/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/* vim: set ts=8 sts=4 et sw=4 tw=99: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "XrayWrapper.h"
#include "AccessCheck.h"
#include "WrapperFactory.h"

#include "nsDependentString.h"
#include "nsIScriptError.h"
#include "mozilla/dom/Element.h"
#include "mozilla/dom/ScriptSettings.h"

#include "XPCWrapper.h"
#include "xpcprivate.h"

#include "jsapi.h"
#include "nsJSUtils.h"
#include "nsPrintfCString.h"

#include "mozilla/dom/BindingUtils.h"
#include "mozilla/dom/WindowBinding.h"
#include "mozilla/dom/XrayExpandoClass.h"
#include "nsGlobalWindow.h"

using namespace mozilla::dom;
using namespace JS;
using namespace mozilla;

using js::BaseProxyHandler;
using js::CheckedUnwrap;
using js::IsCrossCompartmentWrapper;
using js::UncheckedUnwrap;
using js::Wrapper;

namespace xpc {

using namespace XrayUtils;

#define Between(x, a, b) (a <= x && x <= b)

static_assert(JSProto_URIError - JSProto_Error == 7,
              "New prototype added in error object range");
#define AssertErrorObjectKeyInBounds(key)                      \
  static_assert(Between(key, JSProto_Error, JSProto_URIError), \
                "We depend on js/ProtoKey.h ordering here");
MOZ_FOR_EACH(AssertErrorObjectKeyInBounds, (),
             (JSProto_Error, JSProto_InternalError, JSProto_EvalError,
              JSProto_RangeError, JSProto_ReferenceError, JSProto_SyntaxError,
              JSProto_TypeError, JSProto_URIError));

static_assert(JSProto_Uint8ClampedArray - JSProto_Int8Array == 8,
              "New prototype added in typed array range");
#define AssertTypedArrayKeyInBounds(key)                                    \
  static_assert(Between(key, JSProto_Int8Array, JSProto_Uint8ClampedArray), \
                "We depend on js/ProtoKey.h ordering here");
MOZ_FOR_EACH(AssertTypedArrayKeyInBounds, (),
             (JSProto_Int8Array, JSProto_Uint8Array, JSProto_Int16Array,
              JSProto_Uint16Array, JSProto_Int32Array, JSProto_Uint32Array,
              JSProto_Float32Array, JSProto_Float64Array,
              JSProto_Uint8ClampedArray));

#undef Between

inline bool IsErrorObjectKey(JSProtoKey key) {
  return key >= JSProto_Error && key <= JSProto_URIError;
}

inline bool IsTypedArrayKey(JSProtoKey key) {
  return key >= JSProto_Int8Array && key <= JSProto_Uint8ClampedArray;
}

// Whitelist for the standard ES classes we can Xray to.
static bool IsJSXraySupported(JSProtoKey key) {
  if (IsTypedArrayKey(key)) return true;
  if (IsErrorObjectKey(key)) return true;
  switch (key) {
    case JSProto_Date:
    case JSProto_DataView:
    case JSProto_Object:
    case JSProto_Array:
    case JSProto_Function:
    case JSProto_TypedArray:
    case JSProto_SavedFrame:
    case JSProto_RegExp:
    case JSProto_Promise:
    case JSProto_ArrayBuffer:
    case JSProto_SharedArrayBuffer:
    case JSProto_Map:
    case JSProto_Set:
      return true;
    default:
      return false;
  }
}

XrayType GetXrayType(JSObject* obj) {
  obj = js::UncheckedUnwrap(obj, /* stopAtWindowProxy = */ false);
  if (mozilla::dom::UseDOMXray(obj)) return XrayForDOMObject;

  const js::Class* clasp = js::GetObjectClass(obj);
  if (IS_WN_CLASS(clasp) || js::IsWindowProxy(obj)) return XrayForWrappedNative;

  JSProtoKey standardProto = IdentifyStandardInstanceOrPrototype(obj);
  if (IsJSXraySupported(standardProto)) return XrayForJSObject;

  // Modulo a few exceptions, everything else counts as an XrayWrapper to an
  // opaque object, which means that more-privileged code sees nothing from
  // the underlying object. This is very important for security. In some cases
  // though, we need to make an exception for compatibility.
  if (IsSandbox(obj)) return NotXray;

  return XrayForOpaqueObject;
}

JSObject* XrayAwareCalleeGlobal(JSObject* fun) {
  MOZ_ASSERT(js::IsFunctionObject(fun));

  if (!js::FunctionHasNativeReserved(fun)) {
    // Just a normal function, no Xrays involved.
    return js::GetGlobalForObjectCrossCompartment(fun);
  }

  // The functions we expect here have the Xray wrapper they're associated with
  // in their XRAY_DOM_FUNCTION_PARENT_WRAPPER_SLOT and, in a debug build,
  // themselves in their XRAY_DOM_FUNCTION_NATIVE_SLOT_FOR_SELF.  Assert that
  // last bit.
  MOZ_ASSERT(&js::GetFunctionNativeReserved(
                  fun, XRAY_DOM_FUNCTION_NATIVE_SLOT_FOR_SELF)
                  .toObject() == fun);

  Value v =
      js::GetFunctionNativeReserved(fun, XRAY_DOM_FUNCTION_PARENT_WRAPPER_SLOT);
  MOZ_ASSERT(IsXrayWrapper(&v.toObject()));

  JSObject* xrayTarget = js::UncheckedUnwrap(&v.toObject());
  return js::GetGlobalForObjectCrossCompartment(xrayTarget);
}

bool XrayAwareCalleeGlobalForSpecializedGetters(
    JSContext* cx, JS::Handle<JSObject*> thisObj,
    JS::MutableHandle<JSObject*> global) {
  JS::Rooted<JSObject*> wrappedObj(cx, thisObj);
  if (!JS_WrapObject(cx, &wrappedObj)) {
    return false;
  }

  if (xpc::WrapperFactory::IsXrayWrapper(wrappedObj)) {
    // Our current compartment would generaly get xrays to thisObj.  That
    // means we're presumably doing a call over Xrays, an the compartment of
    // the callee is presumably that of thisObj.  This isn't _necessarily_
    // true (e.g. chrome code could be using a chrome-side getter and doing
    // .call() with a content-side this value), but people shouldn't do
    // that!
    //
    // If someoen does do something weird here, the only impact is that we
    // will create the rejected promise that a promise-returning getter
    // creates around any exceptions it throws in the "wrong" compartment.
    // In particular, we might create it in the content compartment even
    // though we should really have created it in the chrome compartment
    // (for the case when a chrome getter is invoked with a content object
    // instead of just invoking the xrayed getter).
    global.set(js::GetGlobalForObjectCrossCompartment(thisObj));
    return true;
  }

  global.set(JS::CurrentGlobalOrNull(cx));
  return true;
}

JSObject* XrayTraits::getExpandoChain(HandleObject obj) {
  return ObjectScope(obj)->GetExpandoChain(obj);
}

JSObject* XrayTraits::detachExpandoChain(HandleObject obj) {
  return ObjectScope(obj)->DetachExpandoChain(obj);
}

bool XrayTraits::setExpandoChain(JSContext* cx, HandleObject obj,
                                 HandleObject chain) {
  return ObjectScope(obj)->SetExpandoChain(cx, obj, chain);
}

// static
XPCWrappedNative* XPCWrappedNativeXrayTraits::getWN(JSObject* wrapper) {
  return XPCWrappedNative::Get(getTargetObject(wrapper));
}

const JSClass XPCWrappedNativeXrayTraits::HolderClass = {
    "NativePropertyHolder",
    JSCLASS_HAS_RESERVED_SLOTS(HOLDER_SHARED_SLOT_COUNT)};

const JSClass XrayTraits::HolderClass = {
    "XrayHolder", JSCLASS_HAS_RESERVED_SLOTS(HOLDER_SHARED_SLOT_COUNT)};

const JSClass JSXrayTraits::HolderClass = {
    "JSXrayHolder", JSCLASS_HAS_RESERVED_SLOTS(SLOT_COUNT)};

bool OpaqueXrayTraits::resolveOwnProperty(
    JSContext* cx, HandleObject wrapper, HandleObject target,
    HandleObject holder, HandleId id, MutableHandle<PropertyDescriptor> desc) {
  bool ok =
      XrayTraits::resolveOwnProperty(cx, wrapper, target, holder, id, desc);
  if (!ok || desc.object()) return ok;

  return ReportWrapperDenial(cx, id, WrapperDenialForXray,
                             "object is not safely Xrayable");
}

bool ReportWrapperDenial(JSContext* cx, HandleId id, WrapperDenialType type,
                         const char* reason) {
  CompartmentPrivate* priv = CompartmentPrivate::Get(CurrentGlobalOrNull(cx));
  bool alreadyWarnedOnce = priv->wrapperDenialWarnings[type];
  priv->wrapperDenialWarnings[type] = true;

  // The browser console warning is only emitted for the first violation,
  // whereas the (debug-only) NS_WARNING is emitted for each violation.
#ifndef DEBUG
  if (alreadyWarnedOnce) return true;
#endif

  nsAutoJSString propertyName;
  RootedValue idval(cx);
  if (!JS_IdToValue(cx, id, &idval)) return false;
  JSString* str = JS_ValueToSource(cx, idval);
  if (!str) return false;
  if (!propertyName.init(cx, str)) return false;
  AutoFilename filename;
  unsigned line = 0, column = 0;
  DescribeScriptedCaller(cx, &filename, &line, &column);

  // Warn to the terminal for the logs.
  NS_WARNING(
      nsPrintfCString("Silently denied access to property %s: %s (@%s:%u:%u)",
                      NS_LossyConvertUTF16toASCII(propertyName).get(), reason,
                      filename.get(), line, column)
          .get());

  // If this isn't the first warning on this topic for this global, we've
  // already bailed out in opt builds. Now that the NS_WARNING is done, bail
  // out in debug builds as well.
  if (alreadyWarnedOnce) return true;

  //
  // Log a message to the console service.
  //

  // Grab the pieces.
  nsCOMPtr<nsIConsoleService> consoleService =
      do_GetService(NS_CONSOLESERVICE_CONTRACTID);
  NS_ENSURE_TRUE(consoleService, true);
  nsCOMPtr<nsIScriptError> errorObject =
      do_CreateInstance(NS_SCRIPTERROR_CONTRACTID);
  NS_ENSURE_TRUE(errorObject, true);

  // Compute the current window id if any.
  uint64_t windowId = 0;
  nsGlobalWindowInner* win = WindowGlobalOrNull(CurrentGlobalOrNull(cx));
  if (win) windowId = win->WindowID();

  Maybe<nsPrintfCString> errorMessage;
  if (type == WrapperDenialForXray) {
    errorMessage.emplace(
        "XrayWrapper denied access to property %s (reason: %s). "
        "See https://developer.mozilla.org/en-US/docs/Xray_vision "
        "for more information. Note that only the first denied "
        "property access from a given global object will be reported.",
        NS_LossyConvertUTF16toASCII(propertyName).get(), reason);
  } else {
    MOZ_ASSERT(type == WrapperDenialForCOW);
    errorMessage.emplace(
        "Security wrapper denied access to property %s on privileged "
        "Javascript object. Support for exposing privileged objects "
        "to untrusted content via __exposedProps__ has been "
        "removed - use WebIDL bindings or Components.utils.cloneInto "
        "instead. Note that only the first denied property access from a "
        "given global object will be reported.",
        NS_LossyConvertUTF16toASCII(propertyName).get());
  }
  nsString filenameStr(NS_ConvertASCIItoUTF16(filename.get()));
  nsresult rv = errorObject->InitWithWindowID(
      NS_ConvertASCIItoUTF16(errorMessage.ref()), filenameStr, EmptyString(),
      line, column, nsIScriptError::warningFlag, "XPConnect", windowId);
  NS_ENSURE_SUCCESS(rv, true);
  rv = consoleService->LogMessage(errorObject);
  NS_ENSURE_SUCCESS(rv, true);

  return true;
}

bool JSXrayTraits::getOwnPropertyFromWrapperIfSafe(
    JSContext* cx, HandleObject wrapper, HandleId id,
    MutableHandle<PropertyDescriptor> outDesc) {
  MOZ_ASSERT(js::IsObjectInContextCompartment(wrapper, cx));
  RootedObject target(cx, getTargetObject(wrapper));
  {
    JSAutoCompartment ac(cx, target);
    JS_MarkCrossZoneId(cx, id);
    if (!getOwnPropertyFromTargetIfSafe(cx, target, wrapper, id, outDesc))
      return false;
  }
  return JS_WrapPropertyDescriptor(cx, outDesc);
}

bool JSXrayTraits::getOwnPropertyFromTargetIfSafe(
    JSContext* cx, HandleObject target, HandleObject wrapper, HandleId id,
    MutableHandle<PropertyDescriptor> outDesc) {
  // Note - This function operates in the target compartment, because it
  // avoids a bunch of back-and-forth wrapping in enumerateNames.
  MOZ_ASSERT(getTargetObject(wrapper) == target);
  MOZ_ASSERT(js::IsObjectInContextCompartment(target, cx));
  MOZ_ASSERT(WrapperFactory::IsXrayWrapper(wrapper));
  MOZ_ASSERT(outDesc.object() == nullptr);

  Rooted<PropertyDescriptor> desc(cx);
  if (!JS_GetOwnPropertyDescriptorById(cx, target, id, &desc)) return false;

  // If the property doesn't exist at all, we're done.
  if (!desc.object()) return true;

  // Disallow accessor properties.
  if (desc.hasGetterOrSetter()) {
    JSAutoCompartment ac(cx, wrapper);
    JS_MarkCrossZoneId(cx, id);
    return ReportWrapperDenial(cx, id, WrapperDenialForXray,
                               "property has accessor");
  }

  // Apply extra scrutiny to objects.
  if (desc.value().isObject()) {
    RootedObject propObj(cx, js::UncheckedUnwrap(&desc.value().toObject()));
    JSAutoCompartment ac(cx, propObj);

    // Disallow non-subsumed objects.
    if (!AccessCheck::subsumes(target, propObj)) {
      JSAutoCompartment ac(cx, wrapper);
      JS_MarkCrossZoneId(cx, id);
      return ReportWrapperDenial(cx, id, WrapperDenialForXray,
                                 "value not same-origin with target");
    }

    // Disallow non-Xrayable objects.
    XrayType xrayType = GetXrayType(propObj);
    if (xrayType == NotXray || xrayType == XrayForOpaqueObject) {
      JSAutoCompartment ac(cx, wrapper);
      JS_MarkCrossZoneId(cx, id);
      return ReportWrapperDenial(cx, id, WrapperDenialForXray,
                                 "value not Xrayable");
    }

    // Disallow callables.
    if (JS::IsCallable(propObj)) {
      JSAutoCompartment ac(cx, wrapper);
      JS_MarkCrossZoneId(cx, id);
      return ReportWrapperDenial(cx, id, WrapperDenialForXray,
                                 "value is callable");
    }
  }

  // Disallow any property that shadows something on its (Xrayed)
  // prototype chain.
  JSAutoCompartment ac2(cx, wrapper);
  JS_MarkCrossZoneId(cx, id);
  RootedObject proto(cx);
  bool foundOnProto = false;
  if (!JS_GetPrototype(cx, wrapper, &proto) ||
      (proto && !JS_HasPropertyById(cx, proto, id, &foundOnProto))) {
    return false;
  }
  if (foundOnProto)
    return ReportWrapperDenial(
        cx, id, WrapperDenialForXray,
        "value shadows a property on the standard prototype");

  // We made it! Assign over the descriptor, and don't forget to wrap.
  outDesc.assign(desc.get());
  return true;
}

// Returns true on success (in the JSAPI sense), false on failure.  If true is
// returned, desc.object() will indicate whether we actually resolved
// the property.
//
// id is the property id we're looking for.
// holder is the object to define the property on.
// fs is the relevant JSFunctionSpec*.
// ps is the relevant JSPropertySpec*.
// desc is the descriptor we're resolving into.
static bool TryResolvePropertyFromSpecs(
    JSContext* cx, HandleId id, HandleObject holder, const JSFunctionSpec* fs,
    const JSPropertySpec* ps, MutableHandle<PropertyDescriptor> desc) {
  // Scan through the functions.
  const JSFunctionSpec* fsMatch = nullptr;
  for (; fs && fs->name; ++fs) {
    if (PropertySpecNameEqualsId(fs->name, id)) {
      fsMatch = fs;
      break;
    }
  }
  if (fsMatch) {
    // Generate an Xrayed version of the method.
    RootedFunction fun(cx, JS::NewFunctionFromSpec(cx, fsMatch, id));
    if (!fun) return false;

    // The generic Xray machinery only defines non-own properties of the target
    // on the holder. This is broken, and will be fixed at some point, but for
    // now we need to cache the value explicitly. See the corresponding call to
    // JS_GetOwnPropertyDescriptorById at the top of
    // JSXrayTraits::resolveOwnProperty.
    RootedObject funObj(cx, JS_GetFunctionObject(fun));
    return JS_DefinePropertyById(cx, holder, id, funObj, 0) &&
           JS_GetOwnPropertyDescriptorById(cx, holder, id, desc);
  }

  // Scan through the properties.
  const JSPropertySpec* psMatch = nullptr;
  for (; ps && ps->name; ++ps) {
    if (PropertySpecNameEqualsId(ps->name, id)) {
      psMatch = ps;
      break;
    }
  }
  if (psMatch) {
    // The generic Xray machinery only defines non-own properties on the holder.
    // This is broken, and will be fixed at some point, but for now we need to
    // cache the value explicitly. See the corresponding call to
    // JS_GetPropertyById at the top of JSXrayTraits::resolveOwnProperty.
    //
    // Note also that the public-facing API here doesn't give us a way to
    // pass along JITInfo. It's probably ok though, since Xrays are already
    // pretty slow.
    desc.value().setUndefined();
    unsigned flags = psMatch->flags;
    if (psMatch->isAccessor()) {
      RootedFunction getterObj(cx);
      RootedFunction setterObj(cx);
      if (psMatch->isSelfHosted()) {
        getterObj = JS::GetSelfHostedFunction(
            cx, psMatch->accessors.getter.selfHosted.funname, id, 0);
        if (!getterObj) return false;
        desc.setGetterObject(JS_GetFunctionObject(getterObj));
        if (psMatch->accessors.setter.selfHosted.funname) {
          MOZ_ASSERT(flags & JSPROP_SETTER);
          setterObj = JS::GetSelfHostedFunction(
              cx, psMatch->accessors.setter.selfHosted.funname, id, 0);
          if (!setterObj) return false;
          desc.setSetterObject(JS_GetFunctionObject(setterObj));
        }
      } else {
        desc.setGetter(
            JS_CAST_NATIVE_TO(psMatch->accessors.getter.native.op, JSGetterOp));
        desc.setSetter(
            JS_CAST_NATIVE_TO(psMatch->accessors.setter.native.op, JSSetterOp));
      }
      desc.setAttributes(flags);
      if (!JS_DefinePropertyById(cx, holder, id,
                                 JS_PROPERTYOP_GETTER(desc.getter()),
                                 JS_PROPERTYOP_SETTER(desc.setter()),
                                 // This particular descriptor, unlike most,
                                 // actually stores JSNatives directly,
                                 // since we just set it up.  Do NOT pass
                                 // JSPROP_PROPOP_ACCESSORS here!
                                 desc.attributes())) {
        return false;
      }
    } else {
      RootedValue v(cx);
      if (!psMatch->getValue(cx, &v)) return false;
      if (!JS_DefinePropertyById(cx, holder, id, v,
                                 flags & ~JSPROP_INTERNAL_USE_BIT))
        return false;
    }

    return JS_GetOwnPropertyDescriptorById(cx, holder, id, desc);
  }

  return true;
}

static bool ShouldResolveStaticProperties(JSProtoKey key) {
  // Don't try to resolve static properties on RegExp, because they
  // have issues.  In particular, some of them grab state off the
  // global of the RegExp constructor that describes the last regexp
  // evaluation in that global, which is not a useful thing to do
  // over Xrays.
  return key != JSProto_RegExp;
}

bool JSXrayTraits::resolveOwnProperty(JSContext* cx, HandleObject wrapper,
                                      HandleObject target, HandleObject holder,
                                      HandleId id,
                                      MutableHandle<PropertyDescriptor> desc) {
  // Call the common code.
  bool ok =
      XrayTraits::resolveOwnProperty(cx, wrapper, target, holder, id, desc);
  if (!ok || desc.object()) return ok;

  // The non-HasPrototypes semantics implemented by traditional Xrays are kind
  // of broken with respect to |own|-ness and the holder. The common code
  // muddles through by only checking the holder for non-|own| lookups, but
  // that doesn't work for us. So we do an explicit holder check here, and hope
  // that this mess gets fixed up soon.
  if (!JS_GetOwnPropertyDescriptorById(cx, holder, id, desc)) return false;
  if (desc.object()) {
    desc.object().set(wrapper);
    return true;
  }

  JSProtoKey key = getProtoKey(holder);
  if (!isPrototype(holder)) {
    // For Object and Array instances, we expose some properties from the
    // underlying object, but only after filtering them carefully.
    //
    // Note that, as far as JS observables go, Arrays are just Objects with
    // a different prototype and a magic (own, non-configurable) |.length| that
    // serves as a non-tight upper bound on |own| indexed properties. So while
    // it's tempting to try to impose some sort of structure on what Arrays
    // "should" look like over Xrays, the underlying object is squishy enough
    // that it makes sense to just treat them like Objects for Xray purposes.
    if (key == JSProto_Object || key == JSProto_Array) {
      return getOwnPropertyFromWrapperIfSafe(cx, wrapper, id, desc);
    }
    if (IsTypedArrayKey(key)) {
      if (IsArrayIndex(GetArrayIndexFromId(cx, id))) {
        // WebExtensions can't use cloneInto(), so we just let them do
        // the slow thing to maximize compatibility.
        if (CompartmentPrivate::Get(CurrentGlobalOrNull(cx))
                ->isWebExtensionContentScript) {
          Rooted<PropertyDescriptor> innerDesc(cx);
          {
            JSAutoCompartment ac(cx, target);
            JS_MarkCrossZoneId(cx, id);
            if (!JS_GetOwnPropertyDescriptorById(cx, target, id, &innerDesc))
              return false;
          }
          if (innerDesc.isDataDescriptor() && innerDesc.value().isNumber()) {
            desc.setValue(innerDesc.value());
            desc.object().set(wrapper);
          }
          return true;
        }
        JS_ReportErrorASCII(
            cx,
            "Accessing TypedArray data over Xrays is slow, and forbidden "
            "in order to encourage performant code. To copy TypedArrays "
            "across origin boundaries, consider using "
            "Components.utils.cloneInto().");
        return false;
      }
    } else if (key == JSProto_Function) {
      if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_LENGTH)) {
        FillPropertyDescriptor(
            desc, wrapper, JSPROP_PERMANENT | JSPROP_READONLY,
            NumberValue(JS_GetFunctionArity(JS_GetObjectFunction(target))));
        return true;
      }
      if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_NAME)) {
        RootedString fname(cx, JS_GetFunctionId(JS_GetObjectFunction(target)));
        if (fname) JS_MarkCrossZoneIdValue(cx, StringValue(fname));
        FillPropertyDescriptor(
            desc, wrapper, JSPROP_PERMANENT | JSPROP_READONLY,
            fname ? StringValue(fname) : JS_GetEmptyStringValue(cx));
      } else {
        // Look for various static properties/methods and the
        // 'prototype' property.
        JSProtoKey standardConstructor = constructorFor(holder);
        if (standardConstructor != JSProto_Null) {
          // Handle the 'prototype' property to make
          // xrayedGlobal.StandardClass.prototype work.
          if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_PROTOTYPE)) {
            RootedObject standardProto(cx);
            {
              JSAutoCompartment ac(cx, target);
              if (!JS_GetClassPrototype(cx, standardConstructor,
                                        &standardProto))
                return false;
              MOZ_ASSERT(standardProto);
            }

            if (!JS_WrapObject(cx, &standardProto)) return false;
            FillPropertyDescriptor(desc, wrapper,
                                   JSPROP_PERMANENT | JSPROP_READONLY,
                                   ObjectValue(*standardProto));
            return true;
          }

          if (ShouldResolveStaticProperties(standardConstructor)) {
            const js::Class* clasp = js::ProtoKeyToClass(standardConstructor);
            MOZ_ASSERT(clasp->specDefined());

            if (!TryResolvePropertyFromSpecs(
                    cx, id, holder, clasp->specConstructorFunctions(),
                    clasp->specConstructorProperties(), desc)) {
              return false;
            }

            if (desc.object()) {
              desc.object().set(wrapper);
              return true;
            }
          }
        }
      }
    } else if (IsErrorObjectKey(key)) {
      // The useful state of error objects (except for .stack) is
      // (unfortunately) represented as own data properties per-spec. This
      // means that we can't have a a clean representation of the data
      // (free from tampering) without doubling the slots of Error
      // objects, which isn't great. So we forward these properties to the
      // underlying object and then just censor any values with the wrong
      // type. This limits the ability of content to do anything all that
      // confusing.
      bool isErrorIntProperty =
          id == GetJSIDByIndex(cx, XPCJSContext::IDX_LINENUMBER) ||
          id == GetJSIDByIndex(cx, XPCJSContext::IDX_COLUMNNUMBER);
      bool isErrorStringProperty =
          id == GetJSIDByIndex(cx, XPCJSContext::IDX_FILENAME) ||
          id == GetJSIDByIndex(cx, XPCJSContext::IDX_MESSAGE);
      if (isErrorIntProperty || isErrorStringProperty) {
        RootedObject waiver(cx, wrapper);
        if (!WrapperFactory::WaiveXrayAndWrap(cx, &waiver)) return false;
        if (!JS_GetOwnPropertyDescriptorById(cx, waiver, id, desc))
          return false;
        bool valueMatchesType =
            (isErrorIntProperty && desc.value().isInt32()) ||
            (isErrorStringProperty && desc.value().isString());
        if (desc.hasGetterOrSetter() || !valueMatchesType)
          FillPropertyDescriptor(desc, nullptr, 0, UndefinedValue());
        return true;
      }
    } else if (key == JSProto_RegExp) {
      if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_LASTINDEX))
        return getOwnPropertyFromWrapperIfSafe(cx, wrapper, id, desc);
    }

    // The rest of this function applies only to prototypes.
    return true;
  }

  // Handle the 'constructor' property.
  if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_CONSTRUCTOR)) {
    RootedObject constructor(cx);
    {
      JSAutoCompartment ac(cx, target);
      if (!JS_GetClassObject(cx, key, &constructor)) return false;
    }
    if (!JS_WrapObject(cx, &constructor)) return false;
    desc.object().set(wrapper);
    desc.setAttributes(0);
    desc.setGetter(nullptr);
    desc.setSetter(nullptr);
    desc.value().setObject(*constructor);
    return true;
  }

  // Grab the JSClass. We require all Xrayable classes to have a ClassSpec.
  const js::Class* clasp = js::GetObjectClass(target);
  MOZ_ASSERT(clasp->specDefined());

  // Indexed array properties are handled above, so we can just work with the
  // class spec here.
  if (!TryResolvePropertyFromSpecs(cx, id, holder,
                                   clasp->specPrototypeFunctions(),
                                   clasp->specPrototypeProperties(), desc)) {
    return false;
  }

  if (desc.object()) {
    desc.object().set(wrapper);
  }

  return true;
}

bool JSXrayTraits::delete_(JSContext* cx, HandleObject wrapper, HandleId id,
                           ObjectOpResult& result) {
  RootedObject holder(cx, ensureHolder(cx, wrapper));
  if (!holder) return false;

  // If we're using Object Xrays, we allow callers to attempt to delete any
  // property from the underlying object that they are able to resolve. Note
  // that this deleting may fail if the property is non-configurable.
  JSProtoKey key = getProtoKey(holder);
  bool isObjectOrArrayInstance =
      (key == JSProto_Object || key == JSProto_Array) && !isPrototype(holder);
  if (isObjectOrArrayInstance) {
    RootedObject target(cx, getTargetObject(wrapper));
    JSAutoCompartment ac(cx, target);
    JS_MarkCrossZoneId(cx, id);
    Rooted<PropertyDescriptor> desc(cx);
    if (!getOwnPropertyFromTargetIfSafe(cx, target, wrapper, id, &desc))
      return false;
    if (desc.object()) return JS_DeletePropertyById(cx, target, id, result);
  }
  return result.succeed();
}

bool JSXrayTraits::defineProperty(JSContext* cx, HandleObject wrapper,
                                  HandleId id, Handle<PropertyDescriptor> desc,
                                  Handle<PropertyDescriptor> existingDesc,
                                  ObjectOpResult& result, bool* defined) {
  *defined = false;
  RootedObject holder(cx, ensureHolder(cx, wrapper));
  if (!holder) return false;

  // Object and Array instances are special. For those cases, we forward
  // property definitions to the underlying object if the following
  // conditions are met:
  // * The property being defined is a value-prop.
  // * The property being defined is either a primitive or subsumed by the
  //   target.
  // * As seen from the Xray, any existing property that we would overwrite
  //   is an |own| value-prop.
  //
  // To avoid confusion, we disallow expandos on Object and Array instances, and
  // therefore raise an exception here if the above conditions aren't met.
  JSProtoKey key = getProtoKey(holder);
  bool isInstance = !isPrototype(holder);
  bool isObjectOrArray = (key == JSProto_Object || key == JSProto_Array);
  if (isObjectOrArray && isInstance) {
    RootedObject target(cx, getTargetObject(wrapper));
    if (desc.hasGetterOrSetter()) {
      JS_ReportErrorASCII(cx,
                          "Not allowed to define accessor property on [Object] "
                          "or [Array] XrayWrapper");
      return false;
    }
    if (desc.value().isObject() &&
        !AccessCheck::subsumes(target,
                               js::UncheckedUnwrap(&desc.value().toObject()))) {
      JS_ReportErrorASCII(cx,
                          "Not allowed to define cross-origin object as "
                          "property on [Object] or [Array] XrayWrapper");
      return false;
    }
    if (existingDesc.hasGetterOrSetter()) {
      JS_ReportErrorASCII(cx,
                          "Not allowed to overwrite accessor property on "
                          "[Object] or [Array] XrayWrapper");
      return false;
    }
    if (existingDesc.object() && existingDesc.object() != wrapper) {
      JS_ReportErrorASCII(cx,
                          "Not allowed to shadow non-own Xray-resolved "
                          "property on [Object] or [Array] XrayWrapper");
      return false;
    }

    Rooted<PropertyDescriptor> wrappedDesc(cx, desc);
    JSAutoCompartment ac(cx, target);
    JS_MarkCrossZoneId(cx, id);
    if (!JS_WrapPropertyDescriptor(cx, &wrappedDesc) ||
        !JS_DefinePropertyById(cx, target, id, wrappedDesc, result)) {
      return false;
    }
    *defined = true;
    return true;
  }

  // For WebExtensions content scripts, we forward the definition of indexed
  // properties. By validating that the key and value are both numbers, we can
  // avoid doing any wrapping.
  if (isInstance && IsTypedArrayKey(key) &&
      CompartmentPrivate::Get(JS::CurrentGlobalOrNull(cx))
          ->isWebExtensionContentScript &&
      desc.isDataDescriptor() &&
      (desc.value().isNumber() || desc.value().isUndefined()) &&
      IsArrayIndex(GetArrayIndexFromId(cx, id))) {
    RootedObject target(cx, getTargetObject(wrapper));
    JSAutoCompartment ac(cx, target);
    JS_MarkCrossZoneId(cx, id);
    if (!JS_DefinePropertyById(cx, target, id, desc, result)) return false;
    *defined = true;
    return true;
  }

  return true;
}

static bool MaybeAppend(jsid id, unsigned flags, AutoIdVector& props) {
  MOZ_ASSERT(!(flags & JSITER_SYMBOLSONLY));
  if (!(flags & JSITER_SYMBOLS) && JSID_IS_SYMBOL(id)) return true;
  return props.append(id);
}

// Append the names from the given function and property specs to props.
static bool AppendNamesFromFunctionAndPropertySpecs(JSContext* cx,
                                                    const JSFunctionSpec* fs,
                                                    const JSPropertySpec* ps,
                                                    unsigned flags,
                                                    AutoIdVector& props) {
  // Convert the method and property names to jsids and pass them to the caller.
  for (; fs && fs->name; ++fs) {
    jsid id;
    if (!PropertySpecNameToPermanentId(cx, fs->name, &id)) return false;
    if (!MaybeAppend(id, flags, props)) return false;
  }
  for (; ps && ps->name; ++ps) {
    jsid id;
    if (!PropertySpecNameToPermanentId(cx, ps->name, &id)) return false;
    if (!MaybeAppend(id, flags, props)) return false;
  }

  return true;
}

bool JSXrayTraits::enumerateNames(JSContext* cx, HandleObject wrapper,
                                  unsigned flags, AutoIdVector& props) {
  RootedObject target(cx, getTargetObject(wrapper));
  RootedObject holder(cx, ensureHolder(cx, wrapper));
  if (!holder) return false;

  JSProtoKey key = getProtoKey(holder);
  if (!isPrototype(holder)) {
    // For Object and Array instances, we expose some properties from the
    // underlying object, but only after filtering them carefully.
    if (key == JSProto_Object || key == JSProto_Array) {
      MOZ_ASSERT(props.empty());
      {
        JSAutoCompartment ac(cx, target);
        AutoIdVector targetProps(cx);
        if (!js::GetPropertyKeys(cx, target, flags | JSITER_OWNONLY,
                                 &targetProps))
          return false;
        // Loop over the properties, and only pass along the ones that
        // we determine to be safe.
        if (!props.reserve(targetProps.length())) return false;
        for (size_t i = 0; i < targetProps.length(); ++i) {
          Rooted<PropertyDescriptor> desc(cx);
          RootedId id(cx, targetProps[i]);
          if (!getOwnPropertyFromTargetIfSafe(cx, target, wrapper, id, &desc))
            return false;
          if (desc.object()) props.infallibleAppend(id);
        }
      }
      for (size_t i = 0; i < props.length(); ++i)
        JS_MarkCrossZoneId(cx, props[i]);
      return true;
    }
    if (IsTypedArrayKey(key)) {
      uint32_t length = JS_GetTypedArrayLength(target);
      // TypedArrays enumerate every indexed property in range, but
      // |length| is a getter that lives on the proto, like it should be.
      if (!props.reserve(length)) return false;
      for (int32_t i = 0; i <= int32_t(length - 1); ++i)
        props.infallibleAppend(INT_TO_JSID(i));
    } else if (key == JSProto_Function) {
      if (!props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_LENGTH)))
        return false;
      if (!props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_NAME)))
        return false;
      // Handle the .prototype property and static properties on standard
      // constructors.
      JSProtoKey standardConstructor = constructorFor(holder);
      if (standardConstructor != JSProto_Null) {
        if (!props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_PROTOTYPE)))
          return false;

        if (ShouldResolveStaticProperties(standardConstructor)) {
          const js::Class* clasp = js::ProtoKeyToClass(standardConstructor);
          MOZ_ASSERT(clasp->specDefined());

          if (!AppendNamesFromFunctionAndPropertySpecs(
                  cx, clasp->specConstructorFunctions(),
                  clasp->specConstructorProperties(), flags, props)) {
            return false;
          }
        }
      }
    } else if (IsErrorObjectKey(key)) {
      if (!props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_FILENAME)) ||
          !props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_LINENUMBER)) ||
          !props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_COLUMNNUMBER)) ||
          !props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_STACK)) ||
          !props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_MESSAGE))) {
        return false;
      }
    } else if (key == JSProto_RegExp) {
      if (!props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_LASTINDEX)))
        return false;
    }

    // The rest of this function applies only to prototypes.
    return true;
  }

  // Add the 'constructor' property.
  if (!props.append(GetJSIDByIndex(cx, XPCJSContext::IDX_CONSTRUCTOR)))
    return false;

  // Grab the JSClass. We require all Xrayable classes to have a ClassSpec.
  const js::Class* clasp = js::GetObjectClass(target);
  MOZ_ASSERT(clasp->specDefined());

  return AppendNamesFromFunctionAndPropertySpecs(
      cx, clasp->specPrototypeFunctions(), clasp->specPrototypeProperties(),
      flags, props);
}

bool JSXrayTraits::construct(JSContext* cx, HandleObject wrapper,
                             const JS::CallArgs& args,
                             const js::Wrapper& baseInstance) {
  JSXrayTraits& self = JSXrayTraits::singleton;
  JS::RootedObject holder(cx, self.ensureHolder(cx, wrapper));
  if (!holder) return false;

  if (self.getProtoKey(holder) == JSProto_Function) {
    JSProtoKey standardConstructor = constructorFor(holder);
    if (standardConstructor == JSProto_Null)
      return baseInstance.construct(cx, wrapper, args);

    const js::Class* clasp = js::ProtoKeyToClass(standardConstructor);
    MOZ_ASSERT(clasp);
    if (!(clasp->flags & JSCLASS_HAS_XRAYED_CONSTRUCTOR))
      return baseInstance.construct(cx, wrapper, args);

    // If the JSCLASS_HAS_XRAYED_CONSTRUCTOR flag is set on the Class,
    // we don't use the constructor at hand. Instead, we retrieve the
    // equivalent standard constructor in the xray compartment and run
    // it in that compartment. The newTarget isn't unwrapped, and the
    // constructor has to be able to detect and handle this situation.
    // See the comments in js/public/Class.h and PromiseConstructor for
    // details and an example.
    RootedObject ctor(cx);
    if (!JS_GetClassObject(cx, standardConstructor, &ctor)) return false;

    RootedValue ctorVal(cx, ObjectValue(*ctor));
    HandleValueArray vals(args);
    RootedObject result(cx);
    if (!JS::Construct(cx, ctorVal, wrapper, vals, &result)) return false;
    AssertSameCompartment(cx, result);
    args.rval().setObject(*result);
    return true;
  }

  JS::RootedValue v(cx, JS::ObjectValue(*wrapper));
  js::ReportIsNotFunction(cx, v);
  return false;
}

JSObject* JSXrayTraits::createHolder(JSContext* cx, JSObject* wrapper) {
  RootedObject target(cx, getTargetObject(wrapper));
  RootedObject holder(cx,
                      JS_NewObjectWithGivenProto(cx, &HolderClass, nullptr));
  if (!holder) return nullptr;

  // Compute information about the target.
  bool isPrototype = false;
  JSProtoKey key = IdentifyStandardInstance(target);
  if (key == JSProto_Null) {
    isPrototype = true;
    key = IdentifyStandardPrototype(target);
  }
  MOZ_ASSERT(key != JSProto_Null);

  // Store it on the holder.
  RootedValue v(cx);
  v.setNumber(static_cast<uint32_t>(key));
  js::SetReservedSlot(holder, SLOT_PROTOKEY, v);
  v.setBoolean(isPrototype);
  js::SetReservedSlot(holder, SLOT_ISPROTOTYPE, v);

  // If this is a function, also compute whether it serves as a constructor
  // for a standard class.
  if (key == JSProto_Function) {
    v.setNumber(static_cast<uint32_t>(IdentifyStandardConstructor(target)));
    js::SetReservedSlot(holder, SLOT_CONSTRUCTOR_FOR, v);
  }

  return holder;
}

XPCWrappedNativeXrayTraits XPCWrappedNativeXrayTraits::singleton;
DOMXrayTraits DOMXrayTraits::singleton;
JSXrayTraits JSXrayTraits::singleton;
OpaqueXrayTraits OpaqueXrayTraits::singleton;

XrayTraits* GetXrayTraits(JSObject* obj) {
  switch (GetXrayType(obj)) {
    case XrayForDOMObject:
      return &DOMXrayTraits::singleton;
    case XrayForWrappedNative:
      return &XPCWrappedNativeXrayTraits::singleton;
    case XrayForJSObject:
      return &JSXrayTraits::singleton;
    case XrayForOpaqueObject:
      return &OpaqueXrayTraits::singleton;
    default:
      return nullptr;
  }
}

/*
 * Xray expando handling.
 *
 * We hang expandos for Xray wrappers off a reserved slot on the target object
 * so that same-origin compartments can share expandos for a given object. We
 * have a linked list of expando objects, one per origin. The properties on
 * these objects are generally wrappers pointing back to the compartment that
 * applied them.
 *
 * The expando objects should _never_ be exposed to script. The fact that they
 * live in the target compartment is a detail of the implementation, and does
 * not imply that code in the target compartment should be allowed to inspect
 * them. They are private to the origin that placed them.
 */

// Certain globals do not share expandos with other globals. Xrays in these
// globals cache expandos on the wrapper's holder, as there is only one such
// wrapper which can create or access the expando. This allows for faster
// access to the expando, including through JIT inline caches.
static inline bool GlobalHasExclusiveExpandos(JSObject* obj) {
  MOZ_ASSERT(JS_IsGlobalObject(obj));
  return !strcmp(js::GetObjectJSClass(obj)->name, "Sandbox");
}

static inline JSObject* GetCachedXrayExpando(JSObject* wrapper);

static inline void SetCachedXrayExpando(JSObject* holder,
                                        JSObject* expandoWrapper);

static nsIPrincipal* ObjectPrincipal(JSObject* obj) {
  return GetCompartmentPrincipal(js::GetObjectCompartment(obj));
}

static nsIPrincipal* GetExpandoObjectPrincipal(JSObject* expandoObject) {
  Value v = JS_GetReservedSlot(expandoObject, JSSLOT_EXPANDO_ORIGIN);
  return static_cast<nsIPrincipal*>(v.toPrivate());
}

static void ExpandoObjectFinalize(JSFreeOp* fop, JSObject* obj) {
  // Release the principal.
  nsIPrincipal* principal = GetExpandoObjectPrincipal(obj);
  NS_RELEASE(principal);
}

const JSClassOps XrayExpandoObjectClassOps = {nullptr,
                                              nullptr,
                                              nullptr,
                                              nullptr,
                                              nullptr,
                                              nullptr,
                                              ExpandoObjectFinalize};

bool XrayTraits::expandoObjectMatchesConsumer(JSContext* cx,
                                              HandleObject expandoObject,
                                              nsIPrincipal* consumerOrigin) {
  MOZ_ASSERT(js::IsObjectInContextCompartment(expandoObject, cx));

  // First, compare the principals.
  nsIPrincipal* o = GetExpandoObjectPrincipal(expandoObject);
  // Note that it's very important here to ignore document.domain. We
  // pull the principal for the expando object off of the first consumer
  // for a given origin, and freely share the expandos amongst multiple
  // same-origin consumers afterwards. However, this means that we have
  // no way to know whether _all_ consumers have opted in to collaboration
  // by explicitly setting document.domain. So we just mandate that expando
  // sharing is unaffected by it.
  if (!consumerOrigin->Equals(o)) return false;

  // Certain globals exclusively own the associated expandos, in which case
  // the caller should have used the cached expando on the wrapper instead.
  JSObject* owner =
      JS_GetReservedSlot(expandoObject, JSSLOT_EXPANDO_EXCLUSIVE_WRAPPER_HOLDER)
          .toObjectOrNull();
  return owner == nullptr;
}

bool XrayTraits::getExpandoObjectInternal(JSContext* cx, JSObject* expandoChain,
                                          HandleObject exclusiveWrapper,
                                          nsIPrincipal* origin,
                                          MutableHandleObject expandoObject) {
  MOZ_ASSERT(!JS_IsExceptionPending(cx));
  expandoObject.set(nullptr);

  // Use the cached expando if this wrapper has exclusive access to it.
  if (exclusiveWrapper) {
    JSObject* expandoWrapper = GetCachedXrayExpando(exclusiveWrapper);
    expandoObject.set(expandoWrapper ? UncheckedUnwrap(expandoWrapper)
                                     : nullptr);
#ifdef DEBUG
    // Make sure the expando we found is on the target's chain. While we
    // don't use this chain to look up expandos for the wrapper,
    // the expando still needs to be on the chain to keep the wrapper and
    // expando alive.
    if (expandoObject) {
      JSObject* head = expandoChain;
      while (head && head != expandoObject)
        head = JS_GetReservedSlot(head, JSSLOT_EXPANDO_NEXT).toObjectOrNull();
      MOZ_ASSERT(head == expandoObject);
    }
#endif
    return true;
  }

  // The expando object lives in the compartment of the target, so all our
  // work needs to happen there.
  RootedObject head(cx, expandoChain);
  JSAutoCompartment ac(cx, head);

  // Iterate through the chain, looking for a same-origin object.
  while (head) {
    if (expandoObjectMatchesConsumer(cx, head, origin)) {
      expandoObject.set(head);
      return true;
    }
    head = JS_GetReservedSlot(head, JSSLOT_EXPANDO_NEXT).toObjectOrNull();
  }

  // Not found.
  return true;
}

bool XrayTraits::getExpandoObject(JSContext* cx, HandleObject target,
                                  HandleObject consumer,
                                  MutableHandleObject expandoObject) {
  // Return early if no expando object has ever been attached, which is
  // usually the case.
  JSObject* chain = getExpandoChain(target);
  if (!chain) return true;

  JSObject* consumerGlobal = js::GetGlobalForObjectCrossCompartment(consumer);
  bool isExclusive = GlobalHasExclusiveExpandos(consumerGlobal);
  return getExpandoObjectInternal(cx, chain, isExclusive ? consumer : nullptr,
                                  ObjectPrincipal(consumer), expandoObject);
}

// Wrappers which have exclusive access to the expando on their target object
// need to be kept alive as long as the target object exists. This is done by
// keeping the expando in the expando chain on the target (even though it will
// not be used while looking up the expando for the wrapper), and keeping a
// strong reference from that expando to the wrapper itself, via the
// JSSLOT_EXPANDO_EXCLUSIVE_WRAPPER_HOLDER reserved slot. This slot does not
// point to the wrapper itself, because it is a cross compartment edge and we
// can't create a wrapper for a wrapper. Instead, the slot points to an
// instance of the holder class below in the wrapper's compartment, and the
// wrapper is held via this holder object's reserved slot.
static const JSClass gWrapperHolderClass = {"XrayExpandoWrapperHolder",
                                            JSCLASS_HAS_RESERVED_SLOTS(1)};
static const size_t JSSLOT_WRAPPER_HOLDER_CONTENTS = 0;

JSObject* XrayTraits::attachExpandoObject(JSContext* cx, HandleObject target,
                                          HandleObject exclusiveWrapper,
                                          nsIPrincipal* origin) {
  // Make sure the compartments are sane.
  MOZ_ASSERT(js::IsObjectInContextCompartment(target, cx));
  MOZ_ASSERT_IF(exclusiveWrapper,
                !js::IsObjectInContextCompartment(exclusiveWrapper, cx));

  // No duplicates allowed.
#ifdef DEBUG
  {
    JSObject* chain = getExpandoChain(target);
    if (chain) {
      RootedObject existingExpandoObject(cx);
      if (getExpandoObjectInternal(cx, chain, exclusiveWrapper, origin,
                                   &existingExpandoObject))
        MOZ_ASSERT(!existingExpandoObject);
      else
        JS_ClearPendingException(cx);
    }
  }
#endif

  // Create the expando object.
  const JSClass* expandoClass = getExpandoClass(cx, target);
  MOZ_ASSERT(!strcmp(expandoClass->name, "XrayExpandoObject"));
  RootedObject expandoObject(
      cx, JS_NewObjectWithGivenProto(cx, expandoClass, nullptr));
  if (!expandoObject) return nullptr;

  // AddRef and store the principal.
  NS_ADDREF(origin);
  JS_SetReservedSlot(expandoObject, JSSLOT_EXPANDO_ORIGIN,
                     JS::PrivateValue(origin));

  // Note the exclusive wrapper, if there is one.
  RootedObject wrapperHolder(cx);
  if (exclusiveWrapper) {
    JSAutoCompartment ac(cx, exclusiveWrapper);
    wrapperHolder =
        JS_NewObjectWithGivenProto(cx, &gWrapperHolderClass, nullptr);
    if (!wrapperHolder) return nullptr;
    JS_SetReservedSlot(wrapperHolder, JSSLOT_WRAPPER_HOLDER_CONTENTS,
                       ObjectValue(*exclusiveWrapper));
  }
  if (!JS_WrapObject(cx, &wrapperHolder)) return nullptr;
  JS_SetReservedSlot(expandoObject, JSSLOT_EXPANDO_EXCLUSIVE_WRAPPER_HOLDER,
                     ObjectOrNullValue(wrapperHolder));

  // Store it on the exclusive wrapper, if there is one.
  if (exclusiveWrapper) {
    RootedObject cachedExpandoObject(cx, expandoObject);
    JSAutoCompartment ac(cx, exclusiveWrapper);
    if (!JS_WrapObject(cx, &cachedExpandoObject)) return nullptr;
    JSObject* holder = ensureHolder(cx, exclusiveWrapper);
    if (!holder) return nullptr;
    SetCachedXrayExpando(holder, cachedExpandoObject);
  }

  // If this is our first expando object, take the opportunity to preserve
  // the wrapper. This keeps our expandos alive even if the Xray wrapper gets
  // collected.
  RootedObject chain(cx, getExpandoChain(target));
  if (!chain) preserveWrapper(target);

  // Insert it at the front of the chain.
  JS_SetReservedSlot(expandoObject, JSSLOT_EXPANDO_NEXT,
                     ObjectOrNullValue(chain));
  setExpandoChain(cx, target, expandoObject);

  return expandoObject;
}

JSObject* XrayTraits::ensureExpandoObject(JSContext* cx, HandleObject wrapper,
                                          HandleObject target) {
  // Expando objects live in the target compartment.
  JSAutoCompartment ac(cx, target);
  RootedObject expandoObject(cx);
  if (!getExpandoObject(cx, target, wrapper, &expandoObject)) return nullptr;
  if (!expandoObject) {
    JSObject* consumerGlobal = js::GetGlobalForObjectCrossCompartment(wrapper);
    bool isExclusive = GlobalHasExclusiveExpandos(consumerGlobal);
    expandoObject = attachExpandoObject(
        cx, target, isExclusive ? wrapper : nullptr, ObjectPrincipal(wrapper));
  }
  return expandoObject;
}

bool XrayTraits::cloneExpandoChain(JSContext* cx, HandleObject dst,
                                   HandleObject srcChain) {
  MOZ_ASSERT(js::IsObjectInContextCompartment(dst, cx));
  MOZ_ASSERT(getExpandoChain(dst) == nullptr);

  RootedObject oldHead(cx, srcChain);
  while (oldHead) {
    // If movingIntoXrayCompartment is true, then our new reflector is in a
    // compartment that used to have an Xray-with-expandos to the old reflector
    // and we should copy the expandos to the new reflector directly.
    bool movingIntoXrayCompartment;

    // exclusiveWrapper is only used if movingIntoXrayCompartment ends up true.
    RootedObject exclusiveWrapper(cx);
    RootedObject wrapperHolder(
        cx, JS_GetReservedSlot(oldHead, JSSLOT_EXPANDO_EXCLUSIVE_WRAPPER_HOLDER)
                .toObjectOrNull());
    if (wrapperHolder) {
      RootedObject unwrappedHolder(cx, UncheckedUnwrap(wrapperHolder));
      // unwrappedHolder is the compartment of the relevant Xray, so check
      // whether that matches the compartment of cx (which matches the
      // compartment of dst).
      movingIntoXrayCompartment =
          js::IsObjectInContextCompartment(unwrappedHolder, cx);

      if (!movingIntoXrayCompartment) {
        // The global containing this wrapper holder has an xray for |src|
        // with expandos. Create an xray in the global for |dst| which
        // will be associated with a clone of |src|'s expando object.
        JSAutoCompartment ac(cx, unwrappedHolder);
        exclusiveWrapper = dst;
        if (!JS_WrapObject(cx, &exclusiveWrapper)) return false;
      }
    } else {
      JSAutoCompartment ac(cx, oldHead);
      movingIntoXrayCompartment =
          expandoObjectMatchesConsumer(cx, oldHead, ObjectPrincipal(dst));
    }

    if (movingIntoXrayCompartment) {
      // Just copy properties directly onto dst.
      if (!JS_CopyPropertiesFrom(cx, dst, oldHead)) return false;
    } else {
      // Create a new expando object in the compartment of dst to replace
      // oldHead.
      RootedObject newHead(
          cx, attachExpandoObject(cx, dst, exclusiveWrapper,
                                  GetExpandoObjectPrincipal(oldHead)));
      if (!JS_CopyPropertiesFrom(cx, newHead, oldHead)) return false;
    }
    oldHead = JS_GetReservedSlot(oldHead, JSSLOT_EXPANDO_NEXT).toObjectOrNull();
  }
  return true;
}

void ClearXrayExpandoSlots(JSObject* target, size_t slotIndex) {
  if (!NS_IsMainThread()) {
    // No Xrays
    return;
  }

  MOZ_ASSERT(slotIndex != JSSLOT_EXPANDO_NEXT);
  MOZ_ASSERT(slotIndex != JSSLOT_EXPANDO_EXCLUSIVE_WRAPPER_HOLDER);
  MOZ_ASSERT(GetXrayTraits(target) == &DOMXrayTraits::singleton);
  RootingContext* rootingCx = RootingCx();
  RootedObject rootedTarget(rootingCx, target);
  RootedObject head(rootingCx,
                    DOMXrayTraits::singleton.getExpandoChain(rootedTarget));
  while (head) {
    MOZ_ASSERT(JSCLASS_RESERVED_SLOTS(js::GetObjectClass(head)) > slotIndex);
    js::SetReservedSlot(head, slotIndex, UndefinedValue());
    head = js::GetReservedSlot(head, JSSLOT_EXPANDO_NEXT).toObjectOrNull();
  }
}

JSObject* EnsureXrayExpandoObject(JSContext* cx, JS::HandleObject wrapper) {
  MOZ_ASSERT(NS_IsMainThread());
  MOZ_ASSERT(GetXrayTraits(wrapper) == &DOMXrayTraits::singleton);
  MOZ_ASSERT(IsXrayWrapper(wrapper));

  RootedObject target(cx, DOMXrayTraits::getTargetObject(wrapper));
  return DOMXrayTraits::singleton.ensureExpandoObject(cx, wrapper, target);
}

const JSClass* XrayTraits::getExpandoClass(JSContext* cx,
                                           HandleObject target) const {
  return &DefaultXrayExpandoObjectClass;
}

static const size_t JSSLOT_XRAY_HOLDER = 0;

static JSObject* GetHolder(JSObject* obj) {
  return &js::GetProxyReservedSlot(obj, JSSLOT_XRAY_HOLDER).toObject();
}

/* static */ JSObject* XrayTraits::getHolder(JSObject* wrapper) {
  MOZ_ASSERT(WrapperFactory::IsXrayWrapper(wrapper));
  js::Value v = js::GetProxyReservedSlot(wrapper, JSSLOT_XRAY_HOLDER);
  return v.isObject() ? &v.toObject() : nullptr;
}

JSObject* XrayTraits::ensureHolder(JSContext* cx, HandleObject wrapper) {
  RootedObject holder(cx, getHolder(wrapper));
  if (holder) return holder;
  holder = createHolder(cx, wrapper);  // virtual trap.
  if (holder)
    js::SetProxyReservedSlot(wrapper, JSSLOT_XRAY_HOLDER, ObjectValue(*holder));
  return holder;
}

static inline JSObject* GetCachedXrayExpando(JSObject* wrapper) {
  JSObject* holder = XrayTraits::getHolder(wrapper);
  if (!holder) return nullptr;
  Value v = JS_GetReservedSlot(holder, XrayTraits::HOLDER_SLOT_EXPANDO);
  return v.isObject() ? &v.toObject() : nullptr;
}

static inline void SetCachedXrayExpando(JSObject* holder,
                                        JSObject* expandoWrapper) {
  MOZ_ASSERT(js::GetObjectCompartment(holder) ==
             js::GetObjectCompartment(expandoWrapper));
  JS_SetReservedSlot(holder, XrayTraits::HOLDER_SLOT_EXPANDO,
                     ObjectValue(*expandoWrapper));
}

namespace XrayUtils {

bool IsXPCWNHolderClass(const JSClass* clasp) {
  return clasp == &XPCWrappedNativeXrayTraits::HolderClass;
}

}  // namespace XrayUtils

static nsGlobalWindowInner* AsWindow(JSContext* cx, JSObject* wrapper) {
  // We want to use our target object here, since we don't want to be
  // doing a security check while unwrapping.
  JSObject* target = XrayTraits::getTargetObject(wrapper);
  return WindowOrNull(target);
}

static bool IsWindow(JSContext* cx, JSObject* wrapper) {
  return !!AsWindow(cx, wrapper);
}

void XPCWrappedNativeXrayTraits::preserveWrapper(JSObject* target) {
  XPCWrappedNative* wn = XPCWrappedNative::Get(target);
  RefPtr<nsXPCClassInfo> ci;
  CallQueryInterface(wn->Native(), getter_AddRefs(ci));
  if (ci) ci->PreserveWrapper(wn->Native());
}

static bool XrayToString(JSContext* cx, unsigned argc, JS::Value* vp);

bool XPCWrappedNativeXrayTraits::resolveNativeProperty(
    JSContext* cx, HandleObject wrapper, HandleObject holder, HandleId id,
    MutableHandle<PropertyDescriptor> desc) {
  MOZ_ASSERT(js::GetObjectJSClass(holder) == &HolderClass);

  desc.object().set(nullptr);

  // This will do verification and the method lookup for us.
  RootedObject target(cx, getTargetObject(wrapper));
  XPCCallContext ccx(cx, target, nullptr, id);

  // There are no native numeric (or symbol-keyed) properties, so we can
  // shortcut here. We will not find the property.
  if (!JSID_IS_STRING(id)) return true;

  XPCNativeInterface* iface;
  XPCNativeMember* member;
  XPCWrappedNative* wn = getWN(wrapper);

  if (ccx.GetWrapper() != wn || !wn->IsValid()) {
    return true;
  }

  if (!(iface = ccx.GetInterface()) || !(member = ccx.GetMember())) {
    if (id != XPCJSRuntime::Get()->GetStringID(XPCJSContext::IDX_TO_STRING))
      return true;

    JSFunction* toString = JS_NewFunction(cx, XrayToString, 0, 0, "toString");
    if (!toString) return false;

    FillPropertyDescriptor(desc, wrapper, 0,
                           ObjectValue(*JS_GetFunctionObject(toString)));

    return JS_DefinePropertyById(cx, holder, id, desc) &&
           JS_GetOwnPropertyDescriptorById(cx, holder, id, desc);
  }

  desc.object().set(holder);
  desc.setAttributes(JSPROP_ENUMERATE);
  desc.setGetter(nullptr);
  desc.setSetter(nullptr);
  desc.value().setUndefined();

  RootedValue fval(cx, JS::UndefinedValue());
  if (member->IsConstant()) {
    if (!member->GetConstantValue(ccx, iface, desc.value().address())) {
      JS_ReportErrorASCII(
          cx, "Failed to convert constant native property to JS value");
      return false;
    }
  } else if (member->IsAttribute()) {
    // This is a getter/setter. Clone a function for it.
    if (!member->NewFunctionObject(ccx, iface, wrapper, fval.address())) {
      JS_ReportErrorASCII(
          cx, "Failed to clone function object for native getter/setter");
      return false;
    }

    unsigned attrs = desc.attributes();
    attrs |= JSPROP_GETTER;
    if (member->IsWritableAttribute()) attrs |= JSPROP_SETTER;

    desc.setAttributes(attrs);
  } else {
    // This is a method. Clone a function for it.
    if (!member->NewFunctionObject(ccx, iface, wrapper,
                                   desc.value().address())) {
      JS_ReportErrorASCII(
          cx, "Failed to clone function object for native function");
      return false;
    }

    // Without a wrapper the function would live on the prototype. Since we
    // don't have one, we have to avoid calling the scriptable helper's
    // GetProperty method for this property, so null out the getter and
    // setter here explicitly.
    desc.setGetter(nullptr);
    desc.setSetter(nullptr);
  }

  if (!JS_WrapValue(cx, desc.value()) || !JS_WrapValue(cx, &fval)) return false;

  if (desc.hasGetterObject()) desc.setGetterObject(&fval.toObject());
  if (desc.hasSetterObject()) desc.setSetterObject(&fval.toObject());

  return JS_DefinePropertyById(cx, holder, id, desc);
}

static bool wrappedJSObject_getter(JSContext* cx, unsigned argc, Value* vp) {
  CallArgs args = CallArgsFromVp(argc, vp);
  if (!args.thisv().isObject()) {
    JS_ReportErrorASCII(cx, "This value not an object");
    return false;
  }
  RootedObject wrapper(cx, &args.thisv().toObject());
  if (!IsWrapper(wrapper) || !WrapperFactory::IsXrayWrapper(wrapper) ||
      !WrapperFactory::AllowWaiver(wrapper)) {
    JS_ReportErrorASCII(cx, "Unexpected object");
    return false;
  }

  args.rval().setObject(*wrapper);

  return WrapperFactory::WaiveXrayAndWrap(cx, args.rval());
}

bool XrayTraits::resolveOwnProperty(JSContext* cx, HandleObject wrapper,
                                    HandleObject target, HandleObject holder,
                                    HandleId id,
                                    MutableHandle<PropertyDescriptor> desc) {
  desc.object().set(nullptr);
  RootedObject expando(cx);
  if (!getExpandoObject(cx, target, wrapper, &expando)) return false;

  // Check for expando properties first. Note that the expando object lives
  // in the target compartment.
  bool found = false;
  if (expando) {
    JSAutoCompartment ac(cx, expando);
    JS_MarkCrossZoneId(cx, id);
    if (!JS_GetOwnPropertyDescriptorById(cx, expando, id, desc)) return false;
    found = !!desc.object();
  }

  // Next, check for ES builtins.
  if (!found && JS_IsGlobalObject(target)) {
    JSProtoKey key = JS_IdToProtoKey(cx, id);
    JSAutoCompartment ac(cx, target);
    if (key != JSProto_Null) {
      MOZ_ASSERT(key < JSProto_LIMIT);
      RootedObject constructor(cx);
      if (!JS_GetClassObject(cx, key, &constructor)) return false;
      MOZ_ASSERT(constructor);
      desc.value().set(ObjectValue(*constructor));
      found = true;
    } else if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_EVAL)) {
      RootedObject eval(cx);
      if (!js::GetOriginalEval(cx, target, &eval)) return false;
      desc.value().set(ObjectValue(*eval));
      found = true;
    }
  }

  if (found) {
    if (!JS_WrapPropertyDescriptor(cx, desc)) return false;
    // Pretend the property lives on the wrapper.
    desc.object().set(wrapper);
    return true;
  }

  // Handle .wrappedJSObject for subsuming callers. This should move once we
  // sort out own-ness for the holder.
  if (id == GetJSIDByIndex(cx, XPCJSContext::IDX_WRAPPED_JSOBJECT) &&
      WrapperFactory::AllowWaiver(wrapper)) {
    if (!JS_AlreadyHasOwnPropertyById(cx, holder, id, &found)) return false;
    if (!found && !JS_DefinePropertyById(cx, holder, id, wrappedJSObject_getter,
                                         nullptr, JSPROP_ENUMERATE)) {
      return false;
    }
    if (!JS_GetOwnPropertyDescriptorById(cx, holder, id, desc)) return false;
    desc.object().set(wrapper);
    return true;
  }

  return true;
}

bool XPCWrappedNativeXrayTraits::resolveOwnProperty(
    JSContext* cx, HandleObject wrapper, HandleObject target,
    HandleObject holder, HandleId id, MutableHandle<PropertyDescriptor> desc) {
  // Call the common code.
  bool ok =
      XrayTraits::resolveOwnProperty(cx, wrapper, target, holder, id, desc);
  if (!ok || desc.object()) return ok;

  // Xray wrappers don't use the regular wrapper hierarchy, so we should be
  // in the wrapper's compartment here, not the wrappee.
  MOZ_ASSERT(js::IsObjectInContextCompartment(wrapper, cx));

  return JS_GetOwnPropertyDescriptorById(cx, holder, id, desc);
}

bool XPCWrappedNativeXrayTraits::enumerateNames(JSContext* cx,
                                                HandleObject wrapper,
                                                unsigned flags,
                                                AutoIdVector& props) {
  // Force all native properties to be materialized onto the wrapped native.
  AutoIdVector wnProps(cx);
  {
    RootedObject target(cx, getTargetObject(wrapper));
    JSAutoCompartment ac(cx, target);
    if (!js::GetPropertyKeys(cx, target, flags, &wnProps)) return false;
  }

  // Go through the properties we found on the underlying object and see if
  // they appear on the XrayWrapper. If it throws (which may happen if the
  // wrapper is a SecurityWrapper), just clear the exception and move on.
  MOZ_ASSERT(!JS_IsExceptionPending(cx));
  if (!props.reserve(wnProps.length())) return false;
  for (size_t n = 0; n < wnProps.length(); ++n) {
    RootedId id(cx, wnProps[n]);
    JS_MarkCrossZoneId(cx, id);
    bool hasProp;
    if (JS_HasPropertyById(cx, wrapper, id, &hasProp) && hasProp)
      props.infallibleAppend(id);
    JS_ClearPendingException(cx);
  }
  return true;
}

JSObject* XPCWrappedNativeXrayTraits::createHolder(JSContext* cx,
                                                   JSObject* wrapper) {
  return JS_NewObjectWithGivenProto(cx, &HolderClass, nullptr);
}

bool XPCWrappedNativeXrayTraits::call(JSContext* cx, HandleObject wrapper,
                                      const JS::CallArgs& args,
                                      const js::Wrapper& baseInstance) {
  // Run the call hook of the wrapped native.
  XPCWrappedNative* wn = getWN(wrapper);
  if (wn->GetScriptable() && wn->GetScriptable()->WantCall()) {
    XPCCallContext ccx(cx, wrapper, nullptr, JSID_VOIDHANDLE, args.length(),
                       args.array(), args.rval().address());
    if (!ccx.IsValid()) return false;
    bool ok = true;
    nsresult rv = wn->GetScriptable()->Call(wn, cx, wrapper, args, &ok);
    if (NS_FAILED(rv)) {
      if (ok) XPCThrower::Throw(rv, cx);
      return false;
    }
  }

  return true;
}

bool XPCWrappedNativeXrayTraits::construct(JSContext* cx, HandleObject wrapper,
                                           const JS::CallArgs& args,
                                           const js::Wrapper& baseInstance) {
  // Run the construct hook of the wrapped native.
  XPCWrappedNative* wn = getWN(wrapper);
  if (wn->GetScriptable() && wn->GetScriptable()->WantConstruct()) {
    XPCCallContext ccx(cx, wrapper, nullptr, JSID_VOIDHANDLE, args.length(),
                       args.array(), args.rval().address());
    if (!ccx.IsValid()) return false;
    bool ok = true;
    nsresult rv = wn->GetScriptable()->Construct(wn, cx, wrapper, args, &ok);
    if (NS_FAILED(rv)) {
      if (ok) XPCThrower::Throw(rv, cx);
      return false;
    }
  }

  return true;
}

bool DOMXrayTraits::resolveOwnProperty(JSContext* cx, HandleObject wrapper,
                                       HandleObject target, HandleObject holder,
                                       HandleId id,
                                       MutableHandle<PropertyDescriptor> desc) {
  // Call the common code.
  bool ok =
      XrayTraits::resolveOwnProperty(cx, wrapper, target, holder, id, desc);
  if (!ok || desc.object()) return ok;

  // Check for indexed access on a window.
  uint32_t index = GetArrayIndexFromId(cx, id);
  if (IsArrayIndex(index)) {
    nsGlobalWindowInner* win = AsWindow(cx, wrapper);
    // Note: As() unwraps outer windows to get to the inner window.
    if (win) {
      nsCOMPtr<nsPIDOMWindowOuter> subframe = win->IndexedGetter(index);
      if (subframe) {
        subframe->EnsureInnerWindow();
        nsGlobalWindowOuter* global = nsGlobalWindowOuter::Cast(subframe);
        JSObject* obj = global->FastGetGlobalJSObject();
        if (MOZ_UNLIKELY(!obj)) {
          // It's gone?
          return xpc::Throw(cx, NS_ERROR_FAILURE);
        }
        ExposeObjectToActiveJS(obj);
        desc.value().setObject(*obj);
        FillPropertyDescriptor(desc, wrapper, true);
        return JS_WrapPropertyDescriptor(cx, desc);
      }
    }
  }

  if (!JS_GetOwnPropertyDescriptorById(cx, holder, id, desc)) return false;
  if (desc.object()) {
    desc.object().set(wrapper);
    return true;
  }

  bool cacheOnHolder;
  if (!XrayResolveOwnProperty(cx, wrapper, target, id, desc, cacheOnHolder))
    return false;

  MOZ_ASSERT(!desc.object() || desc.object() == wrapper,
             "What did we resolve this on?");

  if (!desc.object() || !cacheOnHolder) return true;

  return JS_DefinePropertyById(cx, holder, id, desc) &&
         JS_GetOwnPropertyDescriptorById(cx, holder, id, desc);
}

bool DOMXrayTraits::delete_(JSContext* cx, JS::HandleObject wrapper,
                            JS::HandleId id, JS::ObjectOpResult& result) {
  RootedObject target(cx, getTargetObject(wrapper));
  return XrayDeleteNamedProperty(cx, wrapper, target, id, result);
}

bool DOMXrayTraits::defineProperty(JSContext* cx, HandleObject wrapper,
                                   HandleId id, Handle<PropertyDescriptor> desc,
                                   Handle<PropertyDescriptor> existingDesc,
                                   JS::ObjectOpResult& result, bool* defined) {
  // Check for an indexed property on a Window.  If that's happening, do
  // nothing but claim we defined it so it won't get added as an expando.
  if (IsWindow(cx, wrapper)) {
    if (IsArrayIndex(GetArrayIndexFromId(cx, id))) {
      *defined = true;
      return result.succeed();
    }
  }

  JS::Rooted<JSObject*> obj(cx, getTargetObject(wrapper));
  return XrayDefineProperty(cx, wrapper, obj, id, desc, result, defined);
}

bool DOMXrayTraits::enumerateNames(JSContext* cx, HandleObject wrapper,
                                   unsigned flags, AutoIdVector& props) {
  // Put the indexed properties for a window first.
  nsGlobalWindowInner* win = AsWindow(cx, wrapper);
  if (win) {
    uint32_t length = win->Length();
    if (!props.reserve(props.length() + length)) {
      return false;
    }
    JS::RootedId indexId(cx);
    for (uint32_t i = 0; i < length; ++i) {
      if (!JS_IndexToId(cx, i, &indexId)) {
        return false;
      }
      props.infallibleAppend(indexId);
    }
  }

  JS::Rooted<JSObject*> obj(cx, getTargetObject(wrapper));
  return XrayOwnPropertyKeys(cx, wrapper, obj, flags, props);
}

bool DOMXrayTraits::call(JSContext* cx, HandleObject wrapper,
                         const JS::CallArgs& args,
                         const js::Wrapper& baseInstance) {
  RootedObject obj(cx, getTargetObject(wrapper));
  const js::Class* clasp = js::GetObjectClass(obj);
  // What we have is either a WebIDL interface object, a WebIDL prototype
  // object, or a WebIDL instance object.  WebIDL prototype objects never have
  // a clasp->call.  WebIDL interface objects we want to invoke on the xray
  // compartment.  WebIDL instance objects either don't have a clasp->call or
  // are using "legacycaller", which basically means plug-ins.  We want to
  // call those on the content compartment.
  if (clasp->flags & JSCLASS_IS_DOMIFACEANDPROTOJSCLASS) {
    if (JSNative call = clasp->getCall()) {
      // call it on the Xray compartment
      if (!call(cx, args.length(), args.base())) return false;
    } else {
      RootedValue v(cx, ObjectValue(*wrapper));
      js::ReportIsNotFunction(cx, v);
      return false;
    }
  } else {
    // This is only reached for WebIDL instance objects, and in practice
    // only for plugins.  Just call them on the content compartment.
    if (!baseInstance.call(cx, wrapper, args)) return false;
  }
  return JS_WrapValue(cx, args.rval());
}

bool DOMXrayTraits::construct(JSContext* cx, HandleObject wrapper,
                              const JS::CallArgs& args,
                              const js::Wrapper& baseInstance) {
  RootedObject obj(cx, getTargetObject(wrapper));
  MOZ_ASSERT(mozilla::dom::HasConstructor(obj));
  const js::Class* clasp = js::GetObjectClass(obj);
  // See comments in DOMXrayTraits::call() explaining what's going on here.
  if (clasp->flags & JSCLASS_IS_DOMIFACEANDPROTOJSCLASS) {
    if (JSNative construct = clasp->getConstruct()) {
      if (!construct(cx, args.length(), args.base())) return false;
    } else {
      RootedValue v(cx, ObjectValue(*wrapper));
      js::ReportIsNotFunction(cx, v);
      return false;
    }
  } else {
    if (!baseInstance.construct(cx, wrapper, args)) return false;
  }
  if (!args.rval().isObject() || !JS_WrapValue(cx, args.rval())) return false;
  return true;
}

bool DOMXrayTraits::getPrototype(JSContext* cx, JS::HandleObject wrapper,
                                 JS::HandleObject target,
                                 JS::MutableHandleObject protop) {
  return mozilla::dom::XrayGetNativeProto(cx, target, protop);
}

void DOMXrayTraits::preserveWrapper(JSObject* target) {
  nsISupports* identity = mozilla::dom::UnwrapDOMObjectToISupports(target);
  if (!identity) return;
  nsWrapperCache* cache = nullptr;
  CallQueryInterface(identity, &cache);
  if (cache) cache->PreserveWrapper(identity);
}

JSObject* DOMXrayTraits::createHolder(JSContext* cx, JSObject* wrapper) {
  return JS_NewObjectWithGivenProto(cx, &HolderClass, nullptr);
}

const JSClass* DOMXrayTraits::getExpandoClass(JSContext* cx,
                                              HandleObject target) const {
  return XrayGetExpandoClass(cx, target);
}

namespace XrayUtils {

JSObject* GetNativePropertiesObject(JSContext* cx, JSObject* wrapper) {
  MOZ_ASSERT(js::IsWrapper(wrapper) && WrapperFactory::IsXrayWrapper(wrapper),
             "bad object passed in");

  JSObject* holder = GetHolder(wrapper);
  MOZ_ASSERT(holder, "uninitialized wrapper being used?");
  return holder;
}

bool HasNativeProperty(JSContext* cx, HandleObject wrapper, HandleId id,
                       bool* hasProp) {
  MOZ_ASSERT(WrapperFactory::IsXrayWrapper(wrapper));
  XrayTraits* traits = GetXrayTraits(wrapper);
  MOZ_ASSERT(traits);
  RootedObject target(cx, XrayTraits::getTargetObject(wrapper));
  RootedObject holder(cx, traits->ensureHolder(cx, wrapper));
  NS_ENSURE_TRUE(holder, false);
  *hasProp = false;
  Rooted<PropertyDescriptor> desc(cx);

  // Try resolveOwnProperty.
  if (!traits->resolveOwnProperty(cx, wrapper, target, holder, id, &desc))
    return false;
  if (desc.object()) {
    *hasProp = true;
    return true;
  }

  // Try the holder.
  bool found = false;
  if (!JS_AlreadyHasOwnPropertyById(cx, holder, id, &found)) return false;
  if (found) {
    *hasProp = true;
    return true;
  }

  // Try resolveNativeProperty.
  if (!traits->resolveNativeProperty(cx, wrapper, holder, id, &desc))
    return false;
  *hasProp = !!desc.object();
  return true;
}

}  // namespace XrayUtils

static bool XrayToString(JSContext* cx, unsigned argc, Value* vp) {
  CallArgs args = CallArgsFromVp(argc, vp);

  if (!args.thisv().isObject()) {
    JS_ReportErrorASCII(cx, "XrayToString called on an incompatible object");
    return false;
  }

  RootedObject wrapper(cx, &args.thisv().toObject());
  if (!wrapper) return false;
  if (IsWrapper(wrapper) &&
      GetProxyHandler(wrapper) == &sandboxCallableProxyHandler) {
    wrapper = xpc::SandboxCallableProxyHandler::wrappedObject(wrapper);
  }
  if (!IsWrapper(wrapper) || !WrapperFactory::IsXrayWrapper(wrapper)) {
    JS_ReportErrorASCII(cx, "XrayToString called on an incompatible object");
    return false;
  }

  RootedObject obj(cx, XrayTraits::getTargetObject(wrapper));
  if (GetXrayType(obj) != XrayForWrappedNative) {
    JS_ReportErrorASCII(cx, "XrayToString called on an incompatible object");
    return false;
  }

  static const char start[] = "[object XrayWrapper ";
  static const char end[] = "]";
  nsAutoString result;
  result.AppendASCII(start);

  XPCCallContext ccx(cx, obj);
  XPCWrappedNative* wn = XPCWrappedNativeXrayTraits::getWN(wrapper);
  char* wrapperStr = wn->ToString();
  if (!wrapperStr) {
    JS_ReportOutOfMemory(cx);
    return false;
  }
  result.AppendASCII(wrapperStr);
  js_free(wrapperStr);

  result.AppendASCII(end);

  JSString* str = JS_NewUCStringCopyN(cx, result.get(), result.Length());
  if (!str) return false;

  args.rval().setString(str);
  return true;
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::preventExtensions(
    JSContext* cx, HandleObject wrapper, ObjectOpResult& result) const {
  // Xray wrappers are supposed to provide a clean view of the target
  // reflector, hiding any modifications by script in the target scope.  So
  // even if that script freezes the reflector, we don't want to make that
  // visible to the caller. DOM reflectors are always extensible by default,
  // so we can just return failure here.
  return result.failCantPreventExtensions();
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::isExtensible(JSContext* cx,
                                             JS::Handle<JSObject*> wrapper,
                                             bool* extensible) const {
  // See above.
  *extensible = true;
  return true;
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::getPropertyDescriptor(
    JSContext* cx, HandleObject wrapper, HandleId id,
    JS::MutableHandle<PropertyDescriptor> desc) const {
  // We can't assert !Traits::HasPrototypes here, because
  // CrossOriginXrayWrapper::getOwnPropertyDescriptor calls us, but it uses
  // DOMXrayTraits, which have HasPrototype.

  assertEnteredPolicy(cx, wrapper, id,
                      BaseProxyHandler::GET | BaseProxyHandler::SET |
                          BaseProxyHandler::GET_PROPERTY_DESCRIPTOR);
  RootedObject target(cx, Traits::getTargetObject(wrapper));
  RootedObject holder(cx, Traits::singleton.ensureHolder(cx, wrapper));

  if (!holder) return false;

  // Ordering is important here.
  //
  // We first need to call resolveOwnProperty, even before checking the holder,
  // because there might be a new dynamic |own| property that appears and
  // shadows a previously-resolved non-own property that we cached on the
  // holder. This can happen with indexed properties on NodeLists, for example,
  // which are |own| value props.
  //
  // resolveOwnProperty may or may not cache what it finds on the holder,
  // depending on how ephemeral it decides the property is. XPCWN |own|
  // properties generally end up on the holder via Resolve, whereas
  // NodeList |own| properties don't get defined on the holder, since they're
  // supposed to be dynamic. This means that we have to first check the result
  // of resolveOwnProperty, and _then_, if that comes up blank, check the
  // holder for any cached native properties.
  //
  // Finally, we call resolveNativeProperty, which checks non-own properties,
  // and unconditionally caches what it finds on the holder.

  // Check resolveOwnProperty.
  if (!Traits::singleton.resolveOwnProperty(cx, wrapper, target, holder, id,
                                            desc))
    return false;

  // Check the holder.
  if (!desc.object() && !JS_GetOwnPropertyDescriptorById(cx, holder, id, desc))
    return false;
  if (desc.object()) {
    desc.object().set(wrapper);
    return true;
  }

  // Nothing in the cache. Call through, and cache the result.
  if (!Traits::singleton.resolveNativeProperty(cx, wrapper, holder, id, desc))
    return false;

  // We need to handle named access on the Window somewhere other than
  // Traits::resolveOwnProperty, because per spec it happens on the Global
  // Scope Polluter and thus the resulting properties are non-|own|. However,
  // we're set up (above) to cache (on the holder) anything that comes out of
  // resolveNativeProperty, which we don't want for something dynamic like
  // named access. So we just handle it separately here.  Note that this is
  // only relevant for CrossOriginXrayWrapper, which calls
  // getPropertyDescriptor from getOwnPropertyDescriptor.
  nsGlobalWindowInner* win = nullptr;
  if (!desc.object() && JSID_IS_STRING(id) && (win = AsWindow(cx, wrapper))) {
    nsAutoJSString name;
    if (!name.init(cx, JSID_TO_STRING(id))) return false;
    if (nsCOMPtr<nsPIDOMWindowOuter> childDOMWin = win->GetChildWindow(name)) {
      auto* cwin = nsGlobalWindowOuter::Cast(childDOMWin);
      JSObject* childObj = cwin->FastGetGlobalJSObject();
      if (MOZ_UNLIKELY(!childObj)) return xpc::Throw(cx, NS_ERROR_FAILURE);
      ExposeObjectToActiveJS(childObj);
      FillPropertyDescriptor(desc, wrapper, ObjectValue(*childObj),
                             /* readOnly = */ true);
      return JS_WrapPropertyDescriptor(cx, desc);
    }
  }

  // If we still have nothing, we're done.
  if (!desc.object()) return true;

  if (!JS_DefinePropertyById(cx, holder, id, desc) ||
      !JS_GetOwnPropertyDescriptorById(cx, holder, id, desc)) {
    return false;
  }
  MOZ_ASSERT(desc.object());
  desc.object().set(wrapper);
  return true;
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::getOwnPropertyDescriptor(
    JSContext* cx, HandleObject wrapper, HandleId id,
    JS::MutableHandle<PropertyDescriptor> desc) const {
  assertEnteredPolicy(cx, wrapper, id,
                      BaseProxyHandler::GET | BaseProxyHandler::SET |
                          BaseProxyHandler::GET_PROPERTY_DESCRIPTOR);
  RootedObject target(cx, Traits::getTargetObject(wrapper));
  RootedObject holder(cx, Traits::singleton.ensureHolder(cx, wrapper));
  if (!holder) return false;

  if (!Traits::singleton.resolveOwnProperty(cx, wrapper, target, holder, id,
                                            desc))
    return false;
  if (desc.object()) desc.object().set(wrapper);
  return true;
}

// Consider what happens when chrome does |xray.expando = xray.wrappedJSObject|.
//
// Since the expando comes from the target compartment, wrapping it back into
// the target compartment to define it on the expando object ends up stripping
// off the Xray waiver that gives |xray| and |xray.wrappedJSObject| different
// identities. This is generally the right thing to do when wrapping across
// compartments, but is incorrect in the special case of the Xray expando
// object. Manually re-apply Xrays if necessary.
//
// NB: In order to satisfy the invariants of WaiveXray, we need to pass
// in an object sans security wrapper, which means we need to strip off any
// potential same-compartment security wrapper that may have been applied
// to the content object. This is ok, because the the expando object is only
// ever accessed by code across the compartment boundary.
static bool RecreateLostWaivers(JSContext* cx, const PropertyDescriptor* orig,
                                MutableHandle<PropertyDescriptor> wrapped) {
  // Compute whether the original objects were waived, and implicitly, whether
  // they were objects at all.
  bool valueWasWaived =
      orig->value.isObject() &&
      WrapperFactory::HasWaiveXrayFlag(&orig->value.toObject());
  bool getterWasWaived = (orig->attrs & JSPROP_GETTER) && orig->getter &&
                         WrapperFactory::HasWaiveXrayFlag(
                             JS_FUNC_TO_DATA_PTR(JSObject*, orig->getter));
  bool setterWasWaived = (orig->attrs & JSPROP_SETTER) && orig->setter &&
                         WrapperFactory::HasWaiveXrayFlag(
                             JS_FUNC_TO_DATA_PTR(JSObject*, orig->setter));

  // Recreate waivers. Note that for value, we need an extra UncheckedUnwrap
  // to handle same-compartment security wrappers (see above). This should
  // never happen for getters/setters.

  RootedObject rewaived(cx);
  if (valueWasWaived &&
      !IsCrossCompartmentWrapper(&wrapped.value().toObject())) {
    rewaived = &wrapped.value().toObject();
    rewaived = WrapperFactory::WaiveXray(cx, UncheckedUnwrap(rewaived));
    NS_ENSURE_TRUE(rewaived, false);
    wrapped.value().set(ObjectValue(*rewaived));
  }
  if (getterWasWaived && !IsCrossCompartmentWrapper(wrapped.getterObject())) {
    MOZ_ASSERT(CheckedUnwrap(wrapped.getterObject()));
    rewaived = WrapperFactory::WaiveXray(cx, wrapped.getterObject());
    NS_ENSURE_TRUE(rewaived, false);
    wrapped.setGetterObject(rewaived);
  }
  if (setterWasWaived && !IsCrossCompartmentWrapper(wrapped.setterObject())) {
    MOZ_ASSERT(CheckedUnwrap(wrapped.setterObject()));
    rewaived = WrapperFactory::WaiveXray(cx, wrapped.setterObject());
    NS_ENSURE_TRUE(rewaived, false);
    wrapped.setSetterObject(rewaived);
  }

  return true;
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::defineProperty(JSContext* cx,
                                               HandleObject wrapper,
                                               HandleId id,
                                               Handle<PropertyDescriptor> desc,
                                               ObjectOpResult& result) const {
  assertEnteredPolicy(cx, wrapper, id, BaseProxyHandler::SET);

  Rooted<PropertyDescriptor> existing_desc(cx);
  if (!JS_GetPropertyDescriptorById(cx, wrapper, id, &existing_desc))
    return false;

  // Note that the check here is intended to differentiate between own and
  // non-own properties, since the above lookup is not limited to own
  // properties. At present, this may not always do the right thing because
  // we often lie (sloppily) about where we found properties and set
  // desc.object() to |wrapper|. Once we fully fix our Xray prototype semantics,
  // this should work as intended.
  if (existing_desc.object() == wrapper && !existing_desc.configurable()) {
    // We have a non-configurable property. See if the caller is trying to
    // re-configure it in any way other than making it non-writable.
    if (existing_desc.isAccessorDescriptor() || desc.isAccessorDescriptor() ||
        (desc.hasEnumerable() &&
         existing_desc.enumerable() != desc.enumerable()) ||
        (desc.hasWritable() && !existing_desc.writable() && desc.writable())) {
      // We should technically report non-configurability in strict mode, but
      // doing that via JSAPI used to be a lot of trouble. See bug 1135997.
      return result.succeed();
    }
    if (!existing_desc.writable()) {
      // Same as the above for non-writability.
      return result.succeed();
    }
  }

  bool defined = false;
  if (!Traits::singleton.defineProperty(cx, wrapper, id, desc, existing_desc,
                                        result, &defined))
    return false;
  if (defined) return true;

  // We're placing an expando. The expando objects live in the target
  // compartment, so we need to enter it.
  RootedObject target(cx, Traits::getTargetObject(wrapper));
  JSAutoCompartment ac(cx, target);
  JS_MarkCrossZoneId(cx, id);

  // Grab the relevant expando object.
  RootedObject expandoObject(
      cx, Traits::singleton.ensureExpandoObject(cx, wrapper, target));
  if (!expandoObject) return false;

  // Wrap the property descriptor for the target compartment.
  Rooted<PropertyDescriptor> wrappedDesc(cx, desc);
  if (!JS_WrapPropertyDescriptor(cx, &wrappedDesc)) return false;

  // Fix up Xray waivers.
  if (!RecreateLostWaivers(cx, desc.address(), &wrappedDesc)) return false;

  return JS_DefinePropertyById(cx, expandoObject, id, wrappedDesc, result);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::ownPropertyKeys(JSContext* cx,
                                                HandleObject wrapper,
                                                AutoIdVector& props) const {
  assertEnteredPolicy(cx, wrapper, JSID_VOID, BaseProxyHandler::ENUMERATE);
  return getPropertyKeys(
      cx, wrapper, JSITER_OWNONLY | JSITER_HIDDEN | JSITER_SYMBOLS, props);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::delete_(JSContext* cx, HandleObject wrapper,
                                        HandleId id,
                                        ObjectOpResult& result) const {
  assertEnteredPolicy(cx, wrapper, id, BaseProxyHandler::SET);

  // Check the expando object.
  RootedObject target(cx, Traits::getTargetObject(wrapper));
  RootedObject expando(cx);
  if (!Traits::singleton.getExpandoObject(cx, target, wrapper, &expando))
    return false;

  if (expando) {
    JSAutoCompartment ac(cx, expando);
    JS_MarkCrossZoneId(cx, id);
    bool hasProp;
    if (!JS_HasPropertyById(cx, expando, id, &hasProp)) {
      return false;
    }
    if (hasProp) {
      return JS_DeletePropertyById(cx, expando, id, result);
    }
  }

  return Traits::singleton.delete_(cx, wrapper, id, result);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::get(JSContext* cx, HandleObject wrapper,
                                    HandleValue receiver, HandleId id,
                                    MutableHandleValue vp) const {
  // Skip our Base if it isn't already ProxyHandler.
  // NB: None of the functions we call are prepared for the receiver not
  // being the wrapper, so ignore the receiver here.
  RootedValue thisv(cx);
  if (Traits::HasPrototype)
    thisv = receiver;
  else
    thisv.setObject(*wrapper);

  // This uses getPropertyDescriptor for backward compatibility with
  // the old BaseProxyHandler::get implementation.
  Rooted<PropertyDescriptor> desc(cx);
  if (!getPropertyDescriptor(cx, wrapper, id, &desc)) return false;
  desc.assertCompleteIfFound();

  if (!desc.object()) {
    vp.setUndefined();
    return true;
  }

  // Everything after here follows [[Get]] for ordinary objects.
  if (desc.isDataDescriptor()) {
    vp.set(desc.value());
    return true;
  }

  MOZ_ASSERT(desc.isAccessorDescriptor());
  RootedObject getter(cx, desc.getterObject());

  if (!getter) {
    vp.setUndefined();
    return true;
  }

  return Call(cx, thisv, getter, HandleValueArray::empty(), vp);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::set(JSContext* cx, HandleObject wrapper,
                                    HandleId id, HandleValue v,
                                    HandleValue receiver,
                                    ObjectOpResult& result) const {
  MOZ_ASSERT(!Traits::HasPrototype);
  // Skip our Base if it isn't already BaseProxyHandler.
  // NB: None of the functions we call are prepared for the receiver not
  // being the wrapper, so ignore the receiver here.
  RootedValue wrapperValue(cx, ObjectValue(*wrapper));
  return js::BaseProxyHandler::set(cx, wrapper, id, v, wrapperValue, result);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::has(JSContext* cx, HandleObject wrapper,
                                    HandleId id, bool* bp) const {
  // This uses getPropertyDescriptor for backward compatibility with
  // the old BaseProxyHandler::has implementation.
  Rooted<PropertyDescriptor> desc(cx);
  if (!getPropertyDescriptor(cx, wrapper, id, &desc)) return false;

  *bp = !!desc.object();
  return true;
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::hasOwn(JSContext* cx, HandleObject wrapper,
                                       HandleId id, bool* bp) const {
  // Skip our Base if it isn't already ProxyHandler.
  return js::BaseProxyHandler::hasOwn(cx, wrapper, id, bp);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::getOwnEnumerablePropertyKeys(
    JSContext* cx, HandleObject wrapper, AutoIdVector& props) const {
  // Skip our Base if it isn't already ProxyHandler.
  return js::BaseProxyHandler::getOwnEnumerablePropertyKeys(cx, wrapper, props);
}

template <typename Base, typename Traits>
JSObject* XrayWrapper<Base, Traits>::enumerate(JSContext* cx,
                                               HandleObject wrapper) const {
  MOZ_ASSERT(!Traits::HasPrototype, "Why did we get called?");
  // Skip our Base if it isn't already ProxyHandler.
  return js::BaseProxyHandler::enumerate(cx, wrapper);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::call(JSContext* cx, HandleObject wrapper,
                                     const JS::CallArgs& args) const {
  assertEnteredPolicy(cx, wrapper, JSID_VOID, BaseProxyHandler::CALL);
  // Hard cast the singleton since SecurityWrapper doesn't have one.
  return Traits::call(cx, wrapper, args, Base::singleton);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::construct(JSContext* cx, HandleObject wrapper,
                                          const JS::CallArgs& args) const {
  assertEnteredPolicy(cx, wrapper, JSID_VOID, BaseProxyHandler::CALL);
  // Hard cast the singleton since SecurityWrapper doesn't have one.
  return Traits::construct(cx, wrapper, args, Base::singleton);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::getBuiltinClass(JSContext* cx,
                                                JS::HandleObject wrapper,
                                                js::ESClass* cls) const {
  return Traits::getBuiltinClass(cx, wrapper, Base::singleton, cls);
}

template <typename Base, typename Traits>
const char* XrayWrapper<Base, Traits>::className(JSContext* cx,
                                                 HandleObject wrapper) const {
  return Traits::className(cx, wrapper, Base::singleton);
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::getPrototype(
    JSContext* cx, JS::HandleObject wrapper,
    JS::MutableHandleObject protop) const {
  // We really only want this override for non-SecurityWrapper-inheriting
  // |Base|. But doing that statically with templates requires partial method
  // specializations (and therefore a helper class), which is all more trouble
  // than it's worth. Do a dynamic check.
  if (Base::hasSecurityPolicy()) return Base::getPrototype(cx, wrapper, protop);

  RootedObject target(cx, Traits::getTargetObject(wrapper));
  RootedObject expando(cx);
  if (!Traits::singleton.getExpandoObject(cx, target, wrapper, &expando))
    return false;

  // We want to keep the Xray's prototype distinct from that of content, but
  // only if there's been a set. If there's not an expando, or the expando
  // slot is |undefined|, hand back the default proto, appropriately wrapped.

  if (expando) {
    RootedValue v(cx);
    {  // Scope for JSAutoCompartment
      JSAutoCompartment ac(cx, expando);
      v = JS_GetReservedSlot(expando, JSSLOT_EXPANDO_PROTOTYPE);
    }
    if (!v.isUndefined()) {
      protop.set(v.toObjectOrNull());
      return JS_WrapObject(cx, protop);
    }
  }

  // Check our holder, and cache there if we don't have it cached already.
  RootedObject holder(cx, Traits::singleton.ensureHolder(cx, wrapper));
  if (!holder) return false;

  Value cached = js::GetReservedSlot(holder, Traits::HOLDER_SLOT_CACHED_PROTO);
  if (cached.isUndefined()) {
    if (!getPrototypeHelper(cx, wrapper, target, protop)) return false;

    js::SetReservedSlot(holder, Traits::HOLDER_SLOT_CACHED_PROTO,
                        ObjectOrNullValue(protop));
  } else {
    protop.set(cached.toObjectOrNull());
  }
  return true;
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::setPrototype(JSContext* cx,
                                             JS::HandleObject wrapper,
                                             JS::HandleObject proto,
                                             JS::ObjectOpResult& result) const {
  // Do this only for non-SecurityWrapper-inheriting |Base|. See the comment
  // in getPrototype().
  if (Base::hasSecurityPolicy())
    return Base::setPrototype(cx, wrapper, proto, result);

  RootedObject target(cx, Traits::getTargetObject(wrapper));
  RootedObject expando(
      cx, Traits::singleton.ensureExpandoObject(cx, wrapper, target));
  if (!expando) return false;

  // The expando lives in the target's compartment, so do our installation
  // there.
  JSAutoCompartment ac(cx, target);

  RootedValue v(cx, ObjectOrNullValue(proto));
  if (!JS_WrapValue(cx, &v)) return false;
  JS_SetReservedSlot(expando, JSSLOT_EXPANDO_PROTOTYPE, v);
  return result.succeed();
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::getPrototypeIfOrdinary(
    JSContext* cx, JS::HandleObject wrapper, bool* isOrdinary,
    JS::MutableHandleObject protop) const {
  // We want to keep the Xray's prototype distinct from that of content, but
  // only if there's been a set.  This different-prototype-over-time behavior
  // means that the [[GetPrototypeOf]] trap *can't* be ECMAScript's ordinary
  // [[GetPrototypeOf]].  This also covers cross-origin Window behavior that
  // per
  // <https://html.spec.whatwg.org/multipage/browsers.html#windowproxy-getprototypeof>
  // must be non-ordinary.
  *isOrdinary = false;
  return true;
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::setImmutablePrototype(JSContext* cx,
                                                      JS::HandleObject wrapper,
                                                      bool* succeeded) const {
  // For now, lacking an obvious place to store a bit, prohibit making an
  // Xray's [[Prototype]] immutable.  We can revisit this (or maybe give all
  // Xrays immutable [[Prototype]], because who does this, really?) later if
  // necessary.
  *succeeded = false;
  return true;
}

template <typename Base, typename Traits>
bool XrayWrapper<Base, Traits>::getPropertyKeys(JSContext* cx,
                                                HandleObject wrapper,
                                                unsigned flags,
                                                AutoIdVector& props) const {
  assertEnteredPolicy(cx, wrapper, JSID_VOID, BaseProxyHandler::ENUMERATE);

  // Enumerate expando properties first. Note that the expando object lives
  // in the target compartment.
  RootedObject target(cx, Traits::getTargetObject(wrapper));
  RootedObject expando(cx);
  if (!Traits::singleton.getExpandoObject(cx, target, wrapper, &expando))
    return false;

  if (expando) {
    JSAutoCompartment ac(cx, expando);
    if (!js::GetPropertyKeys(cx, expando, flags, &props)) return false;
  }
  for (size_t i = 0; i < props.length(); ++i) JS_MarkCrossZoneId(cx, props[i]);

  return Traits::singleton.enumerateNames(cx, wrapper, flags, props);
}

/*
 * The Permissive / Security variants should be used depending on whether the
 * compartment of the wrapper is guranteed to subsume the compartment of the
 * wrapped object (i.e. - whether it is safe from a security perspective to
 * unwrap the wrapper).
 */

template <typename Base, typename Traits>
const xpc::XrayWrapper<Base, Traits> xpc::XrayWrapper<Base, Traits>::singleton(
    0);

template class PermissiveXrayXPCWN;
template class SecurityXrayXPCWN;
template class PermissiveXrayDOM;
template class SecurityXrayDOM;
template class PermissiveXrayJS;
template class PermissiveXrayOpaque;

/*
 * This callback is used by the JS engine to test if a proxy handler is for a
 * cross compartment xray with no security requirements.
 */
static bool IsCrossCompartmentXrayCallback(
    const js::BaseProxyHandler* handler) {
  return handler == &PermissiveXrayDOM::singleton;
}

js::XrayJitInfo gXrayJitInfo = {IsCrossCompartmentXrayCallback,
                                GlobalHasExclusiveExpandos, JSSLOT_XRAY_HOLDER,
                                XrayTraits::HOLDER_SLOT_EXPANDO,
                                JSSLOT_EXPANDO_PROTOTYPE};

}  // namespace xpc
