js/public/Wrapper.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  * vim: set ts=8 sts=2 et sw=2 tw=80:
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef js_Wrapper_h
   8 #define js_Wrapper_h
   9
  10 #include "mozilla/Attributes.h"
  11
  12 #include "js/Proxy.h"
  13
  14 namespace js {
  15
  16 /*
  17  * Helper for Wrapper::New default options.
  18  *
  19  * Callers of Wrapper::New() who wish to specify a prototype for the created
  20  * Wrapper, *MUST* construct a WrapperOptions with a JSContext.
  21  */
  22 class MOZ_STACK_CLASS WrapperOptions : public ProxyOptions {
  23  public:
  24   WrapperOptions() : ProxyOptions(false), proto_() {}
  25
  26   explicit WrapperOptions(JSContext* cx) : ProxyOptions(false), proto_() {
  27     proto_.emplace(cx);
  28   }
  29
  30   inline JSObject* proto() const;
  31   WrapperOptions& setProto(JSObject* protoArg) {
  32     MOZ_ASSERT(proto_);
  33     *proto_ = protoArg;
  34     return *this;
  35   }
  36
  37  private:
  38   mozilla::Maybe<JS::RootedObject> proto_;
  39 };
  40
  41 // Base class for proxy handlers that want to forward all operations to an
  42 // object stored in the proxy's private slot.
  43 class JS_FRIEND_API ForwardingProxyHandler : public BaseProxyHandler {
  44  public:
  45   using BaseProxyHandler::BaseProxyHandler;
  46
  47   /* Standard internal methods. */
  48   virtual bool getOwnPropertyDescriptor(
  49       JSContext* cx, JS::HandleObject proxy, JS::HandleId id,
  50       JS::MutableHandle<JS::PropertyDescriptor> desc) const override;
  51   virtual bool defineProperty(JSContext* cx, JS::HandleObject proxy,
  52                               JS::HandleId id,
  53                               JS::Handle<JS::PropertyDescriptor> desc,
  54                               JS::ObjectOpResult& result) const override;
  55   virtual bool ownPropertyKeys(JSContext* cx, JS::HandleObject proxy,
  56                                JS::MutableHandleIdVector props) const override;
  57   virtual bool delete_(JSContext* cx, JS::HandleObject proxy, JS::HandleId id,
  58                        JS::ObjectOpResult& result) const override;
  59   virtual bool enumerate(JSContext* cx, JS::HandleObject proxy,
  60                          JS::MutableHandleIdVector props) const override;
  61   virtual bool getPrototype(JSContext* cx, JS::HandleObject proxy,
  62                             JS::MutableHandleObject protop) const override;
  63   virtual bool setPrototype(JSContext* cx, JS::HandleObject proxy,
  64                             JS::HandleObject proto,
  65                             JS::ObjectOpResult& result) const override;
  66   virtual bool getPrototypeIfOrdinary(
  67       JSContext* cx, JS::HandleObject proxy, bool* isOrdinary,
  68       JS::MutableHandleObject protop) const override;
  69   virtual bool setImmutablePrototype(JSContext* cx, JS::HandleObject proxy,
  70                                      bool* succeeded) const override;
  71   virtual bool preventExtensions(JSContext* cx, JS::HandleObject proxy,
  72                                  JS::ObjectOpResult& result) const override;
  73   virtual bool isExtensible(JSContext* cx, JS::HandleObject proxy,
  74                             bool* extensible) const override;
  75   virtual bool has(JSContext* cx, JS::HandleObject proxy, JS::HandleId id,
  76                    bool* bp) const override;
  77   virtual bool get(JSContext* cx, JS::HandleObject proxy,
  78                    JS::HandleValue receiver, JS::HandleId id,
  79                    JS::MutableHandleValue vp) const override;
  80   virtual bool set(JSContext* cx, JS::HandleObject proxy, JS::HandleId id,
  81                    JS::HandleValue v, JS::HandleValue receiver,
  82                    JS::ObjectOpResult& result) const override;
  83   virtual bool call(JSContext* cx, JS::HandleObject proxy,
  84                     const JS::CallArgs& args) const override;
  85   virtual bool construct(JSContext* cx, JS::HandleObject proxy,
  86                          const JS::CallArgs& args) const override;
  87
  88   /* SpiderMonkey extensions. */
  89   virtual bool hasOwn(JSContext* cx, JS::HandleObject proxy, JS::HandleId id,
  90                       bool* bp) const override;
  91   virtual bool getOwnEnumerablePropertyKeys(
  92       JSContext* cx, JS::HandleObject proxy,
  93       JS::MutableHandleIdVector props) const override;
  94   virtual bool nativeCall(JSContext* cx, JS::IsAcceptableThis test,
  95                           JS::NativeImpl impl,
  96                           const JS::CallArgs& args) const override;
  97   virtual bool hasInstance(JSContext* cx, JS::HandleObject proxy,
  98                            JS::MutableHandleValue v, bool* bp) const override;
  99   virtual bool getBuiltinClass(JSContext* cx, JS::HandleObject proxy,
 100                                ESClass* cls) const override;
 101   virtual bool isArray(JSContext* cx, JS::HandleObject proxy,
 102                        JS::IsArrayAnswer* answer) const override;
 103   virtual const char* className(JSContext* cx,
 104                                 JS::HandleObject proxy) const override;
 105   virtual JSString* fun_toString(JSContext* cx, JS::HandleObject proxy,
 106                                  bool isToSource) const override;
 107   virtual RegExpShared* regexp_toShared(JSContext* cx,
 108                                         JS::HandleObject proxy) const override;
 109   virtual bool boxedValue_unbox(JSContext* cx, JS::HandleObject proxy,
 110                                 JS::MutableHandleValue vp) const override;
 111   virtual bool isCallable(JSObject* obj) const override;
 112   virtual bool isConstructor(JSObject* obj) const override;
 113
 114   // Use the target object for private fields.
 115   virtual bool useProxyExpandoObjectForPrivateFields() const override {
 116     return false;
 117   }
 118 };
 119
 120 /*
 121  * A wrapper is a proxy with a target object to which it generally forwards
 122  * operations, but may restrict access to certain operations or augment those
 123  * operations in various ways.
 124  *
 125  * A wrapper can be "unwrapped" in C++, exposing the underlying object.
 126  * Callers should be careful to avoid unwrapping security wrappers in the wrong
 127  * context.
 128  *
 129  * Important: If you add a method implementation here, you probably also need
 130  * to add an override in CrossCompartmentWrapper. If you don't, you risk
 131  * compartment mismatches. See bug 945826 comment 0.
 132  */
 133 class JS_FRIEND_API Wrapper : public ForwardingProxyHandler {
 134   unsigned mFlags;
 135
 136  public:
 137   explicit constexpr Wrapper(unsigned aFlags, bool aHasPrototype = false,
 138                              bool aHasSecurityPolicy = false)
 139       : ForwardingProxyHandler(&family, aHasPrototype, aHasSecurityPolicy),
 140         mFlags(aFlags) {}
 141
 142   virtual bool finalizeInBackground(const JS::Value& priv) const override;
 143
 144   /**
 145    * A hook subclasses can override to implement CheckedUnwrapDynamic
 146    * behavior.  The JSContext represents the "who is trying to unwrap?" Realm.
 147    * The JSObject is the wrapper that the caller is trying to unwrap.
 148    */
 149   virtual bool dynamicCheckedUnwrapAllowed(JS::HandleObject obj,
 150                                            JSContext* cx) const {
 151     MOZ_ASSERT(hasSecurityPolicy(), "Why are you asking?");
 152     return false;
 153   }
 154
 155   using BaseProxyHandler::Action;
 156
 157   enum Flags { CROSS_COMPARTMENT = 1 << 0, LAST_USED_FLAG = CROSS_COMPARTMENT };
 158
 159   static JSObject* New(JSContext* cx, JSObject* obj, const Wrapper* handler,
 160                        const WrapperOptions& options = WrapperOptions());
 161
 162   static JSObject* NewSingleton(
 163       JSContext* cx, JSObject* obj, const Wrapper* handler,
 164       const WrapperOptions& options = WrapperOptions());
 165
 166   static JSObject* Renew(JSObject* existing, JSObject* obj,
 167                          const Wrapper* handler);
 168
 169   static inline const Wrapper* wrapperHandler(const JSObject* wrapper);
 170
 171   static JSObject* wrappedObject(JSObject* wrapper);
 172
 173   unsigned flags() const { return mFlags; }
 174
 175   bool isCrossCompartmentWrapper() const {
 176     return !!(mFlags & CROSS_COMPARTMENT);
 177   }
 178
 179   static const char family;
 180   static const Wrapper singleton;
 181   static const Wrapper singletonWithPrototype;
 182
 183   static JSObject* const defaultProto;
 184 };
 185
 186 inline JSObject* WrapperOptions::proto() const {
 187   return proto_ ? *proto_ : Wrapper::defaultProto;
 188 }
 189
 190 /* Base class for all cross compartment wrapper handlers. */
 191 class JS_FRIEND_API CrossCompartmentWrapper : public Wrapper {
 192  public:
 193   explicit constexpr CrossCompartmentWrapper(unsigned aFlags,
 194                                              bool aHasPrototype = false,
 195                                              bool aHasSecurityPolicy = false)
 196       : Wrapper(CROSS_COMPARTMENT | aFlags, aHasPrototype, aHasSecurityPolicy) {
 197   }
 198
 199   /* Standard internal methods. */
 200   virtual bool getOwnPropertyDescriptor(
 201       JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 202       JS::MutableHandle<JS::PropertyDescriptor> desc) const override;
 203   virtual bool defineProperty(JSContext* cx, JS::HandleObject wrapper,
 204                               JS::HandleId id,
 205                               JS::Handle<JS::PropertyDescriptor> desc,
 206                               JS::ObjectOpResult& result) const override;
 207   virtual bool ownPropertyKeys(JSContext* cx, JS::HandleObject wrapper,
 208                                JS::MutableHandleIdVector props) const override;
 209   virtual bool delete_(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 210                        JS::ObjectOpResult& result) const override;
 211   virtual bool enumerate(JSContext* cx, JS::HandleObject proxy,
 212                          JS::MutableHandleIdVector props) const override;
 213   virtual bool getPrototype(JSContext* cx, JS::HandleObject proxy,
 214                             JS::MutableHandleObject protop) const override;
 215   virtual bool setPrototype(JSContext* cx, JS::HandleObject proxy,
 216                             JS::HandleObject proto,
 217                             JS::ObjectOpResult& result) const override;
 218
 219   virtual bool getPrototypeIfOrdinary(
 220       JSContext* cx, JS::HandleObject proxy, bool* isOrdinary,
 221       JS::MutableHandleObject protop) const override;
 222   virtual bool setImmutablePrototype(JSContext* cx, JS::HandleObject proxy,
 223                                      bool* succeeded) const override;
 224   virtual bool preventExtensions(JSContext* cx, JS::HandleObject wrapper,
 225                                  JS::ObjectOpResult& result) const override;
 226   virtual bool isExtensible(JSContext* cx, JS::HandleObject wrapper,
 227                             bool* extensible) const override;
 228   virtual bool has(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 229                    bool* bp) const override;
 230   virtual bool get(JSContext* cx, JS::HandleObject wrapper,
 231                    JS::HandleValue receiver, JS::HandleId id,
 232                    JS::MutableHandleValue vp) const override;
 233   virtual bool set(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 234                    JS::HandleValue v, JS::HandleValue receiver,
 235                    JS::ObjectOpResult& result) const override;
 236   virtual bool call(JSContext* cx, JS::HandleObject wrapper,
 237                     const JS::CallArgs& args) const override;
 238   virtual bool construct(JSContext* cx, JS::HandleObject wrapper,
 239                          const JS::CallArgs& args) const override;
 240
 241   /* SpiderMonkey extensions. */
 242   virtual bool hasOwn(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 243                       bool* bp) const override;
 244   virtual bool getOwnEnumerablePropertyKeys(
 245       JSContext* cx, JS::HandleObject wrapper,
 246       JS::MutableHandleIdVector props) const override;
 247   virtual bool nativeCall(JSContext* cx, JS::IsAcceptableThis test,
 248                           JS::NativeImpl impl,
 249                           const JS::CallArgs& args) const override;
 250   virtual bool hasInstance(JSContext* cx, JS::HandleObject wrapper,
 251                            JS::MutableHandleValue v, bool* bp) const override;
 252   virtual const char* className(JSContext* cx,
 253                                 JS::HandleObject proxy) const override;
 254   virtual JSString* fun_toString(JSContext* cx, JS::HandleObject wrapper,
 255                                  bool isToSource) const override;
 256   virtual RegExpShared* regexp_toShared(JSContext* cx,
 257                                         JS::HandleObject proxy) const override;
 258   virtual bool boxedValue_unbox(JSContext* cx, JS::HandleObject proxy,
 259                                 JS::MutableHandleValue vp) const override;
 260
 261   // Allocate CrossCompartmentWrappers in the nursery.
 262   virtual bool canNurseryAllocate() const override { return true; }
 263
 264   static const CrossCompartmentWrapper singleton;
 265   static const CrossCompartmentWrapper singletonWithPrototype;
 266 };
 267
 268 class JS_FRIEND_API OpaqueCrossCompartmentWrapper
 269     : public CrossCompartmentWrapper {
 270  public:
 271   explicit constexpr OpaqueCrossCompartmentWrapper()
 272       : CrossCompartmentWrapper(0) {}
 273
 274   /* Standard internal methods. */
 275   virtual bool getOwnPropertyDescriptor(
 276       JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 277       JS::MutableHandle<JS::PropertyDescriptor> desc) const override;
 278   virtual bool defineProperty(JSContext* cx, JS::HandleObject wrapper,
 279                               JS::HandleId id,
 280                               JS::Handle<JS::PropertyDescriptor> desc,
 281                               JS::ObjectOpResult& result) const override;
 282   virtual bool ownPropertyKeys(JSContext* cx, JS::HandleObject wrapper,
 283                                JS::MutableHandleIdVector props) const override;
 284   virtual bool delete_(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 285                        JS::ObjectOpResult& result) const override;
 286   virtual bool enumerate(JSContext* cx, JS::HandleObject proxy,
 287                          JS::MutableHandleIdVector props) const override;
 288   virtual bool getPrototype(JSContext* cx, JS::HandleObject wrapper,
 289                             JS::MutableHandleObject protop) const override;
 290   virtual bool setPrototype(JSContext* cx, JS::HandleObject wrapper,
 291                             JS::HandleObject proto,
 292                             JS::ObjectOpResult& result) const override;
 293   virtual bool getPrototypeIfOrdinary(
 294       JSContext* cx, JS::HandleObject wrapper, bool* isOrdinary,
 295       JS::MutableHandleObject protop) const override;
 296   virtual bool setImmutablePrototype(JSContext* cx, JS::HandleObject wrapper,
 297                                      bool* succeeded) const override;
 298   virtual bool preventExtensions(JSContext* cx, JS::HandleObject wrapper,
 299                                  JS::ObjectOpResult& result) const override;
 300   virtual bool isExtensible(JSContext* cx, JS::HandleObject wrapper,
 301                             bool* extensible) const override;
 302   virtual bool has(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 303                    bool* bp) const override;
 304   virtual bool get(JSContext* cx, JS::HandleObject wrapper,
 305                    JS::HandleValue receiver, JS::HandleId id,
 306                    JS::MutableHandleValue vp) const override;
 307   virtual bool set(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 308                    JS::HandleValue v, JS::HandleValue receiver,
 309                    JS::ObjectOpResult& result) const override;
 310   virtual bool call(JSContext* cx, JS::HandleObject wrapper,
 311                     const JS::CallArgs& args) const override;
 312   virtual bool construct(JSContext* cx, JS::HandleObject wrapper,
 313                          const JS::CallArgs& args) const override;
 314
 315   /* SpiderMonkey extensions. */
 316   virtual bool hasOwn(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 317                       bool* bp) const override;
 318   virtual bool getOwnEnumerablePropertyKeys(
 319       JSContext* cx, JS::HandleObject wrapper,
 320       JS::MutableHandleIdVector props) const override;
 321   virtual bool getBuiltinClass(JSContext* cx, JS::HandleObject wrapper,
 322                                ESClass* cls) const override;
 323   virtual bool isArray(JSContext* cx, JS::HandleObject obj,
 324                        JS::IsArrayAnswer* answer) const override;
 325   virtual bool hasInstance(JSContext* cx, JS::HandleObject wrapper,
 326                            JS::MutableHandleValue v, bool* bp) const override;
 327   virtual const char* className(JSContext* cx,
 328                                 JS::HandleObject wrapper) const override;
 329   virtual JSString* fun_toString(JSContext* cx, JS::HandleObject proxy,
 330                                  bool isToSource) const override;
 331
 332   static const OpaqueCrossCompartmentWrapper singleton;
 333 };
 334
 335 /*
 336  * Base class for security wrappers. A security wrapper is potentially hiding
 337  * all or part of some wrapped object thus SecurityWrapper defaults to denying
 338  * access to the wrappee. This is the opposite of Wrapper which tries to be
 339  * completely transparent.
 340  *
 341  * NB: Currently, only a few ProxyHandler operations are overridden to deny
 342  * access, relying on derived SecurityWrapper to block access when necessary.
 343  */
 344 template <class Base>
 345 class JS_FRIEND_API SecurityWrapper : public Base {
 346  public:
 347   explicit constexpr SecurityWrapper(unsigned flags, bool hasPrototype = false)
 348       : Base(flags, hasPrototype, /* hasSecurityPolicy = */ true) {}
 349
 350   virtual bool enter(JSContext* cx, JS::HandleObject wrapper, JS::HandleId id,
 351                      Wrapper::Action act, bool mayThrow,
 352                      bool* bp) const override;
 353
 354   virtual bool defineProperty(JSContext* cx, JS::HandleObject wrapper,
 355                               JS::HandleId id,
 356                               JS::Handle<JS::PropertyDescriptor> desc,
 357                               JS::ObjectOpResult& result) const override;
 358   virtual bool isExtensible(JSContext* cx, JS::HandleObject wrapper,
 359                             bool* extensible) const override;
 360   virtual bool preventExtensions(JSContext* cx, JS::HandleObject wrapper,
 361                                  JS::ObjectOpResult& result) const override;
 362   virtual bool setPrototype(JSContext* cx, JS::HandleObject proxy,
 363                             JS::HandleObject proto,
 364                             JS::ObjectOpResult& result) const override;
 365   virtual bool setImmutablePrototype(JSContext* cx, JS::HandleObject proxy,
 366                                      bool* succeeded) const override;
 367
 368   virtual bool nativeCall(JSContext* cx, JS::IsAcceptableThis test,
 369                           JS::NativeImpl impl,
 370                           const JS::CallArgs& args) const override;
 371   virtual bool getBuiltinClass(JSContext* cx, JS::HandleObject wrapper,
 372                                ESClass* cls) const override;
 373   virtual bool isArray(JSContext* cx, JS::HandleObject wrapper,
 374                        JS::IsArrayAnswer* answer) const override;
 375   virtual RegExpShared* regexp_toShared(JSContext* cx,
 376                                         JS::HandleObject proxy) const override;
 377   virtual bool boxedValue_unbox(JSContext* cx, JS::HandleObject proxy,
 378                                 JS::MutableHandleValue vp) const override;
 379
 380   // Allow isCallable and isConstructor. They used to be class-level, and so
 381   // could not be guarded against.
 382
 383   /*
 384    * Allow our subclasses to select the superclass behavior they want without
 385    * needing to specify an exact superclass.
 386    */
 387   typedef Base Permissive;
 388   typedef SecurityWrapper<Base> Restrictive;
 389 };
 390
 391 typedef SecurityWrapper<CrossCompartmentWrapper>
 392     CrossCompartmentSecurityWrapper;
 393
 394 extern JSObject* TransparentObjectWrapper(JSContext* cx,
 395                                           JS::HandleObject existing,
 396                                           JS::HandleObject obj);
 397
 398 inline bool IsWrapper(const JSObject* obj) {
 399   return IsProxy(obj) && GetProxyHandler(obj)->family() == &Wrapper::family;
 400 }
 401
 402 inline bool IsCrossCompartmentWrapper(const JSObject* obj) {
 403   return IsWrapper(obj) &&
 404          (Wrapper::wrapperHandler(obj)->flags() & Wrapper::CROSS_COMPARTMENT);
 405 }
 406
 407 /* static */ inline const Wrapper* Wrapper::wrapperHandler(
 408     const JSObject* wrapper) {
 409   MOZ_ASSERT(IsWrapper(wrapper));
 410   return static_cast<const Wrapper*>(GetProxyHandler(wrapper));
 411 }
 412
 413 // Given a JSObject, returns that object stripped of wrappers. If
 414 // stopAtWindowProxy is true, then this returns the WindowProxy if it was
 415 // previously wrapped. Otherwise, this returns the first object for which
 416 // JSObject::isWrapper returns false.
 417 //
 418 // ExposeToActiveJS is called on wrapper targets to allow gray marking
 419 // assertions to work while an incremental GC is in progress, but this means
 420 // that this cannot be called from the GC or off the main thread.
 421 JS_FRIEND_API JSObject* UncheckedUnwrap(JSObject* obj,
 422                                         bool stopAtWindowProxy = true,
 423                                         unsigned* flagsp = nullptr);
 424
 425 // Given a JSObject, returns that object stripped of wrappers, except
 426 // WindowProxy wrappers.  At each stage, the wrapper has the opportunity to veto
 427 // the unwrap. Null is returned if there are security wrappers that can't be
 428 // unwrapped.
 429 //
 430 // This does a static-only unwrap check: it basically checks whether _all_
 431 // globals in the wrapper's source compartment should be able to access the
 432 // wrapper target.  This won't necessarily return the right thing for the HTML
 433 // spec's cross-origin objects (WindowProxy and Location), but is fine to use
 434 // when failure to unwrap one of those objects wouldn't be a problem.  For
 435 // example, if you want to test whether your target object is a specific class
 436 // that's not WindowProxy or Location, you can use this.
 437 //
 438 // ExposeToActiveJS is called on wrapper targets to allow gray marking
 439 // assertions to work while an incremental GC is in progress, but this means
 440 // that this cannot be called from the GC or off the main thread.
 441 JS_FRIEND_API JSObject* CheckedUnwrapStatic(JSObject* obj);
 442
 443 // Unwrap only the outermost security wrapper, with the same semantics as
 444 // above. This is the checked version of Wrapper::wrappedObject.
 445 JS_FRIEND_API JSObject* UnwrapOneCheckedStatic(JSObject* obj);
 446
 447 // Given a JSObject, returns that object stripped of wrappers. At each stage,
 448 // the security wrapper has the opportunity to veto the unwrap. If
 449 // stopAtWindowProxy is true, then this returns the WindowProxy if it was
 450 // previously wrapped.  Null is returned if there are security wrappers that
 451 // can't be unwrapped.
 452 //
 453 // ExposeToActiveJS is called on wrapper targets to allow gray marking
 454 // assertions to work while an incremental GC is in progress, but this means
 455 // that this cannot be called from the GC or off the main thread.
 456 //
 457 // The JSContext argument will be used for dynamic checks (needed by WindowProxy
 458 // and Location) and should represent the Realm doing the unwrapping.  It is not
 459 // used to throw exceptions; this function never throws.
 460 //
 461 // This function may be able to GC (and the static analysis definitely thinks it
 462 // can), but it still takes a JSObject* argument, because some of its callers
 463 // would actually have a bit of a hard time producing a Rooted.  And it ends up
 464 // having to root internally anyway, because it wants to use the value in a loop
 465 // and you can't assign to a HandleObject.  What this means is that callers who
 466 // plan to use the argument object after they have called this function will
 467 // need to root it to avoid hazard failures, even though this function doesn't
 468 // require a Handle.
 469 JS_FRIEND_API JSObject* CheckedUnwrapDynamic(JSObject* obj, JSContext* cx,
 470                                              bool stopAtWindowProxy = true);
 471
 472 // Unwrap only the outermost security wrapper, with the same semantics as
 473 // above. This is the checked version of Wrapper::wrappedObject.
 474 JS_FRIEND_API JSObject* UnwrapOneCheckedDynamic(JS::HandleObject obj,
 475                                                 JSContext* cx,
 476                                                 bool stopAtWindowProxy = true);
 477
 478 // Given a JSObject, returns that object stripped of wrappers. This returns the
 479 // WindowProxy if it was previously wrapped.
 480 //
 481 // ExposeToActiveJS is not called on wrapper targets so this can be called from
 482 // the GC or off the main thread.
 483 JS_FRIEND_API JSObject* UncheckedUnwrapWithoutExpose(JSObject* obj);
 484
 485 void ReportAccessDenied(JSContext* cx);
 486
 487 JS_FRIEND_API void NukeCrossCompartmentWrapper(JSContext* cx,
 488                                                JSObject* wrapper);
 489
 490 // If a cross-compartment wrapper source => target exists, nuke it.
 491 JS_FRIEND_API void NukeCrossCompartmentWrapperIfExists(JSContext* cx,
 492                                                        JS::Compartment* source,
 493                                                        JSObject* target);
 494
 495 void RemapWrapper(JSContext* cx, JSObject* wobj, JSObject* newTarget);
 496 void RemapDeadWrapper(JSContext* cx, JS::HandleObject wobj,
 497                       JS::HandleObject newTarget);
 498
 499 JS_FRIEND_API bool RemapAllWrappersForObject(JSContext* cx,
 500                                              JS::HandleObject oldTarget,
 501                                              JS::HandleObject newTarget);
 502
 503 // API to recompute all cross-compartment wrappers whose source and target
 504 // match the given filters.
 505 JS_FRIEND_API bool RecomputeWrappers(JSContext* cx,
 506                                      const CompartmentFilter& sourceFilter,
 507                                      const CompartmentFilter& targetFilter);
 508
 509 } /* namespace js */
 510
 511 #endif /* js_Wrapper_h */