize) {
+ EnsureSizeAndPositionUpToDate();
+
+ NS_ENSURE_STATE(mDocShell);
+
+ RefPtr<nsPresContext> presContext = mDocShell->GetPresContext();
+ PresShell* presShell = mDocShell->GetPresShell();
+
+ if (!presContext || !presShell) {
+ aSize = {};
+ return NS_OK;
+ }
+
+ // Whether or not the css viewport has been overridden, we can get the
+ // correct value by looking at the visible area of the presContext.
+ if (RefPtr<nsViewManager> viewManager = presShell->GetViewManager()) {
+ viewManager->FlushDelayedResize();
+ }
+
+ // FIXME: Bug 1598487 - Return the layout viewport instead of the ICB.
+ nsSize viewportSize = presContext->GetVisibleArea().Size();
+ if (presContext->GetDynamicToolbarState() == DynamicToolbarState::Collapsed) {
+ viewportSize =
+ nsLayoutUtils::ExpandHeightForViewportUnits(presContext, viewportSize);
+ }
+
+ aSize = CSSPixel::FromAppUnits(viewportSize);
+
+ if (StaticPrefs::dom_innerSize_rounded()) {
+ aSize.width = std::roundf(aSize.width);
+ aSize.height = std::roundf(aSize.height);
+ }
+
+ return NS_OK;
+}
+
+double nsGlobalWindowOuter::GetInnerWidthOuter(ErrorResult& aError) {
+ CSSSize size;
+ aError = GetInnerSize(size);
+ return size.width;
+}
+
+nsresult nsGlobalWindowOuter::GetInnerWidth(double* aInnerWidth) {
+ FORWARD_TO_INNER(GetInnerWidth, (aInnerWidth), NS_ERROR_UNEXPECTED);
+}
+
+void nsGlobalWindowOuter::SetInnerSize(int32_t aLengthCSSPixels, bool aIsWidth,
+ mozilla::dom::CallerType aCallerType,
+ mozilla::ErrorResult& aError) {
+ if (!mDocShell) {
+ aError.Throw(NS_ERROR_UNEXPECTED);
+ return;
+ }
+
+ CSSIntCoord length(aLengthCSSPixels);
+
+ CheckSecurityWidthAndHeight((aIsWidth ? &length.value : nullptr),
+ (aIsWidth ? nullptr : &length.value),
+ aCallerType);
+
+ RefPtr<PresShell> presShell = mDocShell->GetPresShell();
+
+ // Setting inner size should set the CSS viewport. If the CSS viewport
+ // has been overridden, change the override.
+ if (presShell && presShell->UsesMobileViewportSizing()) {
+ RefPtr<nsPresContext> presContext;
+ presContext = presShell->GetPresContext();
+
+ nsRect shellArea = presContext->GetVisibleArea();
+ if (aIsWidth) {
+ shellArea.width = CSSPixel::ToAppUnits(CSSCoord(length));
+ } else {
+ shellArea.height = CSSPixel::ToAppUnits(CSSCoord(length));
+ }
+
+ SetCSSViewportWidthAndHeight(shellArea.Width(), shellArea.Height());
+ return;
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ auto scale = CSSToDevScaleForBaseWindow(treeOwnerAsWin);
+ LayoutDeviceIntCoord valueDev = (CSSCoord(length) * scale).Rounded();
+
+ Maybe<LayoutDeviceIntCoord> width, height;
+ if (aIsWidth) {
+ width.emplace(valueDev);
+ } else {
+ height.emplace(valueDev);
+ }
+
+ aError = treeOwnerAsWin->SetDimensions(
+ {DimensionKind::Inner, Nothing(), Nothing(), width, height});
+
+ CheckForDPIChange();
+}
+
+void nsGlobalWindowOuter::SetInnerWidthOuter(double aInnerWidth,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ SetInnerSize(NSToIntRound(ToZeroIfNonfinite(aInnerWidth)),
+ /* aIsWidth */ true, aCallerType, aError);
+}
+
+double nsGlobalWindowOuter::GetInnerHeightOuter(ErrorResult& aError) {
+ CSSSize size;
+ aError = GetInnerSize(size);
+ return size.height;
+}
+
+nsresult nsGlobalWindowOuter::GetInnerHeight(double* aInnerHeight) {
+ FORWARD_TO_INNER(GetInnerHeight, (aInnerHeight), NS_ERROR_UNEXPECTED);
+}
+
+void nsGlobalWindowOuter::SetInnerHeightOuter(double aInnerHeight,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ SetInnerSize(NSToIntRound(ToZeroIfNonfinite(aInnerHeight)),
+ /* aIsWidth */ false, aCallerType, aError);
+}
+
+CSSIntSize nsGlobalWindowOuter::GetOuterSize(CallerType aCallerType,
+ ErrorResult& aError) {
+ if (nsIGlobalObject::ShouldResistFingerprinting(aCallerType,
+ RFPTarget::Unknown)) {
+ CSSSize size;
+ aError = GetInnerSize(size);
+ return RoundedToInt(size);
+ }
+
+ // Windows showing documents in RDM panes and any subframes within them
+ // return the simulated device size.
+ if (mDoc) {
+ Maybe<CSSIntSize> deviceSize = GetRDMDeviceSize(*mDoc);
+ if (deviceSize.isSome()) {
+ return *deviceSize;
+ }
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return {};
+ }
+
+ return RoundedToInt(treeOwnerAsWin->GetSize() /
+ CSSToDevScaleForBaseWindow(treeOwnerAsWin));
+}
+
+int32_t nsGlobalWindowOuter::GetOuterWidthOuter(CallerType aCallerType,
+ ErrorResult& aError) {
+ return GetOuterSize(aCallerType, aError).width;
+}
+
+int32_t nsGlobalWindowOuter::GetOuterHeightOuter(CallerType aCallerType,
+ ErrorResult& aError) {
+ return GetOuterSize(aCallerType, aError).height;
+}
+
+void nsGlobalWindowOuter::SetOuterSize(int32_t aLengthCSSPixels, bool aIsWidth,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ CheckSecurityWidthAndHeight(aIsWidth ? &aLengthCSSPixels : nullptr,
+ aIsWidth ? nullptr : &aLengthCSSPixels,
+ aCallerType);
+
+ auto scale = CSSToDevScaleForBaseWindow(treeOwnerAsWin);
+ LayoutDeviceIntCoord value =
+ (CSSCoord(CSSIntCoord(aLengthCSSPixels)) * scale).Rounded();
+
+ Maybe<LayoutDeviceIntCoord> width, height;
+ if (aIsWidth) {
+ width.emplace(value);
+ } else {
+ height.emplace(value);
+ }
+
+ aError = treeOwnerAsWin->SetDimensions(
+ {DimensionKind::Outer, Nothing(), Nothing(), width, height});
+
+ CheckForDPIChange();
+}
+
+void nsGlobalWindowOuter::SetOuterWidthOuter(int32_t aOuterWidth,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ SetOuterSize(aOuterWidth, true, aCallerType, aError);
+}
+
+void nsGlobalWindowOuter::SetOuterHeightOuter(int32_t aOuterHeight,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ SetOuterSize(aOuterHeight, false, aCallerType, aError);
+}
+
+CSSPoint nsGlobalWindowOuter::ScreenEdgeSlop() {
+ if (NS_WARN_IF(!mDocShell)) {
+ return {};
+ }
+ RefPtr<nsPresContext> pc = mDocShell->GetPresContext();
+ if (NS_WARN_IF(!pc)) {
+ return {};
+ }
+ nsCOMPtr<nsIWidget> widget = GetMainWidget();
+ if (NS_WARN_IF(!widget)) {
+ return {};
+ }
+ LayoutDeviceIntPoint pt = widget->GetScreenEdgeSlop();
+ auto auPoint =
+ LayoutDeviceIntPoint::ToAppUnits(pt, pc->AppUnitsPerDevPixel());
+ return CSSPoint::FromAppUnits(auPoint);
+}
+
+CSSIntPoint nsGlobalWindowOuter::GetScreenXY(CallerType aCallerType,
+ ErrorResult& aError) {
+ // When resisting fingerprinting, always return (0,0)
+ if (nsIGlobalObject::ShouldResistFingerprinting(aCallerType,
+ RFPTarget::Unknown)) {
+ return CSSIntPoint(0, 0);
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return CSSIntPoint(0, 0);
+ }
+
+ LayoutDeviceIntPoint windowPos;
+ aError = treeOwnerAsWin->GetPosition(&windowPos.x.value, &windowPos.y.value);
+
+ RefPtr<nsPresContext> presContext = mDocShell->GetPresContext();
+ if (!presContext) {
+ // XXX Fishy LayoutDevice to CSS conversion?
+ return CSSIntPoint(windowPos.x, windowPos.y);
+ }
+
+ nsDeviceContext* context = presContext->DeviceContext();
+ auto windowPosAppUnits = LayoutDeviceIntPoint::ToAppUnits(
+ windowPos, context->AppUnitsPerDevPixel());
+ return CSSIntPoint::FromAppUnitsRounded(windowPosAppUnits);
+}
+
+int32_t nsGlobalWindowOuter::GetScreenXOuter(CallerType aCallerType,
+ ErrorResult& aError) {
+ return GetScreenXY(aCallerType, aError).x;
+}
+
+nsRect nsGlobalWindowOuter::GetInnerScreenRect() {
+ if (!mDocShell) {
+ return nsRect();
+ }
+
+ EnsureSizeAndPositionUpToDate();
+
+ if (!mDocShell) {
+ return nsRect();
+ }
+
+ PresShell* presShell = mDocShell->GetPresShell();
+ if (!presShell) {
+ return nsRect();
+ }
+ nsIFrame* rootFrame = presShell->GetRootFrame();
+ if (!rootFrame) {
+ return nsRect();
+ }
+
+ return rootFrame->GetScreenRectInAppUnits();
+}
+
+Maybe<CSSIntSize> nsGlobalWindowOuter::GetRDMDeviceSize(
+ const Document& aDocument) {
+ // RDM device size should reflect the simulated device resolution, and
+ // be independent of any full zoom or resolution zoom applied to the
+ // content. To get this value, we get the "unscaled" browser child size,
+ // and divide by the full zoom. "Unscaled" in this case means unscaled
+ // from device to screen but it has been affected (multiplied) by the
+ // full zoom and we need to compensate for that.
+ MOZ_RELEASE_ASSERT(NS_IsMainThread());
+
+ // Bug 1576256: This does not work for cross-process subframes.
+ const Document* topInProcessContentDoc =
+ aDocument.GetTopLevelContentDocumentIfSameProcess();
+ BrowsingContext* bc = topInProcessContentDoc
+ ? topInProcessContentDoc->GetBrowsingContext()
+ : nullptr;
+ if (bc && bc->InRDMPane()) {
+ nsIDocShell* docShell = topInProcessContentDoc->GetDocShell();
+ if (docShell) {
+ nsPresContext* presContext = docShell->GetPresContext();
+ if (presContext) {
+ nsCOMPtr<nsIBrowserChild> child = docShell->GetBrowserChild();
+ if (child) {
+ // We intentionally use GetFullZoom here instead of
+ // GetDeviceFullZoom, because the unscaledInnerSize is based
+ // on the full zoom and not the device full zoom (which is
+ // rounded to result in integer device pixels).
+ float zoom = presContext->GetFullZoom();
+ BrowserChild* bc = static_cast<BrowserChild*>(child.get());
+ CSSSize unscaledSize = bc->GetUnscaledInnerSize();
+ return Some(CSSIntSize(gfx::RoundedToInt(unscaledSize / zoom)));
+ }
+ }
+ }
+ }
+ return Nothing();
+}
+
+float nsGlobalWindowOuter::GetMozInnerScreenXOuter(CallerType aCallerType) {
+ // When resisting fingerprinting, always return 0.
+ if (nsIGlobalObject::ShouldResistFingerprinting(aCallerType,
+ RFPTarget::Unknown)) {
+ return 0.0;
+ }
+
+ nsRect r = GetInnerScreenRect();
+ return nsPresContext::AppUnitsToFloatCSSPixels(r.x);
+}
+
+float nsGlobalWindowOuter::GetMozInnerScreenYOuter(CallerType aCallerType) {
+ // Return 0 to prevent fingerprinting.
+ if (nsIGlobalObject::ShouldResistFingerprinting(aCallerType,
+ RFPTarget::Unknown)) {
+ return 0.0;
+ }
+
+ nsRect r = GetInnerScreenRect();
+ return nsPresContext::AppUnitsToFloatCSSPixels(r.y);
+}
+
+void nsGlobalWindowOuter::SetScreenCoord(int32_t aCoordCSSPixels, bool aIsX,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ CheckSecurityLeftAndTop(aIsX ? &aCoordCSSPixels : nullptr,
+ aIsX ? nullptr : &aCoordCSSPixels, aCallerType);
+
+ auto scale = CSSToDevScaleForBaseWindow(treeOwnerAsWin);
+ LayoutDeviceIntCoord coord =
+ (CSSCoord(CSSIntCoord(aCoordCSSPixels)) * scale).Rounded();
+
+ Maybe<LayoutDeviceIntCoord> x, y;
+ if (aIsX) {
+ x.emplace(coord);
+ } else {
+ y.emplace(coord);
+ }
+
+ aError = treeOwnerAsWin->SetDimensions(
+ {DimensionKind::Outer, x, y, Nothing(), Nothing()});
+
+ CheckForDPIChange();
+}
+
+void nsGlobalWindowOuter::SetScreenXOuter(int32_t aScreenX,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ SetScreenCoord(aScreenX, /* aIsX */ true, aCallerType, aError);
+}
+
+int32_t nsGlobalWindowOuter::GetScreenYOuter(CallerType aCallerType,
+ ErrorResult& aError) {
+ return GetScreenXY(aCallerType, aError).y;
+}
+
+void nsGlobalWindowOuter::SetScreenYOuter(int32_t aScreenY,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ SetScreenCoord(aScreenY, /* aIsX */ false, aCallerType, aError);
+}
+
+// NOTE: Arguments to this function should have values scaled to
+// CSS pixels, not device pixels.
+void nsGlobalWindowOuter::CheckSecurityWidthAndHeight(int32_t* aWidth,
+ int32_t* aHeight,
+ CallerType aCallerType) {
+ if (aCallerType != CallerType::System) {
+ // if attempting to resize the window, hide any open popups
+ nsContentUtils::HidePopupsInDocument(mDoc);
+ }
+
+ // This one is easy. Just ensure the variable is greater than 100;
+ if ((aWidth && *aWidth < 100) || (aHeight && *aHeight < 100)) {
+ // Check security state for use in determing window dimensions
+
+ if (aCallerType != CallerType::System) {
+ // sec check failed
+ if (aWidth && *aWidth < 100) {
+ *aWidth = 100;
+ }
+ if (aHeight && *aHeight < 100) {
+ *aHeight = 100;
+ }
+ }
+ }
+}
+
+// NOTE: Arguments to this function should have values in app units
+void nsGlobalWindowOuter::SetCSSViewportWidthAndHeight(nscoord aInnerWidth,
+ nscoord aInnerHeight) {
+ RefPtr<nsPresContext> presContext = mDocShell->GetPresContext();
+
+ nsRect shellArea = presContext->GetVisibleArea();
+ shellArea.SetHeight(aInnerHeight);
+ shellArea.SetWidth(aInnerWidth);
+
+ // FIXME(emilio): This doesn't seem to be ok, this doesn't reflow or
+ // anything... Should go through PresShell::ResizeReflow.
+ //
+ // But I don't think this can be reached by content, as we don't allow to set
+ // inner{Width,Height}.
+ presContext->SetVisibleArea(shellArea);
+}
+
+// NOTE: Arguments to this function should have values scaled to
+// CSS pixels, not device pixels.
+void nsGlobalWindowOuter::CheckSecurityLeftAndTop(int32_t* aLeft, int32_t* aTop,
+ CallerType aCallerType) {
+ // This one is harder. We have to get the screen size and window dimensions.
+
+ // Check security state for use in determing window dimensions
+
+ if (aCallerType != CallerType::System) {
+ // if attempting to move the window, hide any open popups
+ nsContentUtils::HidePopupsInDocument(mDoc);
+
+ if (nsGlobalWindowOuter* rootWindow =
+ nsGlobalWindowOuter::Cast(GetPrivateRoot())) {
+ rootWindow->FlushPendingNotifications(FlushType::Layout);
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+
+ RefPtr<nsScreen> screen = GetScreen();
+
+ if (treeOwnerAsWin && screen) {
+ CSSToLayoutDeviceScale scale = CSSToDevScaleForBaseWindow(treeOwnerAsWin);
+ CSSIntRect winRect =
+ CSSIntRect::Round(treeOwnerAsWin->GetPositionAndSize() / scale);
+
+ // Get the screen dimensions
+ // XXX This should use nsIScreenManager once it's fully fleshed out.
+ int32_t screenLeft = screen->GetAvailLeft(IgnoreErrors());
+ int32_t screenWidth = screen->GetAvailWidth(IgnoreErrors());
+ int32_t screenHeight = screen->GetAvailHeight(IgnoreErrors());
+#if defined(XP_MACOSX)
+ /* The mac's coordinate system is different from the assumed Windows'
+ system. It offsets by the height of the menubar so that a window
+ placed at (0,0) will be entirely visible. Unfortunately that
+ correction is made elsewhere (in Widget) and the meaning of
+ the Avail... coordinates is overloaded. Here we allow a window
+ to be placed at (0,0) because it does make sense to do so.
+ */
+ int32_t screenTop = screen->GetTop(IgnoreErrors());
+#else
+ int32_t screenTop = screen->GetAvailTop(IgnoreErrors());
+#endif
+
+ if (aLeft) {
+ if (screenLeft + screenWidth < *aLeft + winRect.width)
+ *aLeft = screenLeft + screenWidth - winRect.width;
+ if (screenLeft > *aLeft) *aLeft = screenLeft;
+ }
+ if (aTop) {
+ if (screenTop + screenHeight < *aTop + winRect.height)
+ *aTop = screenTop + screenHeight - winRect.height;
+ if (screenTop > *aTop) *aTop = screenTop;
+ }
+ } else {
+ if (aLeft) *aLeft = 0;
+ if (aTop) *aTop = 0;
+ }
+ }
+}
+
+int32_t nsGlobalWindowOuter::GetScrollBoundaryOuter(Side aSide) {
+ FlushPendingNotifications(FlushType::Layout);
+ if (nsIScrollableFrame* sf = GetScrollFrame()) {
+ return nsPresContext::AppUnitsToIntCSSPixels(
+ sf->GetScrollRange().Edge(aSide));
+ }
+ return 0;
+}
+
+CSSPoint nsGlobalWindowOuter::GetScrollXY(bool aDoFlush) {
+ if (aDoFlush) {
+ FlushPendingNotifications(FlushType::Layout);
+ } else {
+ EnsureSizeAndPositionUpToDate();
+ }
+
+ nsIScrollableFrame* sf = GetScrollFrame();
+ if (!sf) {
+ return CSSIntPoint(0, 0);
+ }
+
+ nsPoint scrollPos = sf->GetScrollPosition();
+ if (scrollPos != nsPoint(0, 0) && !aDoFlush) {
+ // Oh, well. This is the expensive case -- the window is scrolled and we
+ // didn't actually flush yet. Repeat, but with a flush, since the content
+ // may get shorter and hence our scroll position may decrease.
+ return GetScrollXY(true);
+ }
+
+ return CSSPoint::FromAppUnits(scrollPos);
+}
+
+double nsGlobalWindowOuter::GetScrollXOuter() { return GetScrollXY(false).x; }
+
+double nsGlobalWindowOuter::GetScrollYOuter() { return GetScrollXY(false).y; }
+
+uint32_t nsGlobalWindowOuter::Length() {
+ BrowsingContext* bc = GetBrowsingContext();
+ return bc ? bc->NonSyntheticChildren().Length() : 0;
+}
+
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::GetTopOuter() {
+ BrowsingContext* bc = GetBrowsingContext();
+ return bc ? bc->GetTop(IgnoreErrors()) : nullptr;
+}
+
+already_AddRefed<BrowsingContext> nsGlobalWindowOuter::GetChildWindow(
+ const nsAString& aName) {
+ NS_ENSURE_TRUE(mBrowsingContext, nullptr);
+ NS_ENSURE_TRUE(mInnerWindow, nullptr);
+ NS_ENSURE_TRUE(mInnerWindow->GetWindowGlobalChild(), nullptr);
+
+ return do_AddRef(mBrowsingContext->FindChildWithName(
+ aName, *mInnerWindow->GetWindowGlobalChild()));
+}
+
+bool nsGlobalWindowOuter::DispatchCustomEvent(
+ const nsAString& aEventName, ChromeOnlyDispatch aChromeOnlyDispatch) {
+ bool defaultActionEnabled = true;
+
+ if (aChromeOnlyDispatch == ChromeOnlyDispatch::eYes) {
+ nsContentUtils::DispatchEventOnlyToChrome(
+ mDoc, ToSupports(this), aEventName, CanBubble::eYes, Cancelable::eYes,
+ &defaultActionEnabled);
+ } else {
+ nsContentUtils::DispatchTrustedEvent(mDoc, ToSupports(this), aEventName,
+ CanBubble::eYes, Cancelable::eYes,
+ &defaultActionEnabled);
+ }
+
+ return defaultActionEnabled;
+}
+
+bool nsGlobalWindowOuter::DispatchResizeEvent(const CSSIntSize& aSize) {
+ ErrorResult res;
+ RefPtr<Event> domEvent =
+ mDoc->CreateEvent(u"CustomEvent"_ns, CallerType::System, res);
+ if (res.Failed()) {
+ return false;
+ }
+
+ // We don't init the AutoJSAPI with ourselves because we don't want it
+ // reporting errors to our onerror handlers.
+ AutoJSAPI jsapi;
+ jsapi.Init();
+ JSContext* cx = jsapi.cx();
+ JSAutoRealm ar(cx, GetWrapperPreserveColor());
+
+ DOMWindowResizeEventDetail detail;
+ detail.mWidth = aSize.width;
+ detail.mHeight = aSize.height;
+ JS::Rooted<JS::Value> detailValue(cx);
+ if (!ToJSValue(cx, detail, &detailValue)) {
+ return false;
+ }
+
+ CustomEvent* customEvent = static_cast<CustomEvent*>(domEvent.get());
+ customEvent->InitCustomEvent(cx, u"DOMWindowResize"_ns,
+ /* aCanBubble = */ true,
+ /* aCancelable = */ true, detailValue);
+
+ domEvent->SetTrusted(true);
+ domEvent->WidgetEventPtr()->mFlags.mOnlyChromeDispatch = true;
+
+ nsCOMPtr<EventTarget> target = this;
+ domEvent->SetTarget(target);
+
+ return target->DispatchEvent(*domEvent, CallerType::System, IgnoreErrors());
+}
+
+bool nsGlobalWindowOuter::WindowExists(const nsAString& aName,
+ bool aForceNoOpener,
+ bool aLookForCallerOnJSStack) {
+ MOZ_ASSERT(mDocShell, "Must have docshell");
+
+ if (aForceNoOpener) {
+ return aName.LowerCaseEqualsLiteral("_self") ||
+ aName.LowerCaseEqualsLiteral("_top") ||
+ aName.LowerCaseEqualsLiteral("_parent");
+ }
+
+ if (WindowGlobalChild* wgc = mInnerWindow->GetWindowGlobalChild()) {
+ return wgc->FindBrowsingContextWithName(aName, aLookForCallerOnJSStack);
+ }
+ return false;
+}
+
+already_AddRefed<nsIWidget> nsGlobalWindowOuter::GetMainWidget() {
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+
+ nsCOMPtr<nsIWidget> widget;
+
+ if (treeOwnerAsWin) {
+ treeOwnerAsWin->GetMainWidget(getter_AddRefs(widget));
+ }
+
+ return widget.forget();
+}
+
+nsIWidget* nsGlobalWindowOuter::GetNearestWidget() const {
+ nsIDocShell* docShell = GetDocShell();
+ if (!docShell) {
+ return nullptr;
+ }
+ PresShell* presShell = docShell->GetPresShell();
+ if (!presShell) {
+ return nullptr;
+ }
+ nsIFrame* rootFrame = presShell->GetRootFrame();
+ if (!rootFrame) {
+ return nullptr;
+ }
+ return rootFrame->GetView()->GetNearestWidget(nullptr);
+}
+
+void nsGlobalWindowOuter::SetFullscreenOuter(bool aFullscreen,
+ mozilla::ErrorResult& aError) {
+ aError =
+ SetFullscreenInternal(FullscreenReason::ForFullscreenMode, aFullscreen);
+}
+
+nsresult nsGlobalWindowOuter::SetFullScreen(bool aFullscreen) {
+ return SetFullscreenInternal(FullscreenReason::ForFullscreenMode,
+ aFullscreen);
+}
+
+static void FinishDOMFullscreenChange(Document* aDoc, bool aInDOMFullscreen) {
+ if (aInDOMFullscreen) {
+ // Ask the document to handle any pending DOM fullscreen change.
+ if (!Document::HandlePendingFullscreenRequests(aDoc)) {
+ // If we don't end up having anything in fullscreen,
+ // async request exiting fullscreen.
+ Document::AsyncExitFullscreen(aDoc);
+ }
+ } else {
+ // If the window is leaving fullscreen state, also ask the document
+ // to exit from DOM Fullscreen.
+ Document::ExitFullscreenInDocTree(aDoc);
+ }
+}
+
+struct FullscreenTransitionDuration {
+ // The unit of the durations is millisecond
+ uint16_t mFadeIn = 0;
+ uint16_t mFadeOut = 0;
+ bool IsSuppressed() const { return mFadeIn == 0 && mFadeOut == 0; }
+};
+
+static void GetFullscreenTransitionDuration(
+ bool aEnterFullscreen, FullscreenTransitionDuration* aDuration) {
+ const char* pref = aEnterFullscreen
+ ? "full-screen-api.transition-duration.enter"
+ : "full-screen-api.transition-duration.leave";
+ nsAutoCString prefValue;
+ Preferences::GetCString(pref, prefValue);
+ if (!prefValue.IsEmpty()) {
+ sscanf(prefValue.get(), "%hu%hu", &aDuration->mFadeIn,
+ &aDuration->mFadeOut);
+ }
+}
+
+class FullscreenTransitionTask : public Runnable {
+ public:
+ FullscreenTransitionTask(const FullscreenTransitionDuration& aDuration,
+ nsGlobalWindowOuter* aWindow, bool aFullscreen,
+ nsIWidget* aWidget, nsISupports* aTransitionData)
+ : mozilla::Runnable("FullscreenTransitionTask"),
+ mWindow(aWindow),
+ mWidget(aWidget),
+ mTransitionData(aTransitionData),
+ mDuration(aDuration),
+ mStage(eBeforeToggle),
+ mFullscreen(aFullscreen) {}
+
+ NS_IMETHOD Run() override;
+
+ private:
+ ~FullscreenTransitionTask() override = default;
+
+ /**
+ * The flow of fullscreen transition:
+ *
+ * parent process | child process
+ * ----------------------------------------------------------------
+ *
+ * | request/exit fullscreen
+ * <-----|
+ * BeforeToggle stage |
+ * |
+ * ToggleFullscreen stage *1 |----->
+ * | HandleFullscreenRequests
+ * |
+ * <-----| MozAfterPaint event
+ * AfterToggle stage *2 |
+ * |
+ * End stage |
+ *
+ * Note we also start a timer at *1 so that if we don't get MozAfterPaint
+ * from the child process in time, we continue going to *2.
+ */
+ enum Stage {
+ // BeforeToggle stage happens before we enter or leave fullscreen
+ // state. In this stage, the task triggers the pre-toggle fullscreen
+ // transition on the widget.
+ eBeforeToggle,
+ // ToggleFullscreen stage actually executes the fullscreen toggle,
+ // and wait for the next paint on the content to continue.
+ eToggleFullscreen,
+ // AfterToggle stage happens after we toggle the fullscreen state.
+ // In this stage, the task triggers the post-toggle fullscreen
+ // transition on the widget.
+ eAfterToggle,
+ // End stage is triggered after the final transition finishes.
+ eEnd
+ };
+
+ class Observer final : public nsIObserver, public nsINamed {
+ public:
+ NS_DECL_ISUPPORTS
+ NS_DECL_NSIOBSERVER
+ NS_DECL_NSINAMED
+
+ explicit Observer(FullscreenTransitionTask* aTask) : mTask(aTask) {}
+
+ private:
+ ~Observer() = default;
+
+ RefPtr<FullscreenTransitionTask> mTask;
+ };
+
+ static const char* const kPaintedTopic;
+
+ RefPtr<nsGlobalWindowOuter> mWindow;
+ nsCOMPtr<nsIWidget> mWidget;
+ nsCOMPtr<nsITimer> mTimer;
+ nsCOMPtr<nsISupports> mTransitionData;
+
+ TimeStamp mFullscreenChangeStartTime;
+ FullscreenTransitionDuration mDuration;
+ Stage mStage;
+ bool mFullscreen;
+};
+
+const char* const FullscreenTransitionTask::kPaintedTopic =
+ "fullscreen-painted";
+
+NS_IMETHODIMP
+FullscreenTransitionTask::Run() {
+ Stage stage = mStage;
+ mStage = Stage(mStage + 1);
+ if (MOZ_UNLIKELY(mWidget->Destroyed())) {
+ // If the widget has been destroyed before we get here, don't try to
+ // do anything more. Just let it go and release ourselves.
+ NS_WARNING("The widget to fullscreen has been destroyed");
+ mWindow->mIsInFullScreenTransition = false;
+ return NS_OK;
+ }
+ if (stage == eBeforeToggle) {
+ PROFILER_MARKER_UNTYPED("Fullscreen transition start", DOM);
+
+ mWindow->mIsInFullScreenTransition = true;
+
+ nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+ NS_ENSURE_TRUE(obs, NS_ERROR_FAILURE);
+ obs->NotifyObservers(nullptr, "fullscreen-transition-start", nullptr);
+
+ mWidget->PerformFullscreenTransition(nsIWidget::eBeforeFullscreenToggle,
+ mDuration.mFadeIn, mTransitionData,
+ this);
+ } else if (stage == eToggleFullscreen) {
+ PROFILER_MARKER_UNTYPED("Fullscreen toggle start", DOM);
+ mFullscreenChangeStartTime = TimeStamp::Now();
+ // Toggle the fullscreen state on the widget
+ if (!mWindow->SetWidgetFullscreen(FullscreenReason::ForFullscreenAPI,
+ mFullscreen, mWidget)) {
+ // Fail to setup the widget, call FinishFullscreenChange to
+ // complete fullscreen change directly.
+ mWindow->FinishFullscreenChange(mFullscreen);
+ }
+ // Set observer for the next content paint.
+ nsCOMPtr<nsIObserver> observer = new Observer(this);
+ nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+ obs->AddObserver(observer, kPaintedTopic, false);
+ // There are several edge cases where we may never get the paint
+ // notification, including:
+ // 1. the window/tab is closed before the next paint;
+ // 2. the user has switched to another tab before we get here.
+ // Completely fixing those cases seems to be tricky, and since they
+ // should rarely happen, it probably isn't worth to fix. Hence we
+ // simply add a timeout here to ensure we never hang forever.
+ // In addition, if the page is complicated or the machine is less
+ // powerful, layout could take a long time, in which case, staying
+ // in black screen for that long could hurt user experience even
+ // more than exposing an intermediate state.
+ uint32_t timeout =
+ Preferences::GetUint("full-screen-api.transition.timeout", 1000);
+ NS_NewTimerWithObserver(getter_AddRefs(mTimer), observer, timeout,
+ nsITimer::TYPE_ONE_SHOT);
+ } else if (stage == eAfterToggle) {
+ Telemetry::AccumulateTimeDelta(Telemetry::FULLSCREEN_TRANSITION_BLACK_MS,
+ mFullscreenChangeStartTime);
+ mWidget->PerformFullscreenTransition(nsIWidget::eAfterFullscreenToggle,
+ mDuration.mFadeOut, mTransitionData,
+ this);
+ } else if (stage == eEnd) {
+ PROFILER_MARKER_UNTYPED("Fullscreen transition end", DOM);
+
+ mWindow->mIsInFullScreenTransition = false;
+
+ nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+ NS_ENSURE_TRUE(obs, NS_ERROR_FAILURE);
+ obs->NotifyObservers(nullptr, "fullscreen-transition-end", nullptr);
+
+ mWidget->CleanupFullscreenTransition();
+ }
+ return NS_OK;
+}
+
+NS_IMPL_ISUPPORTS(FullscreenTransitionTask::Observer, nsIObserver, nsINamed)
+
+NS_IMETHODIMP
+FullscreenTransitionTask::Observer::Observe(nsISupports* aSubject,
+ const char* aTopic,
+ const char16_t* aData) {
+ bool shouldContinue = false;
+ if (strcmp(aTopic, FullscreenTransitionTask::kPaintedTopic) == 0) {
+ nsCOMPtr<nsPIDOMWindowInner> win(do_QueryInterface(aSubject));
+ nsCOMPtr<nsIWidget> widget =
+ win ? nsGlobalWindowInner::Cast(win)->GetMainWidget() : nullptr;
+ if (widget == mTask->mWidget) {
+ // The paint notification arrives first. Cancel the timer.
+ mTask->mTimer->Cancel();
+ shouldContinue = true;
+ PROFILER_MARKER_UNTYPED("Fullscreen toggle end", DOM);
+ }
+ } else {
+#ifdef DEBUG
+ MOZ_ASSERT(strcmp(aTopic, NS_TIMER_CALLBACK_TOPIC) == 0,
+ "Should only get fullscreen-painted or timer-callback");
+ nsCOMPtr<nsITimer> timer(do_QueryInterface(aSubject));
+ MOZ_ASSERT(timer && timer == mTask->mTimer,
+ "Should only trigger this with the timer the task created");
+#endif
+ shouldContinue = true;
+ PROFILER_MARKER_UNTYPED("Fullscreen toggle timeout", DOM);
+ }
+ if (shouldContinue) {
+ nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+ obs->RemoveObserver(this, kPaintedTopic);
+ mTask->mTimer = nullptr;
+ mTask->Run();
+ }
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+FullscreenTransitionTask::Observer::GetName(nsACString& aName) {
+ aName.AssignLiteral("FullscreenTransitionTask");
+ return NS_OK;
+}
+
+static bool MakeWidgetFullscreen(nsGlobalWindowOuter* aWindow,
+ FullscreenReason aReason, bool aFullscreen) {
+ nsCOMPtr<nsIWidget> widget = aWindow->GetMainWidget();
+ if (!widget) {
+ return false;
+ }
+
+ FullscreenTransitionDuration duration;
+ bool performTransition = false;
+ nsCOMPtr<nsISupports> transitionData;
+ if (aReason == FullscreenReason::ForFullscreenAPI) {
+ GetFullscreenTransitionDuration(aFullscreen, &duration);
+ if (!duration.IsSuppressed()) {
+ performTransition = widget->PrepareForFullscreenTransition(
+ getter_AddRefs(transitionData));
+ }
+ }
+
+ if (!performTransition) {
+ return aWindow->SetWidgetFullscreen(aReason, aFullscreen, widget);
+ }
+
+ nsCOMPtr<nsIRunnable> task = new FullscreenTransitionTask(
+ duration, aWindow, aFullscreen, widget, transitionData);
+ task->Run();
+ return true;
+}
+
+nsresult nsGlobalWindowOuter::ProcessWidgetFullscreenRequest(
+ FullscreenReason aReason, bool aFullscreen) {
+ mInProcessFullscreenRequest.emplace(aReason, aFullscreen);
+
+ // Prevent chrome documents which are still loading from resizing
+ // the window after we set fullscreen mode.
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ nsCOMPtr<nsIAppWindow> appWin(do_GetInterface(treeOwnerAsWin));
+ if (aFullscreen && appWin) {
+ appWin->SetIntrinsicallySized(false);
+ }
+
+ // Sometimes we don't want the top-level widget to actually go fullscreen:
+ // - in the B2G desktop client, we don't want the emulated screen dimensions
+ // to appear to increase when entering fullscreen mode; we just want the
+ // content to fill the entire client area of the emulator window.
+ // - in FxR Desktop, we don't want fullscreen to take over the monitor, but
+ // instead we want fullscreen to fill the FxR window in the the headset.
+ if (!StaticPrefs::full_screen_api_ignore_widgets() &&
+ !mForceFullScreenInWidget) {
+ if (MakeWidgetFullscreen(this, aReason, aFullscreen)) {
+ // The rest of code for switching fullscreen is in nsGlobalWindowOuter::
+ // FinishFullscreenChange() which will be called after sizemodechange
+ // event is dispatched.
+ return NS_OK;
+ }
+ }
+
+#if defined(NIGHTLY_BUILD) && defined(XP_WIN)
+ if (FxRWindowManager::GetInstance()->IsFxRWindow(mWindowID)) {
+ mozilla::gfx::VRShMem shmem(nullptr, true /*aRequiresMutex*/);
+ shmem.SendFullscreenState(mWindowID, aFullscreen);
+ }
+#endif // NIGHTLY_BUILD && XP_WIN
+ FinishFullscreenChange(aFullscreen);
+ return NS_OK;
+}
+
+nsresult nsGlobalWindowOuter::SetFullscreenInternal(FullscreenReason aReason,
+ bool aFullscreen) {
+ MOZ_ASSERT(nsContentUtils::IsSafeToRunScript(),
+ "Requires safe to run script as it "
+ "may call FinishDOMFullscreenChange");
+
+ NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
+
+ MOZ_ASSERT(
+ aReason != FullscreenReason::ForForceExitFullscreen || !aFullscreen,
+ "FullscreenReason::ForForceExitFullscreen can "
+ "only be used with exiting fullscreen");
+
+ // Only chrome can change our fullscreen mode. Otherwise, the state
+ // can only be changed for DOM fullscreen.
+ if (aReason == FullscreenReason::ForFullscreenMode &&
+ !nsContentUtils::LegacyIsCallerChromeOrNativeCode()) {
+ return NS_OK;
+ }
+
+ // SetFullscreen needs to be called on the root window, so get that
+ // via the DocShell tree, and if we are not already the root,
+ // call SetFullscreen on that window instead.
+ nsCOMPtr<nsIDocShellTreeItem> rootItem;
+ mDocShell->GetInProcessRootTreeItem(getter_AddRefs(rootItem));
+ nsCOMPtr<nsPIDOMWindowOuter> window =
+ rootItem ? rootItem->GetWindow() : nullptr;
+ if (!window) return NS_ERROR_FAILURE;
+ if (rootItem != mDocShell)
+ return window->SetFullscreenInternal(aReason, aFullscreen);
+
+ // make sure we don't try to set full screen on a non-chrome window,
+ // which might happen in embedding world
+ if (mDocShell->ItemType() != nsIDocShellTreeItem::typeChrome)
+ return NS_ERROR_FAILURE;
+
+ // FullscreenReason::ForForceExitFullscreen can only be used with exiting
+ // fullscreen
+ MOZ_ASSERT_IF(
+ mFullscreen.isSome(),
+ mFullscreen.value() != FullscreenReason::ForForceExitFullscreen);
+
+ // If we are already in full screen mode, just return, we don't care about the
+ // reason here, because,
+ // - If we are in fullscreen mode due to browser fullscreen mode, requesting
+ // DOM fullscreen does not change anything.
+ // - If we are in fullscreen mode due to DOM fullscreen, requesting browser
+ // fullscreen should not change anything, either. Note that we should not
+ // update reason to ForFullscreenMode, otherwise the subsequent DOM
+ // fullscreen exit will be ignored and user will be confused. And ideally
+ // this should never happen as `window.fullscreen` returns `true` for DOM
+ // fullscreen as well.
+ if (mFullscreen.isSome() == aFullscreen) {
+ // How come we get browser fullscreen request while we are already in DOM
+ // fullscreen?
+ MOZ_ASSERT_IF(aFullscreen && aReason == FullscreenReason::ForFullscreenMode,
+ mFullscreen.value() != FullscreenReason::ForFullscreenAPI);
+ return NS_OK;
+ }
+
+ // Note that although entering DOM fullscreen could also cause
+ // consequential calls to this method, those calls will be skipped
+ // at the condition above.
+ if (aReason == FullscreenReason::ForFullscreenMode) {
+ if (!aFullscreen && mFullscreen &&
+ mFullscreen.value() == FullscreenReason::ForFullscreenAPI) {
+ // If we are exiting fullscreen mode, but we actually didn't
+ // entered browser fullscreen mode, the fullscreen state was only for
+ // the Fullscreen API. Change the reason here so that we can
+ // perform transition for it.
+ aReason = FullscreenReason::ForFullscreenAPI;
+ }
+ } else {
+ // If we are exiting from DOM fullscreen while we initially make
+ // the window fullscreen because of browser fullscreen mode, don't restore
+ // the window. But we still need to exit the DOM fullscreen state.
+ if (!aFullscreen && mFullscreen &&
+ mFullscreen.value() == FullscreenReason::ForFullscreenMode) {
+ // If there is a in-process fullscreen request, FinishDOMFullscreenChange
+ // will be called when the request is finished.
+ if (!mInProcessFullscreenRequest.isSome()) {
+ FinishDOMFullscreenChange(mDoc, false);
+ }
+ return NS_OK;
+ }
+ }
+
+ // Set this before so if widget sends an event indicating its
+ // gone full screen, the state trap above works.
+ if (aFullscreen) {
+ mFullscreen.emplace(aReason);
+ } else {
+ mFullscreen.reset();
+ }
+
+ // If we are in process of fullscreen request, only keep the latest fullscreen
+ // state, we will sync up later while the processing request is finished.
+ if (mInProcessFullscreenRequest.isSome()) {
+ mFullscreenHasChangedDuringProcessing = true;
+ return NS_OK;
+ }
+
+ return ProcessWidgetFullscreenRequest(aReason, aFullscreen);
+}
+
+// Support a per-window, dynamic equivalent of enabling
+// full-screen-api.ignore-widgets
+void nsGlobalWindowOuter::ForceFullScreenInWidget() {
+ MOZ_DIAGNOSTIC_ASSERT(XRE_IsParentProcess());
+
+ mForceFullScreenInWidget = true;
+}
+
+bool nsGlobalWindowOuter::SetWidgetFullscreen(FullscreenReason aReason,
+ bool aIsFullscreen,
+ nsIWidget* aWidget) {
+ MOZ_ASSERT(this == GetInProcessTopInternal(),
+ "Only topmost window should call this");
+ MOZ_ASSERT(!GetFrameElementInternal(), "Content window should not call this");
+ MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
+
+ if (!NS_WARN_IF(!IsChromeWindow())) {
+ if (!NS_WARN_IF(mChromeFields.mFullscreenPresShell)) {
+ if (PresShell* presShell = mDocShell->GetPresShell()) {
+ if (nsRefreshDriver* rd = presShell->GetRefreshDriver()) {
+ mChromeFields.mFullscreenPresShell = do_GetWeakReference(presShell);
+ MOZ_ASSERT(mChromeFields.mFullscreenPresShell);
+ rd->SetIsResizeSuppressed();
+ rd->Freeze();
+ }
+ }
+ }
+ }
+ nsresult rv = aReason == FullscreenReason::ForFullscreenMode
+ ?
+ // If we enter fullscreen for fullscreen mode, we want
+ // the native system behavior.
+ aWidget->MakeFullScreenWithNativeTransition(aIsFullscreen)
+ : aWidget->MakeFullScreen(aIsFullscreen);
+ return NS_SUCCEEDED(rv);
+}
+
+/* virtual */
+void nsGlobalWindowOuter::FullscreenWillChange(bool aIsFullscreen) {
+ if (!mInProcessFullscreenRequest.isSome()) {
+ // If there is no in-process fullscreen request, the fullscreen state change
+ // is triggered from the OS directly, e.g. user use built-in window button
+ // to enter/exit fullscreen on macOS.
+ mInProcessFullscreenRequest.emplace(FullscreenReason::ForFullscreenMode,
+ aIsFullscreen);
+ if (mFullscreen.isSome() != aIsFullscreen) {
+ if (aIsFullscreen) {
+ mFullscreen.emplace(FullscreenReason::ForFullscreenMode);
+ } else {
+ mFullscreen.reset();
+ }
+ } else {
+ // It is possible that FullscreenWillChange is notified with current
+ // fullscreen state, e.g. browser goes into fullscreen when widget
+ // fullscreen is prevented, and then user triggers fullscreen from the OS
+ // directly again.
+ MOZ_ASSERT(StaticPrefs::full_screen_api_ignore_widgets() ||
+ mForceFullScreenInWidget,
+ "This should only happen when widget fullscreen is prevented");
+ }
+ }
+ if (aIsFullscreen) {
+ DispatchCustomEvent(u"willenterfullscreen"_ns, ChromeOnlyDispatch::eYes);
+ } else {
+ DispatchCustomEvent(u"willexitfullscreen"_ns, ChromeOnlyDispatch::eYes);
+ }
+}
+
+/* virtual */
+void nsGlobalWindowOuter::FinishFullscreenChange(bool aIsFullscreen) {
+ mozilla::Maybe<FullscreenRequest> currentInProcessRequest =
+ std::move(mInProcessFullscreenRequest);
+ if (!mFullscreenHasChangedDuringProcessing &&
+ aIsFullscreen != mFullscreen.isSome()) {
+ NS_WARNING("Failed to toggle fullscreen state of the widget");
+ // We failed to make the widget enter fullscreen.
+ // Stop further changes and restore the state.
+ if (!aIsFullscreen) {
+ mFullscreen.reset();
+ } else {
+#ifndef XP_MACOSX
+ MOZ_ASSERT_UNREACHABLE("Failed to exit fullscreen?");
+#endif
+ // Restore fullscreen state with FullscreenReason::ForFullscreenAPI reason
+ // in order to make subsequent DOM fullscreen exit request can exit
+ // browser fullscreen mode.
+ mFullscreen.emplace(FullscreenReason::ForFullscreenAPI);
+ }
+ return;
+ }
+
+ // Note that we must call this to toggle the DOM fullscreen state
+ // of the document before dispatching the "fullscreen" event, so
+ // that the chrome can distinguish between browser fullscreen mode
+ // and DOM fullscreen.
+ FinishDOMFullscreenChange(mDoc, aIsFullscreen);
+
+ // dispatch a "fullscreen" DOM event so that XUL apps can
+ // respond visually if we are kicked into full screen mode
+ DispatchCustomEvent(u"fullscreen"_ns, ChromeOnlyDispatch::eYes);
+
+ if (!NS_WARN_IF(!IsChromeWindow())) {
+ if (RefPtr<PresShell> presShell =
+ do_QueryReferent(mChromeFields.mFullscreenPresShell)) {
+ if (nsRefreshDriver* rd = presShell->GetRefreshDriver()) {
+ rd->Thaw();
+ }
+ mChromeFields.mFullscreenPresShell = nullptr;
+ }
+ }
+
+ // If fullscreen state has changed during processing fullscreen request, we
+ // need to ensure widget matches our latest fullscreen state here.
+ if (mFullscreenHasChangedDuringProcessing) {
+ mFullscreenHasChangedDuringProcessing = false;
+ // Widget doesn't care about the reason that makes it entering/exiting
+ // fullscreen, so here we just need to ensure the fullscreen state is
+ // matched.
+ if (aIsFullscreen != mFullscreen.isSome()) {
+ // If we end up need to exit fullscreen, use the same reason that brings
+ // us into fullscreen mode, so that we will perform the same fullscreen
+ // transistion effect for exiting.
+ ProcessWidgetFullscreenRequest(
+ mFullscreen.isSome() ? mFullscreen.value()
+ : currentInProcessRequest.value().mReason,
+ mFullscreen.isSome());
+ }
+ }
+}
+
+/* virtual */
+void nsGlobalWindowOuter::MacFullscreenMenubarOverlapChanged(
+ mozilla::DesktopCoord aOverlapAmount) {
+ ErrorResult res;
+ RefPtr<Event> domEvent =
+ mDoc->CreateEvent(u"CustomEvent"_ns, CallerType::System, res);
+ if (res.Failed()) {
+ return;
+ }
+
+ AutoJSAPI jsapi;
+ jsapi.Init();
+ JSContext* cx = jsapi.cx();
+ JSAutoRealm ar(cx, GetWrapperPreserveColor());
+
+ JS::Rooted<JS::Value> detailValue(cx);
+ if (!ToJSValue(cx, aOverlapAmount, &detailValue)) {
+ return;
+ }
+
+ CustomEvent* customEvent = static_cast<CustomEvent*>(domEvent.get());
+ customEvent->InitCustomEvent(cx, u"MacFullscreenMenubarRevealUpdate"_ns,
+ /* aCanBubble = */ true,
+ /* aCancelable = */ true, detailValue);
+ domEvent->SetTrusted(true);
+ domEvent->WidgetEventPtr()->mFlags.mOnlyChromeDispatch = true;
+
+ nsCOMPtr<EventTarget> target = this;
+ domEvent->SetTarget(target);
+
+ target->DispatchEvent(*domEvent, CallerType::System, IgnoreErrors());
+}
+
+bool nsGlobalWindowOuter::Fullscreen() const {
+ NS_ENSURE_TRUE(mDocShell, mFullscreen.isSome());
+
+ // Get the fullscreen value of the root window, to always have the value
+ // accurate, even when called from content.
+ nsCOMPtr<nsIDocShellTreeItem> rootItem;
+ mDocShell->GetInProcessRootTreeItem(getter_AddRefs(rootItem));
+ if (rootItem == mDocShell) {
+ if (!XRE_IsContentProcess()) {
+ // We are the root window. Return our internal value.
+ return mFullscreen.isSome();
+ }
+ if (nsCOMPtr<nsIWidget> widget = GetNearestWidget()) {
+ // We are in content process, figure out the value from
+ // the sizemode of the puppet widget.
+ return widget->SizeMode() == nsSizeMode_Fullscreen;
+ }
+ return false;
+ }
+
+ nsCOMPtr<nsPIDOMWindowOuter> window = rootItem->GetWindow();
+ NS_ENSURE_TRUE(window, mFullscreen.isSome());
+
+ return nsGlobalWindowOuter::Cast(window)->Fullscreen();
+}
+
+bool nsGlobalWindowOuter::GetFullscreenOuter() { return Fullscreen(); }
+
+bool nsGlobalWindowOuter::GetFullScreen() {
+ FORWARD_TO_INNER(GetFullScreen, (), false);
+}
+
+void nsGlobalWindowOuter::EnsureReflowFlushAndPaint() {
+ NS_ASSERTION(mDocShell,
+ "EnsureReflowFlushAndPaint() called with no "
+ "docshell!");
+
+ if (!mDocShell) return;
+
+ RefPtr<PresShell> presShell = mDocShell->GetPresShell();
+ if (!presShell) {
+ return;
+ }
+
+ // Flush pending reflows.
+ if (mDoc) {
+ mDoc->FlushPendingNotifications(FlushType::Layout);
+ }
+
+ // Unsuppress painting.
+ presShell->UnsuppressPainting();
+}
+
+// static
+void nsGlobalWindowOuter::MakeMessageWithPrincipal(
+ nsAString& aOutMessage, nsIPrincipal* aSubjectPrincipal, bool aUseHostPort,
+ const char* aNullMessage, const char* aContentMessage,
+ const char* aFallbackMessage) {
+ MOZ_ASSERT(aSubjectPrincipal);
+
+ aOutMessage.Truncate();
+
+ // Try to get a host from the running principal -- this will do the
+ // right thing for javascript: and data: documents.
+
+ nsAutoCString contentDesc;
+
+ if (aSubjectPrincipal->GetIsNullPrincipal()) {
+ nsContentUtils::GetLocalizedString(
+ nsContentUtils::eCOMMON_DIALOG_PROPERTIES, aNullMessage, aOutMessage);
+ } else {
+ auto* addonPolicy = BasePrincipal::Cast(aSubjectPrincipal)->AddonPolicy();
+ if (addonPolicy) {
+ nsContentUtils::FormatLocalizedString(
+ aOutMessage, nsContentUtils::eCOMMON_DIALOG_PROPERTIES,
+ aContentMessage, addonPolicy->Name());
+ } else {
+ nsresult rv = NS_ERROR_FAILURE;
+ if (aUseHostPort) {
+ nsCOMPtr<nsIURI> uri = aSubjectPrincipal->GetURI();
+ if (uri) {
+ rv = uri->GetDisplayHostPort(contentDesc);
+ }
+ }
+ if (!aUseHostPort || NS_FAILED(rv)) {
+ rv = aSubjectPrincipal->GetExposablePrePath(contentDesc);
+ }
+ if (NS_SUCCEEDED(rv) && !contentDesc.IsEmpty()) {
+ NS_ConvertUTF8toUTF16 ucsPrePath(contentDesc);
+ nsContentUtils::FormatLocalizedString(
+ aOutMessage, nsContentUtils::eCOMMON_DIALOG_PROPERTIES,
+ aContentMessage, ucsPrePath);
+ }
+ }
+ }
+
+ if (aOutMessage.IsEmpty()) {
+ // We didn't find a host so use the generic heading
+ nsContentUtils::GetLocalizedString(
+ nsContentUtils::eCOMMON_DIALOG_PROPERTIES, aFallbackMessage,
+ aOutMessage);
+ }
+
+ // Just in case
+ if (aOutMessage.IsEmpty()) {
+ NS_WARNING(
+ "could not get ScriptDlgGenericHeading string from string bundle");
+ aOutMessage.AssignLiteral("[Script]");
+ }
+}
+
+bool nsGlobalWindowOuter::CanMoveResizeWindows(CallerType aCallerType) {
+ // When called from chrome, we can avoid the following checks.
+ if (aCallerType != CallerType::System) {
+ // Don't allow scripts to move or resize windows that were not opened by a
+ // script.
+ if (!mBrowsingContext->HadOriginalOpener()) {
+ return false;
+ }
+
+ if (!CanSetProperty("dom.disable_window_move_resize")) {
+ return false;
+ }
+
+ // Ignore the request if we have more than one tab in the window.
+ if (mBrowsingContext->Top()->HasSiblings()) {
+ return false;
+ }
+ }
+
+ if (mDocShell) {
+ bool allow;
+ nsresult rv = mDocShell->GetAllowWindowControl(&allow);
+ if (NS_SUCCEEDED(rv) && !allow) return false;
+ }
+
+ if (nsGlobalWindowInner::sMouseDown &&
+ !nsGlobalWindowInner::sDragServiceDisabled) {
+ nsCOMPtr<nsIDragService> ds =
+ do_GetService("@mozilla.org/widget/dragservice;1");
+ if (ds) {
+ nsGlobalWindowInner::sDragServiceDisabled = true;
+ ds->Suppress();
+ }
+ }
+ return true;
+}
+
+bool nsGlobalWindowOuter::AlertOrConfirm(bool aAlert, const nsAString& aMessage,
+ nsIPrincipal& aSubjectPrincipal,
+ ErrorResult& aError) {
+ // XXX This method is very similar to nsGlobalWindowOuter::Prompt, make
+ // sure any modifications here don't need to happen over there!
+ if (!AreDialogsEnabled()) {
+ // Just silently return. In the case of alert(), the return value is
+ // ignored. In the case of confirm(), returning false is the same thing as
+ // would happen if the user cancels.
+ return false;
+ }
+
+ // Reset popup state while opening a modal dialog, and firing events
+ // about the dialog, to prevent the current state from being active
+ // the whole time a modal dialog is open.
+ AutoPopupStatePusher popupStatePusher(PopupBlocker::openAbused, true);
+
+ // Before bringing up the window, unsuppress painting and flush
+ // pending reflows.
+ EnsureReflowFlushAndPaint();
+
+ nsAutoString title;
+ MakeMessageWithPrincipal(title, &aSubjectPrincipal, false,
+ "ScriptDlgNullPrincipalHeading", "ScriptDlgHeading",
+ "ScriptDlgGenericHeading");
+
+ // Remove non-terminating null characters from the
+ // string. See bug #310037.
+ nsAutoString final;
+ nsContentUtils::StripNullChars(aMessage, final);
+ nsContentUtils::PlatformToDOMLineBreaks(final);
+
+ nsresult rv;
+ nsCOMPtr<nsIPromptFactory> promptFac =
+ do_GetService("@mozilla.org/prompter;1", &rv);
+ if (NS_FAILED(rv)) {
+ aError.Throw(rv);
+ return false;
+ }
+
+ nsCOMPtr<nsIPrompt> prompt;
+ aError =
+ promptFac->GetPrompt(this, NS_GET_IID(nsIPrompt), getter_AddRefs(prompt));
+ if (aError.Failed()) {
+ return false;
+ }
+
+ // Always allow content modal prompts for alert and confirm.
+ if (nsCOMPtr<nsIWritablePropertyBag2> promptBag = do_QueryInterface(prompt)) {
+ promptBag->SetPropertyAsUint32(u"modalType"_ns,
+ nsIPrompt::MODAL_TYPE_CONTENT);
+ }
+
+ bool result = false;
+ nsAutoSyncOperation sync(mDoc, SyncOperationBehavior::eSuspendInput);
+ if (ShouldPromptToBlockDialogs()) {
+ bool disallowDialog = false;
+ nsAutoString label;
+ MakeMessageWithPrincipal(
+ label, &aSubjectPrincipal, true, "ScriptDialogLabelNullPrincipal",
+ "ScriptDialogLabelContentPrincipal", "ScriptDialogLabelNullPrincipal");
+
+ aError = aAlert
+ ? prompt->AlertCheck(title.get(), final.get(), label.get(),
+ &disallowDialog)
+ : prompt->ConfirmCheck(title.get(), final.get(), label.get(),
+ &disallowDialog, &result);
+
+ if (disallowDialog) {
+ DisableDialogs();
+ }
+ } else {
+ aError = aAlert ? prompt->Alert(title.get(), final.get())
+ : prompt->Confirm(title.get(), final.get(), &result);
+ }
+
+ return result;
+}
+
+void nsGlobalWindowOuter::AlertOuter(const nsAString& aMessage,
+ nsIPrincipal& aSubjectPrincipal,
+ ErrorResult& aError) {
+ AlertOrConfirm(/* aAlert = */ true, aMessage, aSubjectPrincipal, aError);
+}
+
+bool nsGlobalWindowOuter::ConfirmOuter(const nsAString& aMessage,
+ nsIPrincipal& aSubjectPrincipal,
+ ErrorResult& aError) {
+ return AlertOrConfirm(/* aAlert = */ false, aMessage, aSubjectPrincipal,
+ aError);
+}
+
+void nsGlobalWindowOuter::PromptOuter(const nsAString& aMessage,
+ const nsAString& aInitial,
+ nsAString& aReturn,
+ nsIPrincipal& aSubjectPrincipal,
+ ErrorResult& aError) {
+ // XXX This method is very similar to nsGlobalWindowOuter::AlertOrConfirm,
+ // make sure any modifications here don't need to happen over there!
+ SetDOMStringToNull(aReturn);
+
+ if (!AreDialogsEnabled()) {
+ // Return null, as if the user just canceled the prompt.
+ return;
+ }
+
+ // Reset popup state while opening a modal dialog, and firing events
+ // about the dialog, to prevent the current state from being active
+ // the whole time a modal dialog is open.
+ AutoPopupStatePusher popupStatePusher(PopupBlocker::openAbused, true);
+
+ // Before bringing up the window, unsuppress painting and flush
+ // pending reflows.
+ EnsureReflowFlushAndPaint();
+
+ nsAutoString title;
+ MakeMessageWithPrincipal(title, &aSubjectPrincipal, false,
+ "ScriptDlgNullPrincipalHeading", "ScriptDlgHeading",
+ "ScriptDlgGenericHeading");
+
+ // Remove non-terminating null characters from the
+ // string. See bug #310037.
+ nsAutoString fixedMessage, fixedInitial;
+ nsContentUtils::StripNullChars(aMessage, fixedMessage);
+ nsContentUtils::PlatformToDOMLineBreaks(fixedMessage);
+ nsContentUtils::StripNullChars(aInitial, fixedInitial);
+
+ nsresult rv;
+ nsCOMPtr<nsIPromptFactory> promptFac =
+ do_GetService("@mozilla.org/prompter;1", &rv);
+ if (NS_FAILED(rv)) {
+ aError.Throw(rv);
+ return;
+ }
+
+ nsCOMPtr<nsIPrompt> prompt;
+ aError =
+ promptFac->GetPrompt(this, NS_GET_IID(nsIPrompt), getter_AddRefs(prompt));
+ if (aError.Failed()) {
+ return;
+ }
+
+ // Always allow content modal prompts for prompt.
+ if (nsCOMPtr<nsIWritablePropertyBag2> promptBag = do_QueryInterface(prompt)) {
+ promptBag->SetPropertyAsUint32(u"modalType"_ns,
+ nsIPrompt::MODAL_TYPE_CONTENT);
+ }
+
+ // Pass in the default value, if any.
+ char16_t* inoutValue = ToNewUnicode(fixedInitial);
+ bool disallowDialog = false;
+
+ nsAutoString label;
+ label.SetIsVoid(true);
+ if (ShouldPromptToBlockDialogs()) {
+ nsContentUtils::GetLocalizedString(
+ nsContentUtils::eCOMMON_DIALOG_PROPERTIES, "ScriptDialogLabel", label);
+ }
+
+ nsAutoSyncOperation sync(mDoc, SyncOperationBehavior::eSuspendInput);
+ bool ok;
+ aError = prompt->Prompt(title.get(), fixedMessage.get(), &inoutValue,
+ label.IsVoid() ? nullptr : label.get(),
+ &disallowDialog, &ok);
+
+ if (disallowDialog) {
+ DisableDialogs();
+ }
+
+ // XXX Doesn't this leak inoutValue?
+ if (aError.Failed()) {
+ return;
+ }
+
+ nsString outValue;
+ outValue.Adopt(inoutValue);
+ if (ok && inoutValue) {
+ aReturn = std::move(outValue);
+ }
+}
+
+void nsGlobalWindowOuter::FocusOuter(CallerType aCallerType,
+ bool aFromOtherProcess,
+ uint64_t aActionId) {
+ RefPtr<nsFocusManager> fm = nsFocusManager::GetFocusManager();
+ if (MOZ_UNLIKELY(!fm)) {
+ return;
+ }
+
+ auto [canFocus, isActive] = GetBrowsingContext()->CanFocusCheck(aCallerType);
+ if (aFromOtherProcess) {
+ // We trust that the check passed in a process that's, in principle,
+ // untrusted, because we don't have the required caller context available
+ // here. Also, the worst that the other process can do in this case is to
+ // raise a window it's not supposed to be allowed to raise.
+ // https://bugzilla.mozilla.org/show_bug.cgi?id=1677899
+ MOZ_ASSERT(XRE_IsContentProcess(),
+ "Parent should not trust other processes.");
+ canFocus = true;
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (treeOwnerAsWin && (canFocus || isActive)) {
+ bool isEnabled = true;
+ if (NS_SUCCEEDED(treeOwnerAsWin->GetEnabled(&isEnabled)) && !isEnabled) {
+ NS_WARNING("Should not try to set the focus on a disabled window");
+ return;
+ }
+ }
+
+ if (!mDocShell) {
+ return;
+ }
+
+ // If the window has a child frame focused, clear the focus. This
+ // ensures that focus will be in this frame and not in a child.
+ if (nsIContent* content = GetFocusedElement()) {
+ if (HTMLIFrameElement::FromNode(content)) {
+ fm->ClearFocus(this);
+ }
+ }
+
+ RefPtr<BrowsingContext> parent;
+ BrowsingContext* bc = GetBrowsingContext();
+ if (bc) {
+ parent = bc->GetParent();
+ if (!parent && XRE_IsParentProcess()) {
+ parent = bc->Canonical()->GetParentCrossChromeBoundary();
+ }
+ }
+ if (parent) {
+ if (!parent->IsInProcess()) {
+ if (isActive) {
+ OwningNonNull<nsGlobalWindowOuter> kungFuDeathGrip(*this);
+ fm->WindowRaised(kungFuDeathGrip, aActionId);
+ } else {
+ ContentChild* contentChild = ContentChild::GetSingleton();
+ MOZ_ASSERT(contentChild);
+ contentChild->SendFinalizeFocusOuter(bc, canFocus, aCallerType);
+ }
+ return;
+ }
+
+ MOZ_ASSERT(mDoc, "Call chain should have ensured document creation.");
+ if (mDoc) {
+ if (Element* frame = mDoc->GetEmbedderElement()) {
+ nsContentUtils::RequestFrameFocus(*frame, canFocus, aCallerType);
+ }
+ }
+ return;
+ }
+
+ if (canFocus) {
+ // if there is no parent, this must be a toplevel window, so raise the
+ // window if canFocus is true. If this is a child process, the raise
+ // window request will get forwarded to the parent by the puppet widget.
+ OwningNonNull<nsGlobalWindowOuter> kungFuDeathGrip(*this);
+ fm->RaiseWindow(kungFuDeathGrip, aCallerType, aActionId);
+ }
+}
+
+nsresult nsGlobalWindowOuter::Focus(CallerType aCallerType) {
+ FORWARD_TO_INNER(Focus, (aCallerType), NS_ERROR_UNEXPECTED);
+}
+
+void nsGlobalWindowOuter::BlurOuter(CallerType aCallerType) {
+ if (!GetBrowsingContext()->CanBlurCheck(aCallerType)) {
+ return;
+ }
+
+ nsCOMPtr<nsIWebBrowserChrome> chrome = GetWebBrowserChrome();
+ if (chrome) {
+ chrome->Blur();
+ }
+}
+
+void nsGlobalWindowOuter::StopOuter(ErrorResult& aError) {
+ // IsNavigationAllowed checks are usually done in nsDocShell directly,
+ // however nsDocShell::Stop has a bunch of internal users that would fail
+ // the IsNavigationAllowed check.
+ if (!mDocShell || !nsDocShell::Cast(mDocShell)->IsNavigationAllowed()) {
+ return;
+ }
+
+ nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(mDocShell));
+ if (webNav) {
+ aError = webNav->Stop(nsIWebNavigation::STOP_ALL);
+ }
+}
+
+void nsGlobalWindowOuter::PrintOuter(ErrorResult& aError) {
+ if (!AreDialogsEnabled()) {
+ // Per spec, silently return. https://github.com/whatwg/html/commit/21a1de1
+ return;
+ }
+
+ // Printing is disabled, silently return.
+ if (!StaticPrefs::print_enabled()) {
+ return;
+ }
+
+ // If we're loading, queue the print for later. This is a special-case that
+ // only applies to the window.print() call, for compat with other engines and
+ // pre-existing behavior.
+ if (mShouldDelayPrintUntilAfterLoad) {
+ if (nsIDocShell* docShell = GetDocShell()) {
+ if (docShell->GetBusyFlags() & nsIDocShell::BUSY_FLAGS_PAGE_LOADING) {
+ mDelayedPrintUntilAfterLoad = true;
+ return;
+ }
+ }
+ }
+
+#ifdef NS_PRINTING
+ RefPtr<BrowsingContext> top =
+ mBrowsingContext ? mBrowsingContext->Top() : nullptr;
+ if (NS_WARN_IF(top && top->GetIsPrinting())) {
+ return;
+ }
+
+ if (top) {
+ Unused << top->SetIsPrinting(true);
+ }
+
+ auto unset = MakeScopeExit([&] {
+ if (top) {
+ Unused << top->SetIsPrinting(false);
+ }
+ });
+
+ const bool forPreview = !StaticPrefs::print_always_print_silent();
+ Print(nullptr, nullptr, nullptr, nullptr, IsPreview(forPreview),
+ IsForWindowDotPrint::Yes, nullptr, aError);
+#endif
+}
+
+class MOZ_RAII AutoModalState {
+ public:
+ explicit AutoModalState(nsGlobalWindowOuter& aWin)
+ : mModalStateWin(aWin.EnterModalState()) {}
+
+ ~AutoModalState() {
+ if (mModalStateWin) {
+ mModalStateWin->LeaveModalState();
+ }
+ }
+
+ RefPtr<nsGlobalWindowOuter> mModalStateWin;
+};
+
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::Print(
+ nsIPrintSettings* aPrintSettings, RemotePrintJobChild* aRemotePrintJob,
+ nsIWebProgressListener* aListener, nsIDocShell* aDocShellToCloneInto,
+ IsPreview aIsPreview, IsForWindowDotPrint aForWindowDotPrint,
+ PrintPreviewResolver&& aPrintPreviewCallback, ErrorResult& aError) {
+#ifdef NS_PRINTING
+ nsCOMPtr<nsIPrintSettingsService> printSettingsService =
+ do_GetService("@mozilla.org/gfx/printsettings-service;1");
+ if (!printSettingsService) {
+ // we currently return here in headless mode - should we?
+ aError.ThrowNotSupportedError("No print settings service");
+ return nullptr;
+ }
+
+ nsCOMPtr<nsIPrintSettings> ps = aPrintSettings;
+ if (!ps) {
+ // We shouldn't need this once bug 1776169 is fixed.
+ printSettingsService->GetDefaultPrintSettingsForPrinting(
+ getter_AddRefs(ps));
+ }
+
+ RefPtr<Document> docToPrint = mDoc;
+ if (NS_WARN_IF(!docToPrint)) {
+ aError.ThrowNotSupportedError("Document is gone");
+ return nullptr;
+ }
+
+ RefPtr<BrowsingContext> sourceBC = docToPrint->GetBrowsingContext();
+ MOZ_DIAGNOSTIC_ASSERT(sourceBC);
+ if (!sourceBC) {
+ aError.ThrowNotSupportedError("No browsing context for source document");
+ return nullptr;
+ }
+
+ nsAutoSyncOperation sync(docToPrint, SyncOperationBehavior::eAllowInput);
+ AutoModalState modalState(*this);
+
+ nsCOMPtr<nsIContentViewer> cv;
+ RefPtr<BrowsingContext> bc;
+ bool hasPrintCallbacks = false;
+ if (docToPrint->IsStaticDocument()) {
+ if (aForWindowDotPrint == IsForWindowDotPrint::Yes) {
+ aError.ThrowNotSupportedError(
+ "Calling print() from a print preview is unsupported, did you intend "
+ "to call printPreview() instead?");
+ return nullptr;
+ }
+ // We're already a print preview window, just reuse our browsing context /
+ // content viewer.
+ bc = sourceBC;
+ nsCOMPtr<nsIDocShell> docShell = bc->GetDocShell();
+ if (!docShell) {
+ aError.ThrowNotSupportedError("No docshell");
+ return nullptr;
+ }
+ // We could handle this if needed.
+ if (aDocShellToCloneInto && aDocShellToCloneInto != docShell) {
+ aError.ThrowNotSupportedError(
+ "We don't handle cloning a print preview doc into a different "
+ "docshell");
+ return nullptr;
+ }
+ docShell->GetContentViewer(getter_AddRefs(cv));
+ MOZ_DIAGNOSTIC_ASSERT(cv);
+ } else {
+ if (aDocShellToCloneInto) {
+ // Ensure the content viewer is created if needed.
+ Unused << aDocShellToCloneInto->GetDocument();
+ bc = aDocShellToCloneInto->GetBrowsingContext();
+ } else {
+ AutoNoJSAPI nojsapi;
+ auto printKind = aForWindowDotPrint == IsForWindowDotPrint::Yes
+ ? PrintKind::WindowDotPrint
+ : PrintKind::InternalPrint;
+ // For PrintKind::WindowDotPrint, this call will not only make the parent
+ // process create a CanonicalBrowsingContext for the returned `bc`, but
+ // it will also make the parent process initiate the print/print preview.
+ // See the handling of OPEN_PRINT_BROWSER in browser.js.
+ aError = OpenInternal(u""_ns, u""_ns, u""_ns,
+ false, // aDialog
+ false, // aContentModal
+ true, // aCalledNoScript
+ false, // aDoJSFixups
+ true, // aNavigate
+ nullptr, nullptr, // No args
+ nullptr, // aLoadState
+ false, // aForceNoOpener
+ printKind, getter_AddRefs(bc));
+ if (NS_WARN_IF(aError.Failed())) {
+ return nullptr;
+ }
+ }
+ if (!bc) {
+ aError.ThrowNotAllowedError("No browsing context");
+ return nullptr;
+ }
+
+ Unused << bc->Top()->SetIsPrinting(true);
+ nsCOMPtr<nsIDocShell> cloneDocShell = bc->GetDocShell();
+ MOZ_DIAGNOSTIC_ASSERT(cloneDocShell);
+ cloneDocShell->GetContentViewer(getter_AddRefs(cv));
+ MOZ_DIAGNOSTIC_ASSERT(cv);
+ if (!cv) {
+ aError.ThrowNotSupportedError("Didn't end up with a content viewer");
+ return nullptr;
+ }
+
+ if (bc != sourceBC) {
+ MOZ_ASSERT(bc->IsTopContent());
+ // If we are cloning from a document in a different BrowsingContext, we
+ // need to make sure to copy over our opener policy information from that
+ // BrowsingContext. In the case where the source is an iframe, this
+ // information needs to be copied from the toplevel source
+ // BrowsingContext, as we may be making a static clone of a single
+ // subframe.
+ MOZ_ALWAYS_SUCCEEDS(
+ bc->SetOpenerPolicy(sourceBC->Top()->GetOpenerPolicy()));
+ MOZ_DIAGNOSTIC_ASSERT(bc->Group() == sourceBC->Group());
+ }
+
+ if (RefPtr<Document> doc = cv->GetDocument()) {
+ if (doc->IsShowing()) {
+ // We're going to drop this document on the floor, in the SetDocument
+ // call below. Make sure to run OnPageHide() to keep state consistent
+ // and avoids assertions in the document destructor.
+ doc->OnPageHide(false, nullptr);
+ }
+ }
+
+ AutoPrintEventDispatcher dispatcher(*docToPrint);
+
+ nsAutoScriptBlocker blockScripts;
+ RefPtr<Document> clone = docToPrint->CreateStaticClone(
+ cloneDocShell, cv, ps, &hasPrintCallbacks);
+ if (!clone) {
+ aError.ThrowNotSupportedError("Clone operation for printing failed");
+ return nullptr;
+ }
+ }
+
+ nsCOMPtr<nsIWebBrowserPrint> webBrowserPrint = do_QueryInterface(cv);
+ if (!webBrowserPrint) {
+ aError.ThrowNotSupportedError(
+ "Content viewer didn't implement nsIWebBrowserPrint");
+ return nullptr;
+ }
+
+ // For window.print(), we postpone making these calls until the round-trip to
+ // the parent process (triggered by the OpenInternal call above) calls us
+ // again. Only a call from the parent can provide a valid nsPrintSettings
+ // object and RemotePrintJobChild object.
+ if (aForWindowDotPrint == IsForWindowDotPrint::No) {
+ if (aIsPreview == IsPreview::Yes) {
+ aError = webBrowserPrint->PrintPreview(ps, aListener,
+ std::move(aPrintPreviewCallback));
+ if (aError.Failed()) {
+ return nullptr;
+ }
+ } else {
+ // Historically we've eaten this error.
+ webBrowserPrint->Print(ps, aRemotePrintJob, aListener);
+ }
+ }
+
+ // When using window.print() with the new UI, we usually want to block until
+ // the print dialog is hidden. But we can't really do that if we have print
+ // callbacks, because we are inside a sync operation, and we want to run
+ // microtasks / etc that the print callbacks may create. It is really awkward
+ // to have this subtle behavior difference...
+ //
+ // We also want to do this for fuzzing, so that they can test window.print().
+ const bool shouldBlock = [&] {
+ if (aForWindowDotPrint == IsForWindowDotPrint::No) {
+ return false;
+ }
+ if (aIsPreview == IsPreview::Yes) {
+ return !hasPrintCallbacks;
+ }
+ return StaticPrefs::dom_window_print_fuzzing_block_while_printing();
+ }();
+
+ if (shouldBlock) {
+ SpinEventLoopUntil("nsGlobalWindowOuter::Print"_ns,
+ [&] { return bc->IsDiscarded(); });
+ }
+
+ return WindowProxyHolder(std::move(bc));
+#else
+ return nullptr;
+#endif // NS_PRINTING
+}
+
+void nsGlobalWindowOuter::MoveToOuter(int32_t aXPos, int32_t aYPos,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ /*
+ * If caller is not chrome and the user has not explicitly exempted the site,
+ * prevent window.moveTo() by exiting early
+ */
+
+ if (!CanMoveResizeWindows(aCallerType) || mBrowsingContext->IsSubframe()) {
+ return;
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ // We need to do the same transformation GetScreenXY does.
+ RefPtr<nsPresContext> presContext = mDocShell->GetPresContext();
+ if (!presContext) {
+ return;
+ }
+
+ CSSIntPoint cssPos(aXPos, aYPos);
+ CheckSecurityLeftAndTop(&cssPos.x.value, &cssPos.y.value, aCallerType);
+
+ nsDeviceContext* context = presContext->DeviceContext();
+
+ auto devPos = LayoutDeviceIntPoint::FromAppUnitsRounded(
+ CSSIntPoint::ToAppUnits(cssPos), context->AppUnitsPerDevPixel());
+
+ aError = treeOwnerAsWin->SetPosition(devPos.x, devPos.y);
+ CheckForDPIChange();
+}
+
+void nsGlobalWindowOuter::MoveByOuter(int32_t aXDif, int32_t aYDif,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ /*
+ * If caller is not chrome and the user has not explicitly exempted the site,
+ * prevent window.moveBy() by exiting early
+ */
+
+ if (!CanMoveResizeWindows(aCallerType) || mBrowsingContext->IsSubframe()) {
+ return;
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ // To do this correctly we have to convert what we get from GetPosition
+ // into CSS pixels, add the arguments, do the security check, and
+ // then convert back to device pixels for the call to SetPosition.
+
+ int32_t x, y;
+ aError = treeOwnerAsWin->GetPosition(&x, &y);
+ if (aError.Failed()) {
+ return;
+ }
+
+ auto cssScale = CSSToDevScaleForBaseWindow(treeOwnerAsWin);
+ CSSIntPoint cssPos = RoundedToInt(treeOwnerAsWin->GetPosition() / cssScale);
+
+ cssPos.x += aXDif;
+ cssPos.y += aYDif;
+
+ CheckSecurityLeftAndTop(&cssPos.x.value, &cssPos.y.value, aCallerType);
+
+ LayoutDeviceIntPoint newDevPos = RoundedToInt(cssPos * cssScale);
+ aError = treeOwnerAsWin->SetPosition(newDevPos.x, newDevPos.y);
+
+ CheckForDPIChange();
+}
+
+nsresult nsGlobalWindowOuter::MoveBy(int32_t aXDif, int32_t aYDif) {
+ ErrorResult rv;
+ MoveByOuter(aXDif, aYDif, CallerType::System, rv);
+
+ return rv.StealNSResult();
+}
+
+void nsGlobalWindowOuter::ResizeToOuter(int32_t aWidth, int32_t aHeight,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ /*
+ * If caller is not chrome and the user has not explicitly exempted the site,
+ * prevent window.resizeTo() by exiting early
+ */
+
+ if (!CanMoveResizeWindows(aCallerType) || mBrowsingContext->IsSubframe()) {
+ return;
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ CSSIntSize cssSize(aWidth, aHeight);
+ CheckSecurityWidthAndHeight(&cssSize.width, &cssSize.height, aCallerType);
+
+ LayoutDeviceIntSize devSize =
+ RoundedToInt(cssSize * CSSToDevScaleForBaseWindow(treeOwnerAsWin));
+ aError = treeOwnerAsWin->SetSize(devSize.width, devSize.height, true);
+
+ CheckForDPIChange();
+}
+
+void nsGlobalWindowOuter::ResizeByOuter(int32_t aWidthDif, int32_t aHeightDif,
+ CallerType aCallerType,
+ ErrorResult& aError) {
+ /*
+ * If caller is not chrome and the user has not explicitly exempted the site,
+ * prevent window.resizeBy() by exiting early
+ */
+
+ if (!CanMoveResizeWindows(aCallerType) || mBrowsingContext->IsSubframe()) {
+ return;
+ }
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ LayoutDeviceIntSize size = treeOwnerAsWin->GetSize();
+
+ // To do this correctly we have to convert what we got from GetSize
+ // into CSS pixels, add the arguments, do the security check, and
+ // then convert back to device pixels for the call to SetSize.
+
+ auto scale = CSSToDevScaleForBaseWindow(treeOwnerAsWin);
+ CSSIntSize cssSize = RoundedToInt(size / scale);
+
+ cssSize.width += aWidthDif;
+ cssSize.height += aHeightDif;
+
+ CheckSecurityWidthAndHeight(&cssSize.width, &cssSize.height, aCallerType);
+
+ LayoutDeviceIntSize newDevSize = RoundedToInt(cssSize * scale);
+
+ aError = treeOwnerAsWin->SetSize(newDevSize.width, newDevSize.height, true);
+
+ CheckForDPIChange();
+}
+
+void nsGlobalWindowOuter::SizeToContentOuter(
+ CallerType aCallerType, const SizeToContentConstraints& aConstraints,
+ ErrorResult& aError) {
+ if (!mDocShell) {
+ return;
+ }
+
+ /*
+ * If caller is not chrome and the user has not explicitly exempted the site,
+ * prevent window.sizeToContent() by exiting early
+ */
+
+ if (!CanMoveResizeWindows(aCallerType) || mBrowsingContext->IsSubframe()) {
+ return;
+ }
+
+ // The content viewer does a check to make sure that it's a content
+ // viewer for a toplevel docshell.
+ nsCOMPtr<nsIContentViewer> cv;
+ mDocShell->GetContentViewer(getter_AddRefs(cv));
+ if (!cv) {
+ return aError.Throw(NS_ERROR_FAILURE);
+ }
+
+ auto contentSize = cv->GetContentSize(
+ aConstraints.mMaxWidth, aConstraints.mMaxHeight, aConstraints.mPrefWidth);
+ if (!contentSize) {
+ return aError.Throw(NS_ERROR_FAILURE);
+ }
+
+ // Make sure the new size is following the CheckSecurityWidthAndHeight
+ // rules.
+ nsCOMPtr<nsIDocShellTreeOwner> treeOwner = GetTreeOwner();
+ if (!treeOwner) {
+ return aError.Throw(NS_ERROR_FAILURE);
+ }
+
+ // Don't use DevToCSSIntPixelsForBaseWindow() nor
+ // CSSToDevIntPixelsForBaseWindow() here because contentSize is comes from
+ // nsIContentViewer::GetContentSize() and it's computed with nsPresContext so
+ // that we need to work with nsPresContext here too.
+ RefPtr<nsPresContext> presContext = cv->GetPresContext();
+ MOZ_ASSERT(
+ presContext,
+ "Should be non-nullptr if nsIContentViewer::GetContentSize() succeeded");
+ CSSIntSize cssSize = *contentSize;
+ CheckSecurityWidthAndHeight(&cssSize.width, &cssSize.height, aCallerType);
+
+ LayoutDeviceIntSize newDevSize(
+ presContext->CSSPixelsToDevPixels(cssSize.width),
+ presContext->CSSPixelsToDevPixels(cssSize.height));
+
+ nsCOMPtr<nsIDocShell> docShell = mDocShell;
+ aError =
+ treeOwner->SizeShellTo(docShell, newDevSize.width, newDevSize.height);
+}
+
+already_AddRefed<nsPIWindowRoot> nsGlobalWindowOuter::GetTopWindowRoot() {
+ nsPIDOMWindowOuter* piWin = GetPrivateRoot();
+ if (!piWin) {
+ return nullptr;
+ }
+
+ nsCOMPtr<nsPIWindowRoot> window =
+ do_QueryInterface(piWin->GetChromeEventHandler());
+ return window.forget();
+}
+
+void nsGlobalWindowOuter::FirePopupBlockedEvent(
+ Document* aDoc, nsIURI* aPopupURI, const nsAString& aPopupWindowName,
+ const nsAString& aPopupWindowFeatures) {
+ MOZ_ASSERT(aDoc);
+
+ // Fire a "DOMPopupBlocked" event so that the UI can hear about
+ // blocked popups.
+ PopupBlockedEventInit init;
+ init.mBubbles = true;
+ init.mCancelable = true;
+ // XXX: This is a different object, but webidl requires an inner window here
+ // now.
+ init.mRequestingWindow = GetCurrentInnerWindowInternal();
+ init.mPopupWindowURI = aPopupURI;
+ init.mPopupWindowName = aPopupWindowName;
+ init.mPopupWindowFeatures = aPopupWindowFeatures;
+
+ RefPtr<PopupBlockedEvent> event =
+ PopupBlockedEvent::Constructor(aDoc, u"DOMPopupBlocked"_ns, init);
+
+ event->SetTrusted(true);
+
+ aDoc->DispatchEvent(*event);
+}
+
+// static
+bool nsGlobalWindowOuter::CanSetProperty(const char* aPrefName) {
+ // Chrome can set any property.
+ if (nsContentUtils::LegacyIsCallerChromeOrNativeCode()) {
+ return true;
+ }
+
+ // If the pref is set to true, we can not set the property
+ // and vice versa.
+ return !Preferences::GetBool(aPrefName, true);
+}
+
+/* If a window open is blocked, fire the appropriate DOM events. */
+void nsGlobalWindowOuter::FireAbuseEvents(
+ const nsAString& aPopupURL, const nsAString& aPopupWindowName,
+ const nsAString& aPopupWindowFeatures) {
+ // fetch the URI of the window requesting the opened window
+ nsCOMPtr<Document> currentDoc = GetDoc();
+ nsCOMPtr<nsIURI> popupURI;
+
+ // build the URI of the would-have-been popup window
+ // (see nsWindowWatcher::URIfromURL)
+
+ // first, fetch the opener's base URI
+
+ nsIURI* baseURL = nullptr;
+
+ nsCOMPtr<Document> doc = GetEntryDocument();
+ if (doc) baseURL = doc->GetDocBaseURI();
+
+ // use the base URI to build what would have been the popup's URI
+ nsCOMPtr<nsIIOService> ios(do_GetService(NS_IOSERVICE_CONTRACTID));
+ if (ios)
+ ios->NewURI(NS_ConvertUTF16toUTF8(aPopupURL), nullptr, baseURL,
+ getter_AddRefs(popupURI));
+
+ // fire an event block full of informative URIs
+ FirePopupBlockedEvent(currentDoc, popupURI, aPopupWindowName,
+ aPopupWindowFeatures);
+}
+
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::OpenOuter(
+ const nsAString& aUrl, const nsAString& aName, const nsAString& aOptions,
+ ErrorResult& aError) {
+ RefPtr<BrowsingContext> bc;
+ nsresult rv = OpenJS(aUrl, aName, aOptions, getter_AddRefs(bc));
+ if (rv == NS_ERROR_MALFORMED_URI) {
+ aError.ThrowSyntaxError("Unable to open a window with invalid URL '"_ns +
+ NS_ConvertUTF16toUTF8(aUrl) + "'."_ns);
+ return nullptr;
+ }
+
+ // XXX Is it possible that some internal errors are thrown here?
+ aError = rv;
+
+ if (!bc) {
+ return nullptr;
+ }
+ return WindowProxyHolder(std::move(bc));
+}
+
+nsresult nsGlobalWindowOuter::Open(const nsAString& aUrl,
+ const nsAString& aName,
+ const nsAString& aOptions,
+ nsDocShellLoadState* aLoadState,
+ bool aForceNoOpener,
+ BrowsingContext** _retval) {
+ return OpenInternal(aUrl, aName, aOptions,
+ false, // aDialog
+ false, // aContentModal
+ true, // aCalledNoScript
+ false, // aDoJSFixups
+ true, // aNavigate
+ nullptr, nullptr, // No args
+ aLoadState, aForceNoOpener, PrintKind::None, _retval);
+}
+
+nsresult nsGlobalWindowOuter::OpenJS(const nsAString& aUrl,
+ const nsAString& aName,
+ const nsAString& aOptions,
+ BrowsingContext** _retval) {
+ return OpenInternal(aUrl, aName, aOptions,
+ false, // aDialog
+ false, // aContentModal
+ false, // aCalledNoScript
+ true, // aDoJSFixups
+ true, // aNavigate
+ nullptr, nullptr, // No args
+ nullptr, // aLoadState
+ false, // aForceNoOpener
+ PrintKind::None, _retval);
+}
+
+// like Open, but attaches to the new window any extra parameters past
+// [features] as a JS property named "arguments"
+nsresult nsGlobalWindowOuter::OpenDialog(const nsAString& aUrl,
+ const nsAString& aName,
+ const nsAString& aOptions,
+ nsISupports* aExtraArgument,
+ BrowsingContext** _retval) {
+ return OpenInternal(aUrl, aName, aOptions,
+ true, // aDialog
+ false, // aContentModal
+ true, // aCalledNoScript
+ false, // aDoJSFixups
+ true, // aNavigate
+ nullptr, aExtraArgument, // Arguments
+ nullptr, // aLoadState
+ false, // aForceNoOpener
+ PrintKind::None, _retval);
+}
+
+// Like Open, but passes aNavigate=false.
+/* virtual */
+nsresult nsGlobalWindowOuter::OpenNoNavigate(const nsAString& aUrl,
+ const nsAString& aName,
+ const nsAString& aOptions,
+ BrowsingContext** _retval) {
+ return OpenInternal(aUrl, aName, aOptions,
+ false, // aDialog
+ false, // aContentModal
+ true, // aCalledNoScript
+ false, // aDoJSFixups
+ false, // aNavigate
+ nullptr, nullptr, // No args
+ nullptr, // aLoadState
+ false, // aForceNoOpener
+ PrintKind::None, _retval);
+}
+
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::OpenDialogOuter(
+ JSContext* aCx, const nsAString& aUrl, const nsAString& aName,
+ const nsAString& aOptions, const Sequence<JS::Value>& aExtraArgument,
+ ErrorResult& aError) {
+ nsCOMPtr<nsIJSArgArray> argvArray;
+ aError =
+ NS_CreateJSArgv(aCx, aExtraArgument.Length(), aExtraArgument.Elements(),
+ getter_AddRefs(argvArray));
+ if (aError.Failed()) {
+ return nullptr;
+ }
+
+ RefPtr<BrowsingContext> dialog;
+ aError = OpenInternal(aUrl, aName, aOptions,
+ true, // aDialog
+ false, // aContentModal
+ false, // aCalledNoScript
+ false, // aDoJSFixups
+ true, // aNavigate
+ argvArray, nullptr, // Arguments
+ nullptr, // aLoadState
+ false, // aForceNoOpener
+ PrintKind::None, getter_AddRefs(dialog));
+ if (!dialog) {
+ return nullptr;
+ }
+ return WindowProxyHolder(std::move(dialog));
+}
+
+WindowProxyHolder nsGlobalWindowOuter::GetFramesOuter() {
+ RefPtr<nsPIDOMWindowOuter> frames(this);
+ FlushPendingNotifications(FlushType::ContentAndNotify);
+ return WindowProxyHolder(mBrowsingContext);
+}
+
+/* static */
+bool nsGlobalWindowOuter::GatherPostMessageData(
+ JSContext* aCx, const nsAString& aTargetOrigin, BrowsingContext** aSource,
+ nsAString& aOrigin, nsIURI** aTargetOriginURI,
+ nsIPrincipal** aCallerPrincipal, nsGlobalWindowInner** aCallerInnerWindow,
+ nsIURI** aCallerURI, Maybe<nsID>* aCallerAgentClusterId,
+ nsACString* aScriptLocation, ErrorResult& aError) {
+ //
+ // Window.postMessage is an intentional subversion of the same-origin policy.
+ // As such, this code must be particularly careful in the information it
+ // exposes to calling code.
+ //
+ // http://www.whatwg.org/specs/web-apps/current-work/multipage/section-crossDocumentMessages.html
+ //
+
+ // First, get the caller's window
+ RefPtr<nsGlobalWindowInner> callerInnerWin =
+ nsContentUtils::IncumbentInnerWindow();
+ nsIPrincipal* callerPrin;
+ if (callerInnerWin) {
+ RefPtr<Document> doc = callerInnerWin->GetExtantDoc();
+ if (!doc) {
+ return false;
+ }
+ NS_IF_ADDREF(*aCallerURI = doc->GetDocumentURI());
+
+ // Compute the caller's origin either from its principal or, in the case the
+ // principal doesn't carry a URI (e.g. the system principal), the caller's
+ // document. We must get this now instead of when the event is created and
+ // dispatched, because ultimately it is the identity of the calling window
+ // *now* that determines who sent the message (and not an identity which
+ // might have changed due to intervening navigations).
+ callerPrin = callerInnerWin->GetPrincipal();
+ } else {
+ // In case the global is not a window, it can be a sandbox, and the
+ // sandbox's principal can be used for the security check.
+ nsIGlobalObject* global = GetIncumbentGlobal();
+ NS_ASSERTION(global, "Why is there no global object?");
+ callerPrin = global->PrincipalOrNull();
+ if (callerPrin) {
+ BasePrincipal::Cast(callerPrin)->GetScriptLocation(*aScriptLocation);
+ }
+ }
+ if (!callerPrin) {
+ return false;
+ }
+
+ // if the principal has a URI, use that to generate the origin
+ if (!callerPrin->IsSystemPrincipal()) {
+ nsAutoCString asciiOrigin;
+ callerPrin->GetAsciiOrigin(asciiOrigin);
+ CopyUTF8toUTF16(asciiOrigin, aOrigin);
+ } else if (callerInnerWin) {
+ if (!*aCallerURI) {
+ return false;
+ }
+ // otherwise use the URI of the document to generate origin
+ nsContentUtils::GetUTFOrigin(*aCallerURI, aOrigin);
+ } else {
+ // in case of a sandbox with a system principal origin can be empty
+ if (!callerPrin->IsSystemPrincipal()) {
+ return false;
+ }
+ }
+ NS_IF_ADDREF(*aCallerPrincipal = callerPrin);
+
+ // "/" indicates same origin as caller, "*" indicates no specific origin is
+ // required.
+ if (!aTargetOrigin.EqualsASCII("/") && !aTargetOrigin.EqualsASCII("*")) {
+ nsCOMPtr<nsIURI> targetOriginURI;
+ if (NS_FAILED(NS_NewURI(getter_AddRefs(targetOriginURI), aTargetOrigin))) {
+ aError.Throw(NS_ERROR_DOM_SYNTAX_ERR);
+ return false;
+ }
+
+ nsresult rv = NS_MutateURI(targetOriginURI)
+ .SetUserPass(""_ns)
+ .SetPathQueryRef(""_ns)
+ .Finalize(aTargetOriginURI);
+ if (NS_FAILED(rv)) {
+ return false;
+ }
+ }
+
+ if (!nsContentUtils::IsCallerChrome() && callerInnerWin &&
+ callerInnerWin->GetOuterWindowInternal()) {
+ NS_ADDREF(*aSource = callerInnerWin->GetOuterWindowInternal()
+ ->GetBrowsingContext());
+ } else {
+ *aSource = nullptr;
+ }
+
+ if (aCallerAgentClusterId && callerInnerWin &&
+ callerInnerWin->GetDocGroup()) {
+ *aCallerAgentClusterId =
+ Some(callerInnerWin->GetDocGroup()->AgentClusterId());
+ }
+
+ callerInnerWin.forget(aCallerInnerWindow);
+
+ return true;
+}
+
+bool nsGlobalWindowOuter::GetPrincipalForPostMessage(
+ const nsAString& aTargetOrigin, nsIURI* aTargetOriginURI,
+ nsIPrincipal* aCallerPrincipal, nsIPrincipal& aSubjectPrincipal,
+ nsIPrincipal** aProvidedPrincipal) {
+ //
+ // Window.postMessage is an intentional subversion of the same-origin policy.
+ // As such, this code must be particularly careful in the information it
+ // exposes to calling code.
+ //
+ // http://www.whatwg.org/specs/web-apps/current-work/multipage/section-crossDocumentMessages.html
+ //
+
+ // Convert the provided origin string into a URI for comparison purposes.
+ nsCOMPtr<nsIPrincipal> providedPrincipal;
+
+ if (aTargetOrigin.EqualsASCII("/")) {
+ providedPrincipal = aCallerPrincipal;
+ }
+ // "*" indicates no specific origin is required.
+ else if (!aTargetOrigin.EqualsASCII("*")) {
+ OriginAttributes attrs = aSubjectPrincipal.OriginAttributesRef();
+ if (aSubjectPrincipal.IsSystemPrincipal()) {
+ auto principal = BasePrincipal::Cast(GetPrincipal());
+
+ if (attrs != principal->OriginAttributesRef()) {
+ nsAutoCString targetURL;
+ nsAutoCString sourceOrigin;
+ nsAutoCString targetOrigin;
+
+ if (NS_FAILED(principal->GetAsciiSpec(targetURL)) ||
+ NS_FAILED(principal->GetOrigin(targetOrigin)) ||
+ NS_FAILED(aSubjectPrincipal.GetOrigin(sourceOrigin))) {
+ NS_WARNING("Failed to get source and target origins");
+ return false;
+ }
+
+ nsContentUtils::LogSimpleConsoleError(
+ NS_ConvertUTF8toUTF16(nsPrintfCString(
+ R"(Attempting to post a message to window with url "%s" and )"
+ R"(origin "%s" from a system principal scope with mismatched )"
+ R"(origin "%s".)",
+ targetURL.get(), targetOrigin.get(), sourceOrigin.get())),
+ "DOM"_ns, !!principal->PrivateBrowsingId(),
+ principal->IsSystemPrincipal());
+
+ attrs = principal->OriginAttributesRef();
+ }
+ }
+
+ // Create a nsIPrincipal inheriting the app/browser attributes from the
+ // caller.
+ providedPrincipal =
+ BasePrincipal::CreateContentPrincipal(aTargetOriginURI, attrs);
+ if (NS_WARN_IF(!providedPrincipal)) {
+ return false;
+ }
+ } else {
+ // We still need to check the originAttributes if the target origin is '*'.
+ // But we will ingore the FPD here since the FPDs are possible to be
+ // different.
+ auto principal = BasePrincipal::Cast(GetPrincipal());
+ NS_ENSURE_TRUE(principal, false);
+
+ OriginAttributes targetAttrs = principal->OriginAttributesRef();
+ OriginAttributes sourceAttrs = aSubjectPrincipal.OriginAttributesRef();
+ // We have to exempt the check of OA if the subject prioncipal is a system
+ // principal since there are many tests try to post messages to content from
+ // chrome with a mismatch OA. For example, using the ContentTask.spawn() to
+ // post a message into a private browsing window. The injected code in
+ // ContentTask.spawn() will be executed under the system principal and the
+ // OA of the system principal mismatches with the OA of a private browsing
+ // window.
+ MOZ_DIAGNOSTIC_ASSERT(aSubjectPrincipal.IsSystemPrincipal() ||
+ sourceAttrs.EqualsIgnoringFPD(targetAttrs));
+
+ // If 'privacy.firstparty.isolate.block_post_message' is true, we will block
+ // postMessage across different first party domains.
+ if (OriginAttributes::IsBlockPostMessageForFPI() &&
+ !aSubjectPrincipal.IsSystemPrincipal() &&
+ sourceAttrs.mFirstPartyDomain != targetAttrs.mFirstPartyDomain) {
+ return false;
+ }
+ }
+
+ providedPrincipal.forget(aProvidedPrincipal);
+ return true;
+}
+
+void nsGlobalWindowOuter::PostMessageMozOuter(JSContext* aCx,
+ JS::Handle<JS::Value> aMessage,
+ const nsAString& aTargetOrigin,
+ JS::Handle<JS::Value> aTransfer,
+ nsIPrincipal& aSubjectPrincipal,
+ ErrorResult& aError) {
+ RefPtr<BrowsingContext> sourceBc;
+ nsAutoString origin;
+ nsCOMPtr<nsIURI> targetOriginURI;
+ nsCOMPtr<nsIPrincipal> callerPrincipal;
+ RefPtr<nsGlobalWindowInner> callerInnerWindow;
+ nsCOMPtr<nsIURI> callerURI;
+ Maybe<nsID> callerAgentClusterId = Nothing();
+ nsAutoCString scriptLocation;
+ if (!GatherPostMessageData(
+ aCx, aTargetOrigin, getter_AddRefs(sourceBc), origin,
+ getter_AddRefs(targetOriginURI), getter_AddRefs(callerPrincipal),
+ getter_AddRefs(callerInnerWindow), getter_AddRefs(callerURI),
+ &callerAgentClusterId, &scriptLocation, aError)) {
+ return;
+ }
+
+ nsCOMPtr<nsIPrincipal> providedPrincipal;
+ if (!GetPrincipalForPostMessage(aTargetOrigin, targetOriginURI,
+ callerPrincipal, aSubjectPrincipal,
+ getter_AddRefs(providedPrincipal))) {
+ return;
+ }
+
+ // Create and asynchronously dispatch a runnable which will handle actual DOM
+ // event creation and dispatch.
+ RefPtr<PostMessageEvent> event = new PostMessageEvent(
+ sourceBc, origin, this, providedPrincipal,
+ callerInnerWindow ? callerInnerWindow->WindowID() : 0, callerURI,
+ scriptLocation, callerAgentClusterId);
+
+ JS::CloneDataPolicy clonePolicy;
+
+ if (GetDocGroup() && callerAgentClusterId.isSome() &&
+ GetDocGroup()->AgentClusterId().Equals(callerAgentClusterId.value())) {
+ clonePolicy.allowIntraClusterClonableSharedObjects();
+ }
+
+ if (callerInnerWindow && callerInnerWindow->IsSharedMemoryAllowed()) {
+ clonePolicy.allowSharedMemoryObjects();
+ }
+
+ event->Write(aCx, aMessage, aTransfer, clonePolicy, aError);
+ if (NS_WARN_IF(aError.Failed())) {
+ return;
+ }
+
+ event->DispatchToTargetThread(aError);
+}
+
+class nsCloseEvent : public Runnable {
+ RefPtr<nsGlobalWindowOuter> mWindow;
+ bool mIndirect;
+
+ nsCloseEvent(nsGlobalWindowOuter* aWindow, bool aIndirect)
+ : mozilla::Runnable("nsCloseEvent"),
+ mWindow(aWindow),
+ mIndirect(aIndirect) {}
+
+ public:
+ static nsresult PostCloseEvent(nsGlobalWindowOuter* aWindow, bool aIndirect) {
+ nsCOMPtr<nsIRunnable> ev = new nsCloseEvent(aWindow, aIndirect);
+ nsresult rv = aWindow->Dispatch(TaskCategory::Other, ev.forget());
+ return rv;
+ }
+
+ NS_IMETHOD Run() override {
+ if (mWindow) {
+ if (mIndirect) {
+ return PostCloseEvent(mWindow, false);
+ }
+ mWindow->ReallyCloseWindow();
+ }
+ return NS_OK;
+ }
+};
+
+bool nsGlobalWindowOuter::CanClose() {
+ if (mIsChrome) {
+ nsCOMPtr<nsIBrowserDOMWindow> bwin;
+ GetBrowserDOMWindow(getter_AddRefs(bwin));
+
+ bool canClose = true;
+ if (bwin && NS_SUCCEEDED(bwin->CanClose(&canClose))) {
+ return canClose;
+ }
+ }
+
+ if (!mDocShell) {
+ return true;
+ }
+
+ nsCOMPtr<nsIContentViewer> cv;
+ mDocShell->GetContentViewer(getter_AddRefs(cv));
+ if (cv) {
+ bool canClose;
+ nsresult rv = cv->PermitUnload(&canClose);
+ if (NS_SUCCEEDED(rv) && !canClose) return false;
+ }
+
+ // If we still have to print, we delay the closing until print has happened.
+ if (mShouldDelayPrintUntilAfterLoad && mDelayedPrintUntilAfterLoad) {
+ mDelayedCloseForPrinting = true;
+ return false;
+ }
+
+ return true;
+}
+
+void nsGlobalWindowOuter::CloseOuter(bool aTrustedCaller) {
+ if (!mDocShell || IsInModalState() || mBrowsingContext->IsSubframe()) {
+ // window.close() is called on a frame in a frameset, on a window
+ // that's already closed, or on a window for which there's
+ // currently a modal dialog open. Ignore such calls.
+ return;
+ }
+
+ if (mHavePendingClose) {
+ // We're going to be closed anyway; do nothing since we don't want
+ // to double-close
+ return;
+ }
+
+ if (mBlockScriptedClosingFlag) {
+ // A script's popup has been blocked and we don't want
+ // the window to be closed directly after this event,
+ // so the user can see that there was a blocked popup.
+ return;
+ }
+
+ // Don't allow scripts from content to close non-neterror windows that
+ // were not opened by script.
+ if (mDoc) {
+ nsAutoString url;
+ nsresult rv = mDoc->GetURL(url);
+ NS_ENSURE_SUCCESS_VOID(rv);
+
+ if (!StringBeginsWith(url, u"about:neterror"_ns) &&
+ !mBrowsingContext->HadOriginalOpener() && !aTrustedCaller &&
+ !IsOnlyTopLevelDocumentInSHistory()) {
+ bool allowClose =
+ mAllowScriptsToClose ||
+ Preferences::GetBool("dom.allow_scripts_to_close_windows", true);
+ if (!allowClose) {
+ // We're blocking the close operation
+ // report localized error msg in JS console
+ nsContentUtils::ReportToConsole(
+ nsIScriptError::warningFlag, "DOM Window"_ns,
+ mDoc, // Better name for the category?
+ nsContentUtils::eDOM_PROPERTIES, "WindowCloseBlockedWarning");
+
+ return;
+ }
+ }
+ }
+
+ if (!mInClose && !mIsClosed && !CanClose()) {
+ return;
+ }
+
+ // Fire a DOM event notifying listeners that this window is about to
+ // be closed. The tab UI code may choose to cancel the default
+ // action for this event, if so, we won't actually close the window
+ // (since the tab UI code will close the tab in stead). Sure, this
+ // could be abused by content code, but do we care? I don't think
+ // so...
+
+ bool wasInClose = mInClose;
+ mInClose = true;
+
+ if (!DispatchCustomEvent(u"DOMWindowClose"_ns, ChromeOnlyDispatch::eYes)) {
+ // Someone chose to prevent the default action for this event, if
+ // so, let's not close this window after all...
+
+ mInClose = wasInClose;
+ return;
+ }
+
+ FinalClose();
+}
+
+bool nsGlobalWindowOuter::IsOnlyTopLevelDocumentInSHistory() {
+ NS_ENSURE_TRUE(mDocShell && mBrowsingContext, false);
+ // Disabled since IsFrame() is buggy in Fission
+ // MOZ_ASSERT(mBrowsingContext->IsTop());
+
+ if (mozilla::SessionHistoryInParent()) {
+ return mBrowsingContext->GetIsSingleToplevelInHistory();
+ }
+
+ RefPtr<ChildSHistory> csh = nsDocShell::Cast(mDocShell)->GetSessionHistory();
+ if (csh && csh->LegacySHistory()) {
+ return csh->LegacySHistory()->IsEmptyOrHasEntriesForSingleTopLevelPage();
+ }
+
+ return false;
+}
+
+nsresult nsGlobalWindowOuter::Close() {
+ CloseOuter(/* aTrustedCaller = */ true);
+ return NS_OK;
+}
+
+void nsGlobalWindowOuter::ForceClose() {
+ MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
+
+ if (mBrowsingContext->IsSubframe() || !mDocShell) {
+ // This may be a frame in a frameset, or a window that's already closed.
+ // Ignore such calls.
+ return;
+ }
+
+ if (mHavePendingClose) {
+ // We're going to be closed anyway; do nothing since we don't want
+ // to double-close
+ return;
+ }
+
+ mInClose = true;
+
+ DispatchCustomEvent(u"DOMWindowClose"_ns, ChromeOnlyDispatch::eYes);
+
+ FinalClose();
+}
+
+void nsGlobalWindowOuter::FinalClose() {
+ // Flag that we were closed.
+ mIsClosed = true;
+
+ if (!mBrowsingContext->IsDiscarded()) {
+ MOZ_ALWAYS_SUCCEEDS(mBrowsingContext->SetClosed(true));
+ }
+
+ // If we get here from CloseOuter then it means that the parent process is
+ // going to close our window for us. It's just important to set mIsClosed.
+ if (XRE_GetProcessType() == GeckoProcessType_Content) {
+ return;
+ }
+
+ // This stuff is non-sensical but incredibly fragile. The reasons for the
+ // behavior here don't make sense today and may not have ever made sense,
+ // but various bits of frontend code break when you change them. If you need
+ // to fix up this behavior, feel free to. It's a righteous task, but involves
+ // wrestling with various download manager tests, frontend code, and possible
+ // broken addons. The chrome tests in toolkit/mozapps/downloads are a good
+ // testing ground.
+ //
+ // In particular, if some inner of |win| is the entry global, we must
+ // complete _two_ round-trips to the event loop before the call to
+ // ReallyCloseWindow. This allows setTimeout handlers that are set after
+ // FinalClose() is called to run before the window is torn down.
+ nsCOMPtr<nsPIDOMWindowInner> entryWindow =
+ do_QueryInterface(GetEntryGlobal());
+ bool indirect = entryWindow && entryWindow->GetOuterWindow() == this;
+ if (NS_FAILED(nsCloseEvent::PostCloseEvent(this, indirect))) {
+ ReallyCloseWindow();
+ } else {
+ mHavePendingClose = true;
+ }
+}
+
+void nsGlobalWindowOuter::ReallyCloseWindow() {
+ // Make sure we never reenter this method.
+ mHavePendingClose = true;
+
+ nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
+ if (!treeOwnerAsWin) {
+ return;
+ }
+
+ treeOwnerAsWin->Destroy();
+ CleanUp();
+}
+
+void nsGlobalWindowOuter::SuppressEventHandling() {
+ if (mSuppressEventHandlingDepth == 0) {
+ if (BrowsingContext* bc = GetBrowsingContext()) {
+ bc->PreOrderWalk([&](BrowsingContext* aBC) {
+ if (nsCOMPtr<nsPIDOMWindowOuter> win = aBC->GetDOMWindow()) {
+ if (RefPtr<Document> doc = win->GetExtantDoc()) {
+ mSuspendedDocs.AppendElement(doc);
+ // Note: Document::SuppressEventHandling will also automatically
+ // suppress event handling for any in-process sub-documents.
+ // However, since we need to deal with cases where remote
+ // BrowsingContexts may be interleaved with in-process ones, we
+ // still need to walk the entire tree ourselves. This may be
+ // slightly redundant in some cases, but since event handling
+ // suppressions maintain a count of current blockers, it does not
+ // cause any problems.
+ doc->SuppressEventHandling();
+ }
+ }
+ });
+ }
+ }
+ mSuppressEventHandlingDepth++;
+}
+
+void nsGlobalWindowOuter::UnsuppressEventHandling() {
+ MOZ_ASSERT(mSuppressEventHandlingDepth != 0);
+ mSuppressEventHandlingDepth--;
+
+ if (mSuppressEventHandlingDepth == 0 && mSuspendedDocs.Length()) {
+ RefPtr<Document> currentDoc = GetExtantDoc();
+ bool fireEvent = currentDoc == mSuspendedDocs[0];
+ nsTArray<RefPtr<Document>> suspendedDocs = std::move(mSuspendedDocs);
+ for (const auto& doc : suspendedDocs) {
+ doc->UnsuppressEventHandlingAndFireEvents(fireEvent);
+ }
+ }
+}
+
+nsGlobalWindowOuter* nsGlobalWindowOuter::EnterModalState() {
+ // GetInProcessScriptableTop, not GetInProcessTop, so that EnterModalState
+ // works properly with <iframe mozbrowser>.
+ nsGlobalWindowOuter* topWin = GetInProcessScriptableTopInternal();
+
+ if (!topWin) {
+ NS_ERROR("Uh, EnterModalState() called w/o a reachable top window?");
+ return nullptr;
+ }
+
+ // If there is an active ESM in this window, clear it. Otherwise, this can
+ // cause a problem if a modal state is entered during a mouseup event.
+ EventStateManager* activeESM = static_cast<EventStateManager*>(
+ EventStateManager::GetActiveEventStateManager());
+ if (activeESM && activeESM->GetPresContext()) {
+ PresShell* activePresShell = activeESM->GetPresContext()->GetPresShell();
+ if (activePresShell && (nsContentUtils::ContentIsCrossDocDescendantOf(
+ activePresShell->GetDocument(), mDoc) ||
+ nsContentUtils::ContentIsCrossDocDescendantOf(
+ mDoc, activePresShell->GetDocument()))) {
+ EventStateManager::ClearGlobalActiveContent(activeESM);
+
+ PresShell::ReleaseCapturingContent();
+
+ if (activePresShell) {
+ RefPtr<nsFrameSelection> frameSelection =
+ activePresShell->FrameSelection();
+ frameSelection->SetDragState(false);
+ }
+ }
+ }
+
+ // If there are any drag and drop operations in flight, try to end them.
+ nsCOMPtr<nsIDragService> ds =
+ do_GetService("@mozilla.org/widget/dragservice;1");
+ if (ds) {
+ ds->EndDragSession(true, 0);
+ }
+
+ // Clear the capturing content if it is under topDoc.
+ // Usually the activeESM check above does that, but there are cases when
+ // we don't have activeESM, or it is for different document.
+ Document* topDoc = topWin->GetExtantDoc();
+ nsIContent* capturingContent = PresShell::GetCapturingContent();
+ if (capturingContent && topDoc &&
+ nsContentUtils::ContentIsCrossDocDescendantOf(capturingContent, topDoc)) {
+ PresShell::ReleaseCapturingContent();
+ }
+
+ if (topWin->mModalStateDepth == 0) {
+ topWin->SuppressEventHandling();
+
+ if (nsGlobalWindowInner* inner = topWin->GetCurrentInnerWindowInternal()) {
+ inner->Suspend();
+ }
+ }
+ topWin->mModalStateDepth++;
+ return topWin;
+}
+
+void nsGlobalWindowOuter::LeaveModalState() {
+ {
+ nsGlobalWindowOuter* topWin = GetInProcessScriptableTopInternal();
+ if (!topWin) {
+ NS_WARNING("Uh, LeaveModalState() called w/o a reachable top window?");
+ return;
+ }
+
+ if (topWin != this) {
+ MOZ_ASSERT(IsSuspended());
+ return topWin->LeaveModalState();
+ }
+ }
+
+ MOZ_ASSERT(mModalStateDepth != 0);
+ MOZ_ASSERT(IsSuspended());
+ mModalStateDepth--;
+
+ nsGlobalWindowInner* inner = GetCurrentInnerWindowInternal();
+ if (mModalStateDepth == 0) {
+ if (inner) {
+ inner->Resume();
+ }
+
+ UnsuppressEventHandling();
+ }
+
+ // Remember the time of the last dialog quit.
+ if (auto* bcg = GetBrowsingContextGroup()) {
+ bcg->SetLastDialogQuitTime(TimeStamp::Now());
+ }
+
+ if (mModalStateDepth == 0) {
+ RefPtr<Event> event = NS_NewDOMEvent(inner, nullptr, nullptr);
+ event->InitEvent(u"endmodalstate"_ns, true, false);
+ event->SetTrusted(true);
+ event->WidgetEventPtr()->mFlags.mOnlyChromeDispatch = true;
+ DispatchEvent(*event);
+ }
+}
+
+bool nsGlobalWindowOuter::IsInModalState() {
+ nsGlobalWindowOuter* topWin = GetInProcessScriptableTopInternal();
+
+ if (!topWin) {
+ // IsInModalState() getting called w/o a reachable top window is a bit
+ // iffy, but valid enough not to make noise about it. See bug 404828
+ return false;
+ }
+
+ return topWin->mModalStateDepth != 0;
+}
+
+void nsGlobalWindowOuter::NotifyWindowIDDestroyed(const char* aTopic) {
+ nsCOMPtr<nsIRunnable> runnable =
+ new WindowDestroyedEvent(this, mWindowID, aTopic);
+ Dispatch(TaskCategory::Other, runnable.forget());
+}
+
+Element* nsGlobalWindowOuter::GetFrameElement(nsIPrincipal& aSubjectPrincipal) {
+ // Per HTML5, the frameElement getter returns null in cross-origin situations.
+ Element* element = GetFrameElement();
+ if (!element) {
+ return nullptr;
+ }
+
+ if (!aSubjectPrincipal.SubsumesConsideringDomain(element->NodePrincipal())) {
+ return nullptr;
+ }
+
+ return element;
+}
+
+Element* nsGlobalWindowOuter::GetFrameElement() {
+ if (!mBrowsingContext || mBrowsingContext->IsTop()) {
+ return nullptr;
+ }
+ return mBrowsingContext->GetEmbedderElement();
+}
+
+namespace {
+class ChildCommandDispatcher : public Runnable {
+ public:
+ ChildCommandDispatcher(nsPIWindowRoot* aRoot, nsIBrowserChild* aBrowserChild,
+ nsPIDOMWindowOuter* aWindow, const nsAString& aAction)
+ : mozilla::Runnable("ChildCommandDispatcher"),
+ mRoot(aRoot),
+ mBrowserChild(aBrowserChild),
+ mWindow(aWindow),
+ mAction(aAction) {}
+
+ NS_IMETHOD Run() override {
+ AutoTArray<nsCString, 70> enabledCommands, disabledCommands;
+ mRoot->GetEnabledDisabledCommands(enabledCommands, disabledCommands);
+ if (enabledCommands.Length() || disabledCommands.Length()) {
+ BrowserChild* bc = static_cast<BrowserChild*>(mBrowserChild.get());
+ bc->SendEnableDisableCommands(mWindow->GetBrowsingContext(), mAction,
+ enabledCommands, disabledCommands);
+ }
+
+ return NS_OK;
+ }
+
+ private:
+ nsCOMPtr<nsPIWindowRoot> mRoot;
+ nsCOMPtr<nsIBrowserChild> mBrowserChild;
+ nsCOMPtr<nsPIDOMWindowOuter> mWindow;
+ nsString mAction;
+};
+
+class CommandDispatcher : public Runnable {
+ public:
+ CommandDispatcher(nsIDOMXULCommandDispatcher* aDispatcher,
+ const nsAString& aAction)
+ : mozilla::Runnable("CommandDispatcher"),
+ mDispatcher(aDispatcher),
+ mAction(aAction) {}
+
+ // TODO: Convert this to MOZ_CAN_RUN_SCRIPT (bug 1415230, bug 1535398)
+ MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override {
+ return mDispatcher->UpdateCommands(mAction);
+ }
+
+ const nsCOMPtr<nsIDOMXULCommandDispatcher> mDispatcher;
+ nsString mAction;
+};
+} // anonymous namespace
+
+void nsGlobalWindowOuter::UpdateCommands(const nsAString& anAction,
+ Selection* aSel, int16_t aReason) {
+ // If this is a child process, redirect to the parent process.
+ if (nsIDocShell* docShell = GetDocShell()) {
+ if (nsCOMPtr<nsIBrowserChild> child = docShell->GetBrowserChild()) {
+ nsCOMPtr<nsPIWindowRoot> root = GetTopWindowRoot();
+ if (root) {
+ nsContentUtils::AddScriptRunner(
+ new ChildCommandDispatcher(root, child, this, anAction));
+ }
+ return;
+ }
+ }
+
+ nsPIDOMWindowOuter* rootWindow = GetPrivateRoot();
+ if (!rootWindow) {
+ return;
+ }
+
+ Document* doc = rootWindow->GetExtantDoc();
+
+ if (!doc) {
+ return;
+ }
+ // selectionchange action is only used for mozbrowser, not for XUL. So we
+ // bypass XUL command dispatch if anAction is "selectionchange".
+ if (!anAction.EqualsLiteral("selectionchange")) {
+ // Retrieve the command dispatcher and call updateCommands on it.
+ nsIDOMXULCommandDispatcher* xulCommandDispatcher =
+ doc->GetCommandDispatcher();
+ if (xulCommandDispatcher) {
+ nsContentUtils::AddScriptRunner(
+ new CommandDispatcher(xulCommandDispatcher, anAction));
+ }
+ }
+}
+
+Selection* nsGlobalWindowOuter::GetSelectionOuter() {
+ if (!mDocShell) {
+ return nullptr;
+ }
+
+ PresShell* presShell = mDocShell->GetPresShell();
+ if (!presShell) {
+ return nullptr;
+ }
+ return presShell->GetCurrentSelection(SelectionType::eNormal);
+}
+
+already_AddRefed<Selection> nsGlobalWindowOuter::GetSelection() {
+ RefPtr<Selection> selection = GetSelectionOuter();
+ return selection.forget();
+}
+
+bool nsGlobalWindowOuter::FindOuter(const nsAString& aString,
+ bool aCaseSensitive, bool aBackwards,
+ bool aWrapAround, bool aWholeWord,
+ bool aSearchInFrames, bool aShowDialog,
+ ErrorResult& aError) {
+ Unused << aShowDialog;
+
+ nsCOMPtr<nsIWebBrowserFind> finder(do_GetInterface(mDocShell));
+ if (!finder) {
+ aError.Throw(NS_ERROR_NOT_AVAILABLE);
+ return false;
+ }
+
+ // Set the options of the search
+ aError = finder->SetSearchString(aString);
+ if (aError.Failed()) {
+ return false;
+ }
+ finder->SetMatchCase(aCaseSensitive);
+ finder->SetFindBackwards(aBackwards);
+ finder->SetWrapFind(aWrapAround);
+ finder->SetEntireWord(aWholeWord);
+ finder->SetSearchFrames(aSearchInFrames);
+
+ // the nsIWebBrowserFind is initialized to use this window
+ // as the search root, but uses focus to set the current search
+ // frame. If we're being called from JS (as here), this window
+ // should be the current search frame.
+ nsCOMPtr<nsIWebBrowserFindInFrames> framesFinder(do_QueryInterface(finder));
+ if (framesFinder) {
+ framesFinder->SetRootSearchFrame(this); // paranoia
+ framesFinder->SetCurrentSearchFrame(this);
+ }
+
+ if (aString.IsEmpty()) {
+ return false;
+ }
+
+ // Launch the search with the passed in search string
+ bool didFind = false;
+ aError = finder->FindNext(&didFind);
+ return didFind;
+}
+
+//*****************************************************************************
+// EventTarget
+//*****************************************************************************
+
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetOwnerGlobalForBindingsInternal() {
+ return this;
+}
+
+bool nsGlobalWindowOuter::DispatchEvent(Event& aEvent, CallerType aCallerType,
+ ErrorResult& aRv) {
+ FORWARD_TO_INNER(DispatchEvent, (aEvent, aCallerType, aRv), false);
+}
+
+bool nsGlobalWindowOuter::ComputeDefaultWantsUntrusted(ErrorResult& aRv) {
+ // It's OK that we just return false here on failure to create an
+ // inner. GetOrCreateListenerManager() will likewise fail, and then
+ // we won't be adding any listeners anyway.
+ FORWARD_TO_INNER_CREATE(ComputeDefaultWantsUntrusted, (aRv), false);
+}
+
+EventListenerManager* nsGlobalWindowOuter::GetOrCreateListenerManager() {
+ FORWARD_TO_INNER_CREATE(GetOrCreateListenerManager, (), nullptr);
+}
+
+EventListenerManager* nsGlobalWindowOuter::GetExistingListenerManager() const {
+ FORWARD_TO_INNER(GetExistingListenerManager, (), nullptr);
+}
+
+//*****************************************************************************
+// nsGlobalWindowOuter::nsPIDOMWindow
+//*****************************************************************************
+
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetPrivateParent() {
+ nsCOMPtr<nsPIDOMWindowOuter> parent = GetInProcessParent();
+
+ if (this == parent) {
+ nsCOMPtr<nsIContent> chromeElement(do_QueryInterface(mChromeEventHandler));
+ if (!chromeElement)
+ return nullptr; // This is ok, just means a null parent.
+
+ Document* doc = chromeElement->GetComposedDoc();
+ if (!doc) return nullptr; // This is ok, just means a null parent.
+
+ return doc->GetWindow();
+ }
+
+ return parent;
+}
+
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetPrivateRoot() {
+ nsCOMPtr<nsPIDOMWindowOuter> top = GetInProcessTop();
+
+ nsCOMPtr<nsIContent> chromeElement(do_QueryInterface(mChromeEventHandler));
+ if (chromeElement) {
+ Document* doc = chromeElement->GetComposedDoc();
+ if (doc) {
+ nsCOMPtr<nsPIDOMWindowOuter> parent = doc->GetWindow();
+ if (parent) {
+ top = parent->GetInProcessTop();
+ }
+ }
+ }
+
+ return top;
+}
+
+// This has a caller in Windows-only code (nsNativeAppSupportWin).
+Location* nsGlobalWindowOuter::GetLocation() {
+ // This method can be called on the outer window as well.
+ FORWARD_TO_INNER(Location, (), nullptr);
+}
+
+void nsGlobalWindowOuter::SetIsBackground(bool aIsBackground) {
+ bool changed = aIsBackground != IsBackground();
+ SetIsBackgroundInternal(aIsBackground);
+
+ nsGlobalWindowInner* inner = GetCurrentInnerWindowInternal();
+
+ if (inner && changed) {
+ inner->UpdateBackgroundState();
+ }
+
+ if (aIsBackground) {
+ // Notify gamepadManager we are at the background window,
+ // we need to stop vibrate.
+ // Stop the vr telemery time spent when it switches to
+ // the background window.
+ if (inner && changed) {
+ inner->StopGamepadHaptics();
+ inner->StopVRActivity();
+ // true is for asking to set the delta time to
+ // the telemetry.
+ inner->ResetVRTelemetry(true);
+ }
+ return;
+ }
+
+ if (inner) {
+ // When switching to be as a top tab, restart the telemetry.
+ // false is for only resetting the timestamp.
+ inner->ResetVRTelemetry(false);
+ inner->SyncGamepadState();
+ inner->StartVRActivity();
+ }
+}
+
+void nsGlobalWindowOuter::SetIsBackgroundInternal(bool aIsBackground) {
+ mIsBackground = aIsBackground;
+}
+
+void nsGlobalWindowOuter::SetChromeEventHandler(
+ EventTarget* aChromeEventHandler) {
+ SetChromeEventHandlerInternal(aChromeEventHandler);
+ // update the chrome event handler on all our inner windows
+ RefPtr<nsGlobalWindowInner> inner;
+ for (PRCList* node = PR_LIST_HEAD(this); node != this;
+ node = PR_NEXT_LINK(inner)) {
+ // This cast is only safe if `node != this`, as nsGlobalWindowOuter is also
+ // in the list.
+ inner = static_cast<nsGlobalWindowInner*>(node);
+ NS_ASSERTION(!inner->mOuterWindow || inner->mOuterWindow == this,
+ "bad outer window pointer");
+ inner->SetChromeEventHandlerInternal(aChromeEventHandler);
+ }
+}
+
+void nsGlobalWindowOuter::SetFocusedElement(Element* aElement,
+ uint32_t aFocusMethod,
+ bool aNeedsFocus) {
+ FORWARD_TO_INNER_VOID(SetFocusedElement,
+ (aElement, aFocusMethod, aNeedsFocus));
+}
+
+uint32_t nsGlobalWindowOuter::GetFocusMethod() {
+ FORWARD_TO_INNER(GetFocusMethod, (), 0);
+}
+
+bool nsGlobalWindowOuter::ShouldShowFocusRing() {
+ FORWARD_TO_INNER(ShouldShowFocusRing, (), false);
+}
+
+bool nsGlobalWindowOuter::TakeFocus(bool aFocus, uint32_t aFocusMethod) {
+ FORWARD_TO_INNER(TakeFocus, (aFocus, aFocusMethod), false);
+}
+
+void nsGlobalWindowOuter::SetReadyForFocus() {
+ FORWARD_TO_INNER_VOID(SetReadyForFocus, ());
+}
+
+void nsGlobalWindowOuter::PageHidden() {
+ FORWARD_TO_INNER_VOID(PageHidden, ());
+}
+
+already_AddRefed<nsICSSDeclaration>
+nsGlobalWindowOuter::GetComputedStyleHelperOuter(Element& aElt,
+ const nsAString& aPseudoElt,
+ bool aDefaultStylesOnly,
+ ErrorResult& aRv) {
+ if (!mDoc) {
+ return nullptr;
+ }
+
+ RefPtr<nsICSSDeclaration> compStyle = NS_NewComputedDOMStyle(
+ &aElt, aPseudoElt, mDoc,
+ aDefaultStylesOnly ? nsComputedDOMStyle::StyleType::DefaultOnly
+ : nsComputedDOMStyle::StyleType::All,
+ aRv);
+
+ return compStyle.forget();
+}
+
+//*****************************************************************************
+// nsGlobalWindowOuter::nsIInterfaceRequestor
+//*****************************************************************************
+
+nsresult nsGlobalWindowOuter::GetInterfaceInternal(const nsIID& aIID,
+ void** aSink) {
+ NS_ENSURE_ARG_POINTER(aSink);
+ *aSink = nullptr;
+
+ if (aIID.Equals(NS_GET_IID(nsIWebNavigation))) {
+ nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(mDocShell));
+ webNav.forget(aSink);
+ } else if (aIID.Equals(NS_GET_IID(nsIDocShell))) {
+ nsCOMPtr<nsIDocShell> docShell = mDocShell;
+ docShell.forget(aSink);
+ }
+#ifdef NS_PRINTING
+ else if (aIID.Equals(NS_GET_IID(nsIWebBrowserPrint))) {
+ if (mDocShell) {
+ nsCOMPtr<nsIContentViewer> viewer;
+ mDocShell->GetContentViewer(getter_AddRefs(viewer));
+ if (viewer) {
+ nsCOMPtr<nsIWebBrowserPrint> webBrowserPrint(do_QueryInterface(viewer));
+ webBrowserPrint.forget(aSink);
+ }
+ }
+ }
+#endif
+ else if (aIID.Equals(NS_GET_IID(nsILoadContext))) {
+ nsCOMPtr<nsILoadContext> loadContext(do_QueryInterface(mDocShell));
+ loadContext.forget(aSink);
+ }
+
+ return *aSink ? NS_OK : NS_ERROR_NO_INTERFACE;
+}
+
+NS_IMETHODIMP
+nsGlobalWindowOuter::GetInterface(const nsIID& aIID, void** aSink) {
+ nsresult rv = GetInterfaceInternal(aIID, aSink);
+ if (rv == NS_ERROR_NO_INTERFACE) {
+ return QueryInterface(aIID, aSink);
+ }
+ return rv;
+}
+
+bool nsGlobalWindowOuter::IsSuspended() const {
+ MOZ_ASSERT(NS_IsMainThread());
+ // No inner means we are effectively suspended
+ if (!mInnerWindow) {
+ return true;
+ }
+ return mInnerWindow->IsSuspended();
+}
+
+bool nsGlobalWindowOuter::IsFrozen() const {
+ MOZ_ASSERT(NS_IsMainThread());
+ // No inner means we are effectively frozen
+ if (!mInnerWindow) {
+ return true;
+ }
+ return mInnerWindow->IsFrozen();
+}
+
+nsresult nsGlobalWindowOuter::FireDelayedDOMEvents(bool aIncludeSubWindows) {
+ FORWARD_TO_INNER(FireDelayedDOMEvents, (aIncludeSubWindows),
+ NS_ERROR_UNEXPECTED);
+}
+
+//*****************************************************************************
+// nsGlobalWindowOuter: Window Control Functions
+//*****************************************************************************
+
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetInProcessParentInternal() {
+ nsCOMPtr<nsPIDOMWindowOuter> parent = GetInProcessParent();
+
+ if (parent && parent != this) {
+ return parent;
+ }
+
+ return nullptr;
+}
+
+void nsGlobalWindowOuter::UnblockScriptedClosing() {
+ mBlockScriptedClosingFlag = false;
+}
+
+class AutoUnblockScriptClosing {
+ private:
+ RefPtr<nsGlobalWindowOuter> mWin;
+
+ public:
+ explicit AutoUnblockScriptClosing(nsGlobalWindowOuter* aWin) : mWin(aWin) {
+ MOZ_ASSERT(mWin);
+ }
+ ~AutoUnblockScriptClosing() {
+ void (nsGlobalWindowOuter::*run)() =
+ &nsGlobalWindowOuter::UnblockScriptedClosing;
+ nsCOMPtr<nsIRunnable> caller = NewRunnableMethod(
+ "AutoUnblockScriptClosing::~AutoUnblockScriptClosing", mWin, run);
+ mWin->Dispatch(TaskCategory::Other, caller.forget());
+ }
+};
+
+nsresult nsGlobalWindowOuter::OpenInternal(
+ const nsAString& aUrl, const nsAString& aName, const nsAString& aOptions,
+ bool aDialog, bool aContentModal, bool aCalledNoScript, bool aDoJSFixups,
+ bool aNavigate, nsIArray* argv, nsISupports* aExtraArgument,
+ nsDocShellLoadState* aLoadState, bool aForceNoOpener, PrintKind aPrintKind,
+ BrowsingContext** aReturn) {
+#ifdef DEBUG
+ uint32_t argc = 0;
+ if (argv) argv->GetLength(&argc);
+#endif
+
+ MOZ_ASSERT(!aExtraArgument || (!argv && argc == 0),
+ "Can't pass in arguments both ways");
+ MOZ_ASSERT(!aCalledNoScript || (!argv && argc == 0),
+ "Can't pass JS args when called via the noscript methods");
+
+ mozilla::Maybe<AutoUnblockScriptClosing> closeUnblocker;
+
+ // Calls to window.open from script should navigate.
+ MOZ_ASSERT(aCalledNoScript || aNavigate);
+
+ *aReturn = nullptr;
+
+ nsCOMPtr<nsIWebBrowserChrome> chrome = GetWebBrowserChrome();
+ if (!chrome) {
+ // No chrome means we don't want to go through with this open call
+ // -- see nsIWindowWatcher.idl
+ return NS_ERROR_NOT_AVAILABLE;
+ }
+
+ NS_ASSERTION(mDocShell, "Must have docshell here");
+
+ NS_ConvertUTF16toUTF8 optionsUtf8(aOptions);
+
+ WindowFeatures features;
+ if (!features.Tokenize(optionsUtf8)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ bool forceNoOpener = aForceNoOpener;
+ if (features.Exists("noopener")) {
+ forceNoOpener = features.GetBool("noopener");
+ features.Remove("noopener");
+ }
+
+ bool forceNoReferrer = false;
+ if (features.Exists("noreferrer")) {
+ forceNoReferrer = features.GetBool("noreferrer");
+ if (forceNoReferrer) {
+ // noreferrer implies noopener
+ forceNoOpener = true;
+ }
+ features.Remove("noreferrer");
+ }
+
+ nsAutoCString options;
+ features.Stringify(options);
+
+ // If noopener is force-enabled for the current document, then set noopener to
+ // true, and clear the name to "_blank".
+ nsAutoString windowName(aName);
+ if (nsDocShell::Cast(GetDocShell())->NoopenerForceEnabled()) {
+ // FIXME: Eventually bypass force-enabling noopener if `aPrintKind !=
+ // PrintKind::None`, so that we can print pages with noopener force-enabled.
+ // This will require relaxing assertions elsewhere.
+ if (aPrintKind != PrintKind::None) {
+ NS_WARNING(
+ "printing frames with noopener force-enabled isn't supported yet");
+ return NS_ERROR_FAILURE;
+ }
+
+ MOZ_DIAGNOSTIC_ASSERT(aNavigate,
+ "cannot OpenNoNavigate if noopener is force-enabled");
+
+ forceNoOpener = true;
+ windowName = u"_blank"_ns;
+ }
+
+ bool windowExists = WindowExists(windowName, forceNoOpener, !aCalledNoScript);
+
+ // XXXbz When this gets fixed to not use LegacyIsCallerNativeCode()
+ // (indirectly) maybe we can nix the AutoJSAPI usage OnLinkClickEvent::Run.
+ // But note that if you change this to GetEntryGlobal(), say, then
+ // OnLinkClickEvent::Run will need a full-blown AutoEntryScript.
+ const bool checkForPopup =
+ !nsContentUtils::LegacyIsCallerChromeOrNativeCode() && !aDialog &&
+ !windowExists;
+
+ // Note: the Void handling here is very important, because the window watcher
+ // expects a null URL string (not an empty string) if there is no URL to load.
+ nsCString url;
+ url.SetIsVoid(true);
+ nsresult rv = NS_OK;
+
+ nsCOMPtr<nsIURI> uri;
+
+ // It's important to do this security check before determining whether this
+ // window opening should be blocked, to ensure that we don't FireAbuseEvents
+ // for a window opening that wouldn't have succeeded in the first place.
+ if (!aUrl.IsEmpty()) {
+ AppendUTF16toUTF8(aUrl, url);
+
+ // It's safe to skip the security check below if we're not a dialog
+ // because window.openDialog is not callable from content script. See bug
+ // 56851.
+ //
+ // If we're not navigating, we assume that whoever *does* navigate the
+ // window will do a security check of their own.
+ if (!url.IsVoid() && !aDialog && aNavigate)
+ rv = SecurityCheckURL(url.get(), getter_AddRefs(uri));
+ } else if (mDoc) {
+ mDoc->SetUseCounter(eUseCounter_custom_WindowOpenEmptyUrl);
+ }
+
+ if (NS_FAILED(rv)) return rv;
+
+ PopupBlocker::PopupControlState abuseLevel =
+ PopupBlocker::GetPopupControlState();
+ if (checkForPopup) {
+ abuseLevel = mBrowsingContext->RevisePopupAbuseLevel(abuseLevel);
+ if (abuseLevel >= PopupBlocker::openBlocked) {
+ if (!aCalledNoScript) {
+ // If script in some other window is doing a window.open on us and
+ // it's being blocked, then it's OK to close us afterwards, probably.
+ // But if we're doing a window.open on ourselves and block the popup,
+ // prevent this window from closing until after this script terminates
+ // so that whatever popup blocker UI the app has will be visible.
+ nsCOMPtr<nsPIDOMWindowInner> entryWindow =
+ do_QueryInterface(GetEntryGlobal());
+ // Note that entryWindow can be null here if some JS component was the
+ // place where script was entered for this JS execution.
+ if (entryWindow && entryWindow->GetOuterWindow() == this) {
+ mBlockScriptedClosingFlag = true;
+ closeUnblocker.emplace(this);
+ }
+ }
+
+ FireAbuseEvents(aUrl, windowName, aOptions);
+ return aDoJSFixups ? NS_OK : NS_ERROR_FAILURE;
+ }
+ }
+
+ RefPtr<BrowsingContext> domReturn;
+
+ nsCOMPtr<nsIWindowWatcher> wwatch =
+ do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv);
+ NS_ENSURE_TRUE(wwatch, rv);
+
+ NS_ConvertUTF16toUTF8 name(windowName);
+
+ nsCOMPtr<nsPIWindowWatcher> pwwatch(do_QueryInterface(wwatch));
+ NS_ENSURE_STATE(pwwatch);
+
+ MOZ_ASSERT_IF(checkForPopup, abuseLevel < PopupBlocker::openBlocked);
+ // At this point we should know for a fact that if checkForPopup then
+ // abuseLevel < PopupBlocker::openBlocked, so we could just check for
+ // abuseLevel == PopupBlocker::openControlled. But let's be defensive just in
+ // case and treat anything that fails the above assert as a spam popup too, if
+ // it ever happens.
+ bool isPopupSpamWindow =
+ checkForPopup && (abuseLevel >= PopupBlocker::openControlled);
+
+ const auto wwPrintKind = [&] {
+ switch (aPrintKind) {
+ case PrintKind::None:
+ return nsPIWindowWatcher::PRINT_NONE;
+ case PrintKind::InternalPrint:
+ return nsPIWindowWatcher::PRINT_INTERNAL;
+ case PrintKind::WindowDotPrint:
+ return nsPIWindowWatcher::PRINT_WINDOW_DOT_PRINT;
+ }
+ MOZ_ASSERT_UNREACHABLE("Wat");
+ return nsPIWindowWatcher::PRINT_NONE;
+ }();
+
+ {
+ // Reset popup state while opening a window to prevent the
+ // current state from being active the whole time a modal
+ // dialog is open.
+ AutoPopupStatePusher popupStatePusher(PopupBlocker::openAbused, true);
+
+ if (!aCalledNoScript) {
+ // We asserted at the top of this function that aNavigate is true for
+ // !aCalledNoScript.
+ rv = pwwatch->OpenWindow2(this, url, name, options,
+ /* aCalledFromScript = */ true, aDialog,
+ aNavigate, argv, isPopupSpamWindow,
+ forceNoOpener, forceNoReferrer, wwPrintKind,
+ aLoadState, getter_AddRefs(domReturn));
+ } else {
+ // Force a system caller here so that the window watcher won't screw us
+ // up. We do NOT want this case looking at the JS context on the stack
+ // when searching. Compare comments on
+ // nsIDOMWindow::OpenWindow and nsIWindowWatcher::OpenWindow.
+
+ // Note: Because nsWindowWatcher is so broken, it's actually important
+ // that we don't force a system caller here, because that screws it up
+ // when it tries to compute the caller principal to associate with dialog
+ // arguments. That whole setup just really needs to be rewritten. :-(
+ Maybe<AutoNoJSAPI> nojsapi;
+ if (!aContentModal) {
+ nojsapi.emplace();
+ }
+
+ rv = pwwatch->OpenWindow2(this, url, name, options,
+ /* aCalledFromScript = */ false, aDialog,
+ aNavigate, aExtraArgument, isPopupSpamWindow,
+ forceNoOpener, forceNoReferrer, wwPrintKind,
+ aLoadState, getter_AddRefs(domReturn));
+ }
+ }
+
+ NS_ENSURE_SUCCESS(rv, rv);
+
+ // success!
+
+ if (!aCalledNoScript && !windowExists && uri && !forceNoOpener) {
+ MaybeAllowStorageForOpenedWindow(uri);
+ }
+
+ if (domReturn && aDoJSFixups) {
+ nsCOMPtr<nsIDOMChromeWindow> chrome_win(
+ do_QueryInterface(domReturn->GetDOMWindow()));
+ if (!chrome_win) {
+ // A new non-chrome window was created from a call to
+ // window.open() from JavaScript, make sure there's a document in
+ // the new window. We do this by simply asking the new window for
+ // its document, this will synchronously create an empty document
+ // if there is no document in the window.
+ // XXXbz should this just use EnsureInnerWindow()?
+
+ // Force document creation.
+ if (nsPIDOMWindowOuter* win = domReturn->GetDOMWindow()) {
+ nsCOMPtr<Document> doc = win->GetDoc();
+ Unused << doc;
+ }
+ }
+ }
+
+ domReturn.forget(aReturn);
+ return NS_OK;
+}
+
+void nsGlobalWindowOuter::MaybeAllowStorageForOpenedWindow(nsIURI* aURI) {
+ nsGlobalWindowInner* inner = GetCurrentInnerWindowInternal();
+ if (NS_WARN_IF(!inner)) {
+ return;
+ }
+
+ // No 3rd party URL/window.
+ if (!AntiTrackingUtils::IsThirdPartyWindow(inner, aURI)) {
+ return;
+ }
+
+ Document* doc = inner->GetDoc();
+ if (!doc) {
+ return;
+ }
+ nsCOMPtr<nsIPrincipal> principal = BasePrincipal::CreateContentPrincipal(
+ aURI, doc->NodePrincipal()->OriginAttributesRef());
+
+ // We don't care when the asynchronous work finishes here.
+ Unused << StorageAccessAPIHelper::AllowAccessFor(
+ principal, GetBrowsingContext(), ContentBlockingNotifier::eOpener);
+}
+
+//*****************************************************************************
+// nsGlobalWindowOuter: Helper Functions
+//*****************************************************************************
+
+already_AddRefed<nsIDocShellTreeOwner> nsPIDOMWindowOuter::GetTreeOwner() {
+ // If there's no docShellAsItem, this window must have been closed,
+ // in that case there is no tree owner.
+
+ if (!mDocShell) {
+ return nullptr;
+ }
+
+ nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+ mDocShell->GetTreeOwner(getter_AddRefs(treeOwner));
+ return treeOwner.forget();
+}
+
+already_AddRefed<nsIBaseWindow> nsPIDOMWindowOuter::GetTreeOwnerWindow() {
+ nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+
+ // If there's no mDocShell, this window must have been closed,
+ // in that case there is no tree owner.
+
+ if (mDocShell) {
+ mDocShell->GetTreeOwner(getter_AddRefs(treeOwner));
+ }
+
+ nsCOMPtr<nsIBaseWindow> baseWindow = do_QueryInterface(treeOwner);
+ return baseWindow.forget();
+}
+
+already_AddRefed<nsIWebBrowserChrome>
+nsPIDOMWindowOuter::GetWebBrowserChrome() {
+ nsCOMPtr<nsIDocShellTreeOwner> treeOwner = GetTreeOwner();
+
+ nsCOMPtr<nsIWebBrowserChrome> browserChrome = do_GetInterface(treeOwner);
+ return browserChrome.forget();
+}
+
+nsIScrollableFrame* nsGlobalWindowOuter::GetScrollFrame() {
+ if (!mDocShell) {
+ return nullptr;
+ }
+
+ PresShell* presShell = mDocShell->GetPresShell();
+ if (presShell) {
+ return presShell->GetRootScrollFrameAsScrollable();
+ }
+ return nullptr;
+}
+
+nsresult nsGlobalWindowOuter::SecurityCheckURL(const char* aURL,
+ nsIURI** aURI) {
+ nsCOMPtr<nsPIDOMWindowInner> sourceWindow =
+ do_QueryInterface(GetEntryGlobal());
+ if (!sourceWindow) {
+ sourceWindow = GetCurrentInnerWindow();
+ }
+ AutoJSContext cx;
+ nsGlobalWindowInner* sourceWin = nsGlobalWindowInner::Cast(sourceWindow);
+ JSAutoRealm ar(cx, sourceWin->GetGlobalJSObject());
+
+ // Resolve the baseURI, which could be relative to the calling window.
+ //
+ // Note the algorithm to get the base URI should match the one
+ // used to actually kick off the load in nsWindowWatcher.cpp.
+ nsCOMPtr<Document> doc = sourceWindow->GetDoc();
+ nsIURI* baseURI = nullptr;
+ auto encoding = UTF_8_ENCODING; // default to utf-8
+ if (doc) {
+ baseURI = doc->GetDocBaseURI();
+ encoding = doc->GetDocumentCharacterSet();
+ }
+ nsCOMPtr<nsIURI> uri;
+ nsresult rv = NS_NewURI(getter_AddRefs(uri), nsDependentCString(aURL),
+ encoding, baseURI);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_DOM_SYNTAX_ERR;
+ }
+
+ if (NS_FAILED(nsContentUtils::GetSecurityManager()->CheckLoadURIFromScript(
+ cx, uri))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ uri.forget(aURI);
+ return NS_OK;
+}
+
+void nsGlobalWindowOuter::FlushPendingNotifications(FlushType aType) {
+ if (mDoc) {
+ mDoc->FlushPendingNotifications(aType);
+ }
+}
+
+void nsGlobalWindowOuter::EnsureSizeAndPositionUpToDate() {
+ // If we're a subframe, make sure our size is up to date. Make sure to go
+ // through the document chain rather than the window chain to not flush on
+ // detached iframes, see bug 1545516.
+ if (mDoc && mDoc->StyleOrLayoutObservablyDependsOnParentDocumentLayout()) {
+ RefPtr<Document> parent = mDoc->GetInProcessParentDocument();
+ parent->FlushPendingNotifications(FlushType::Layout);
+ }
+}
+
+already_AddRefed<nsISupports> nsGlobalWindowOuter::SaveWindowState() {
+ MOZ_ASSERT(!mozilla::SessionHistoryInParent());
+
+ if (!mContext || !GetWrapperPreserveColor()) {
+ // The window may be getting torn down; don't bother saving state.
+ return nullptr;
+ }
+
+ nsGlobalWindowInner* inner = GetCurrentInnerWindowInternal();
+ NS_ASSERTION(inner, "No inner window to save");
+
+ if (WindowContext* wc = inner->GetWindowContext()) {
+ MOZ_ASSERT(!wc->GetWindowStateSaved());
+ Unused << wc->SetWindowStateSaved(true);
+ }
+
+ // Don't do anything else to this inner window! After this point, all
+ // calls to SetTimeoutOrInterval will create entries in the timeout
+ // list that will only run after this window has come out of the bfcache.
+ // Also, while we're frozen, we won't dispatch online/offline events
+ // to the page.
+ inner->Freeze();
+
+ nsCOMPtr<nsISupports> state = new WindowStateHolder(inner);
+
+ MOZ_LOG(gPageCacheLog, LogLevel::Debug,
+ ("saving window state, state = %p", (void*)state));
+
+ return state.forget();
+}
+
+nsresult nsGlobalWindowOuter::RestoreWindowState(nsISupports* aState) {
+ MOZ_ASSERT(!mozilla::SessionHistoryInParent());
+
+ if (!mContext || !GetWrapperPreserveColor()) {
+ // The window may be getting torn down; don't bother restoring state.
+ return NS_OK;
+ }
+
+ nsCOMPtr<WindowStateHolder> holder = do_QueryInterface(aState);
+ NS_ENSURE_TRUE(holder, NS_ERROR_FAILURE);
+
+ MOZ_LOG(gPageCacheLog, LogLevel::Debug,
+ ("restoring window state, state = %p", (void*)holder));
+
+ // And we're ready to go!
+ nsGlobalWindowInner* inner = GetCurrentInnerWindowInternal();
+
+ // if a link is focused, refocus with the FLAG_SHOWRING flag set. This makes
+ // it easy to tell which link was last clicked when going back a page.
+ RefPtr<Element> focusedElement = inner->GetFocusedElement();
+ if (nsContentUtils::ContentIsLink(focusedElement)) {
+ if (RefPtr<nsFocusManager> fm = nsFocusManager::GetFocusManager()) {
+ fm->SetFocus(focusedElement, nsIFocusManager::FLAG_NOSCROLL |
+ nsIFocusManager::FLAG_SHOWRING);
+ }
+ }
+
+ if (WindowContext* wc = inner->GetWindowContext()) {
+ MOZ_ASSERT(wc->GetWindowStateSaved());
+ Unused << wc->SetWindowStateSaved(false);
+ }
+
+ inner->Thaw();
+
+ holder->DidRestoreWindow();
+
+ return NS_OK;
+}
+
+void nsGlobalWindowOuter::AddSizeOfIncludingThis(
+ nsWindowSizes& aWindowSizes) const {
+ aWindowSizes.mDOMSizes.mDOMOtherSize +=
+ aWindowSizes.mState.mMallocSizeOf(this);
+}
+
+uint32_t nsGlobalWindowOuter::GetAutoActivateVRDisplayID() {
+ uint32_t retVal = mAutoActivateVRDisplayID;
+ mAutoActivateVRDisplayID = 0;
+ return retVal;
+}
+
+void nsGlobalWindowOuter::SetAutoActivateVRDisplayID(
+ uint32_t aAutoActivateVRDisplayID) {
+ mAutoActivateVRDisplayID = aAutoActivateVRDisplayID;
+}
+
+already_AddRefed<nsWindowRoot> nsGlobalWindowOuter::GetWindowRootOuter() {
+ nsCOMPtr<nsPIWindowRoot> root = GetTopWindowRoot();
+ return root.forget().downcast<nsWindowRoot>();
+}
+
+nsIDOMWindowUtils* nsGlobalWindowOuter::WindowUtils() {
+ if (!mWindowUtils) {
+ mWindowUtils = new nsDOMWindowUtils(this);
+ }
+ return mWindowUtils;
+}
+
+bool nsGlobalWindowOuter::IsInSyncOperation() {
+ return GetExtantDoc() && GetExtantDoc()->IsInSyncOperation();
+}
+
+// Note: This call will lock the cursor, it will not change as it moves.
+// To unlock, the cursor must be set back to Auto.
+void nsGlobalWindowOuter::SetCursorOuter(const nsACString& aCursor,
+ ErrorResult& aError) {
+ auto cursor = StyleCursorKind::Auto;
+ if (!Servo_CursorKind_Parse(&aCursor, &cursor)) {
+ // FIXME: It's a bit weird that this doesn't throw but stuff below does, but
+ // matches previous behavior so...
+ return;
+ }
+
+ RefPtr<nsPresContext> presContext;
+ if (mDocShell) {
+ presContext = mDocShell->GetPresContext();
+ }
+
+ if (presContext) {
+ // Need root widget.
+ PresShell* presShell = mDocShell->GetPresShell();
+ if (!presShell) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ nsViewManager* vm = presShell->GetViewManager();
+ if (!vm) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ nsView* rootView = vm->GetRootView();
+ if (!rootView) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ nsIWidget* widget = rootView->GetNearestWidget(nullptr);
+ if (!widget) {
+ aError.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+
+ // Call esm and set cursor.
+ aError = presContext->EventStateManager()->SetCursor(
+ cursor, nullptr, {}, Nothing(), widget, true);
+ }
+}
+
+NS_IMETHODIMP
+nsGlobalWindowOuter::GetBrowserDOMWindow(nsIBrowserDOMWindow** aBrowserWindow) {
+ MOZ_RELEASE_ASSERT(IsChromeWindow());
+ FORWARD_TO_INNER(GetBrowserDOMWindow, (aBrowserWindow), NS_ERROR_UNEXPECTED);
+}
+
+nsIBrowserDOMWindow* nsGlobalWindowOuter::GetBrowserDOMWindowOuter() {
+ MOZ_ASSERT(IsChromeWindow());
+ return mChromeFields.mBrowserDOMWindow;
+}
+
+void nsGlobalWindowOuter::SetBrowserDOMWindowOuter(
+ nsIBrowserDOMWindow* aBrowserWindow) {
+ MOZ_ASSERT(IsChromeWindow());
+ mChromeFields.mBrowserDOMWindow = aBrowserWindow;
+}
+
+ChromeMessageBroadcaster* nsGlobalWindowOuter::GetMessageManager() {
+ if (!mInnerWindow) {
+ NS_WARNING("No inner window available!");
+ return nullptr;
+ }
+ return GetCurrentInnerWindowInternal()->MessageManager();
+}
+
+ChromeMessageBroadcaster* nsGlobalWindowOuter::GetGroupMessageManager(
+ const nsAString& aGroup) {
+ if (!mInnerWindow) {
+ NS_WARNING("No inner window available!");
+ return nullptr;
+ }
+ return GetCurrentInnerWindowInternal()->GetGroupMessageManager(aGroup);
+}
+
+void nsGlobalWindowOuter::InitWasOffline() { mWasOffline = NS_IsOffline(); }
+
+#if defined(_WINDOWS_) && !defined(MOZ_WRAPPED_WINDOWS_H)
+# pragma message( \
+ "wrapper failure reason: " MOZ_WINDOWS_WRAPPER_DISABLED_REASON)
+# error "Never include unwrapped windows.h in this file!"
+#endif
+
+// Helper called by methods that move/resize the window,
+// to ensure the presContext (if any) is aware of resolution
+// change that may happen in multi-monitor configuration.
+void nsGlobalWindowOuter::CheckForDPIChange() {
+ if (mDocShell) {
+ RefPtr<nsPresContext> presContext = mDocShell->GetPresContext();
+ if (presContext) {
+ if (presContext->DeviceContext()->CheckDPIChange()) {
+ presContext->UIResolutionChanged();
+ }
+ }
+ }
+}
+
+nsresult nsGlobalWindowOuter::Dispatch(
+ TaskCategory aCategory, already_AddRefed<nsIRunnable>&& aRunnable) {
+ MOZ_RELEASE_ASSERT(NS_IsMainThread());
+ if (GetDocGroup()) {
+ return GetDocGroup()->Dispatch(aCategory, std::move(aRunnable));
+ }
+ return DispatcherTrait::Dispatch(aCategory, std::move(aRunnable));
+}
+
+nsISerialEventTarget* nsGlobalWindowOuter::EventTargetFor(
+ TaskCategory aCategory) const {
+ MOZ_RELEASE_ASSERT(NS_IsMainThread());
+ if (GetDocGroup()) {
+ return GetDocGroup()->EventTargetFor(aCategory);
+ }
+ return DispatcherTrait::EventTargetFor(aCategory);
+}
+
+AbstractThread* nsGlobalWindowOuter::AbstractMainThreadFor(
+ TaskCategory aCategory) {
+ MOZ_RELEASE_ASSERT(NS_IsMainThread());
+ if (GetDocGroup()) {
+ return GetDocGroup()->AbstractMainThreadFor(aCategory);
+ }
+ return DispatcherTrait::AbstractMainThreadFor(aCategory);
+}
+
+void nsGlobalWindowOuter::MaybeResetWindowName(Document* aNewDocument) {
+ MOZ_ASSERT(aNewDocument);
+
+ if (!StaticPrefs::privacy_window_name_update_enabled()) {
+ return;
+ }
+
+ const LoadingSessionHistoryInfo* info =
+ nsDocShell::Cast(mDocShell)->GetLoadingSessionHistoryInfo();
+ if (!info || info->mForceMaybeResetName.isNothing()) {
+ // We only reset the window name for the top-level content as well as
+ // storing in session entries.
+ if (!GetBrowsingContext()->IsTopContent()) {
+ return;
+ }
+
+ // Following implements https://html.spec.whatwg.org/#history-traversal:
+ // Step 4.2. Check if the loading document has a different origin than the
+ // previous document.
+
+ // We don't need to do anything if we haven't loaded a non-initial document.
+ if (!GetBrowsingContext()->GetHasLoadedNonInitialDocument()) {
+ return;
+ }
+
+ // If we have an existing document, directly check the document prinicpals
+ // with the new document to know if it is cross-origin.
+ //
+ // Note that there will be an issue of initial document handling in Fission
+ // when running the WPT unset_context_name-1.html. In the test, the first
+ // about:blank page would be loaded with the principal of the testing domain
+ // in Fission and the window.name will be set there. Then, The window.name
+ // won't be reset after navigating to the testing page because the principal
+ // is the same. But, it won't be the case for non-Fission mode that the
+ // first about:blank will be loaded with a null principal and the
+ // window.name will be reset when loading the test page.
+ if (mDoc && mDoc->NodePrincipal()->Equals(aNewDocument->NodePrincipal())) {
+ return;
+ }
+
+ // If we don't have an existing document, and if it's not the initial
+ // about:blank, we could be loading a document because of the
+ // process-switching. In this case, this should be a cross-origin
+ // navigation.
+ } else if (!info->mForceMaybeResetName.ref()) {
+ return;
+ }
+
+ // Step 4.2.2 Store the window.name into all session history entries that have
+ // the same origin as the previous document.
+ nsDocShell::Cast(mDocShell)->StoreWindowNameToSHEntries();
+
+ // Step 4.2.3 Clear the window.name if the browsing context is the top-level
+ // content and doesn't have an opener.
+
+ // We need to reset the window name in case of a cross-origin navigation,
+ // without an opener.
+ RefPtr<BrowsingContext> opener = GetOpenerBrowsingContext();
+ if (opener) {
+ return;
+ }
+
+ Unused << mBrowsingContext->SetName(EmptyString());
+}
+
+nsGlobalWindowOuter::TemporarilyDisableDialogs::TemporarilyDisableDialogs(
+ BrowsingContext* aBC) {
+ BrowsingContextGroup* group = aBC->Group();
+ if (!group) {
+ NS_ERROR(
+ "nsGlobalWindowOuter::TemporarilyDisableDialogs called without a "
+ "browsing context group?");
+ return;
+ }
+
+ if (group) {
+ mGroup = group;
+ mSavedDialogsEnabled = group->GetAreDialogsEnabled();
+ group->SetAreDialogsEnabled(false);
+ }
+}
+
+nsGlobalWindowOuter::TemporarilyDisableDialogs::~TemporarilyDisableDialogs() {
+ if (mGroup) {
+ mGroup->SetAreDialogsEnabled(mSavedDialogsEnabled);
+ }
+}
+
+/* static */
+already_AddRefed<nsGlobalWindowOuter> nsGlobalWindowOuter::Create(
+ nsDocShell* aDocShell, bool aIsChrome) {
+ uint64_t outerWindowID = aDocShell->GetOuterWindowID();
+ RefPtr<nsGlobalWindowOuter> window = new nsGlobalWindowOuter(outerWindowID);
+ if (aIsChrome) {
+ window->mIsChrome = true;
+ }
+ window->SetDocShell(aDocShell);
+
+ window->InitWasOffline();
+ return window.forget();
+}
+
+nsIURI* nsPIDOMWindowOuter::GetDocumentURI() const {
+ return mDoc ? mDoc->GetDocumentURI() : mDocumentURI.get();
+}
+
+void nsPIDOMWindowOuter::MaybeCreateDoc() {
+ MOZ_ASSERT(!mDoc);
+ if (nsIDocShell* docShell = GetDocShell()) {
+ // Note that |document| here is the same thing as our mDoc, but we
+ // don't have to explicitly set the member variable because the docshell
+ // has already called SetNewDocument().
+ nsCOMPtr<Document> document = docShell->GetDocument();
+ Unused << document;
+ }
+}
+
+void nsPIDOMWindowOuter::SetChromeEventHandlerInternal(
+ EventTarget* aChromeEventHandler) {
+ // Out-of-line so we don't need to include ContentFrameMessageManager.h in
+ // nsPIDOMWindow.h.
+ mChromeEventHandler = aChromeEventHandler;
+
+ // mParentTarget and mMessageManager will be set when the next event is
+ // dispatched or someone asks for our message manager.
+ mParentTarget = nullptr;
+ mMessageManager = nullptr;
+}
+
+mozilla::dom::DocGroup* nsPIDOMWindowOuter::GetDocGroup() const {
+ Document* doc = GetExtantDoc();
+ if (doc) {
+ return doc->GetDocGroup();
+ }
+ return nullptr;
+}
+
+nsPIDOMWindowOuter::nsPIDOMWindowOuter(uint64_t aWindowID)
+ : mFrameElement(nullptr),
+ mModalStateDepth(0),
+ mSuppressEventHandlingDepth(0),
+ mIsBackground(false),
+ mIsRootOuterWindow(false),
+ mInnerWindow(nullptr),
+ mWindowID(aWindowID),
+ mMarkedCCGeneration(0) {}
+
+nsPIDOMWindowOuter::~nsPIDOMWindowOuter() = default;