/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */

/* vim: set ts=8 sts=2 et sw=2 tw=80: */

/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "base/basictypes.h"

#include "nsFrameMessageManager.h"

#include "ContentChild.h"

#include "GeckoProfiler.h"

#include "nsASCIIMask.h"

#include "nsContentUtils.h"

#include "nsError.h"

#include "nsIXPConnect.h"

#include "jsapi.h"

#include "jsfriendapi.h"

#include "nsJSUtils.h"

#include "nsJSPrincipals.h"

#include "nsNetUtil.h"

#include "mozilla/dom/ScriptLoader.h"

#include "nsFrameLoader.h"

#include "nsIInputStream.h"

#include "nsIXULRuntime.h"

#include "nsIScriptError.h"

#include "nsIConsoleService.h"

#include "nsIMemoryReporter.h"

#include "nsIProtocolHandler.h"

#include "nsIScriptSecurityManager.h"

#include "xpcpublic.h"

#include "js/CompilationAndEvaluation.h"

#include "js/JSON.h"

#include "js/SourceBufferHolder.h"

#include "mozilla/ClearOnShutdown.h"

#include "mozilla/CycleCollectedJSContext.h"

#include "mozilla/Preferences.h"

#include "mozilla/ScriptPreloader.h"

#include "mozilla/Telemetry.h"

#include "mozilla/dom/ChildProcessMessageManager.h"

#include "mozilla/dom/ChromeMessageBroadcaster.h"

#include "mozilla/dom/File.h"

#include "mozilla/dom/MessageManagerBinding.h"

#include "mozilla/dom/MessagePort.h"

#include "mozilla/dom/ContentParent.h"

#include "mozilla/dom/ContentProcessMessageManager.h"

#include "mozilla/dom/ParentProcessMessageManager.h"

#include "mozilla/dom/PermissionMessageUtils.h"

#include "mozilla/dom/ProcessMessageManager.h"

#include "mozilla/dom/ResolveSystemBinding.h"

#include "mozilla/dom/SameProcessMessageQueue.h"

#include "mozilla/dom/ScriptSettings.h"

#include "mozilla/dom/ToJSValue.h"

#include "mozilla/dom/ipc/SharedMap.h"

#include "mozilla/dom/ipc/StructuredCloneData.h"

#include "mozilla/dom/DOMStringList.h"

#include "mozilla/jsipc/CrossProcessObjectWrappers.h"

#include "mozilla/recordreplay/ParentIPC.h"

#include "nsPrintfCString.h"

#include "nsXULAppAPI.h"

#include "nsQueryObject.h"

#include "xpcprivate.h"

#include <algorithm>

#include "chrome/common/ipc_channel.h" // for IPC::Channel::kMaximumMessageSize

#ifdef XP_WIN

# if defined(SendMessage)

#  undef SendMessage

# endif

#endif

#ifdef FUZZING

#include "MessageManagerFuzzer.h"

#endif

using namespace mozilla;

using namespace mozilla::dom;

using namespace mozilla::dom::ipc;

nsFrameMessageManager::nsFrameMessageManager(MessageManagerCallback* aCallback,

                                             MessageManagerFlags aFlags)

 : mChrome(aFlags & MessageManagerFlags::MM_CHROME),

   mGlobal(aFlags & MessageManagerFlags::MM_GLOBAL),

   mIsProcessManager(aFlags & MessageManagerFlags::MM_PROCESSMANAGER),

   mIsBroadcaster(aFlags & MessageManagerFlags::MM_BROADCASTER),

   mOwnsCallback(aFlags & MessageManagerFlags::MM_OWNSCALLBACK),

   mHandlingMessage(false),

   mClosed(false),

   mDisconnected(false),

   mCallback(aCallback)

{

  NS_ASSERTION(!mIsBroadcaster || !mCallback,

               "Broadcasters cannot have callbacks!");

  if (mOwnsCallback) {

    mOwnedCallback = aCallback;

  }

}

nsFrameMessageManager::~nsFrameMessageManager()

{

  for (int32_t i = mChildManagers.Length(); i > 0; --i) {

    mChildManagers[i - 1]->Disconnect(false);

  }

  if (mIsProcessManager) {

    if (this == sParentProcessManager) {

      sParentProcessManager = nullptr;

    }

    if (this == sChildProcessManager) {

      sChildProcessManager = nullptr;

      delete mozilla::dom::SameProcessMessageQueue::Get();

    }

    if (this == sSameProcessParentManager) {

      sSameProcessParentManager = nullptr;

    }

  }

}

inline void

ImplCycleCollectionTraverse(nsCycleCollectionTraversalCallback& aCallback,

                            nsMessageListenerInfo& aField,

                            const char* aName,

                            uint32_t aFlags = 0)

{

  ImplCycleCollectionTraverse(aCallback, aField.mStrongListener, aName, aFlags);

  ImplCycleCollectionTraverse(aCallback, aField.mWeakListener, aName, aFlags);

}

NS_IMPL_CYCLE_COLLECTION_CLASS(nsFrameMessageManager)

NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsFrameMessageManager)

  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mListeners)

  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChildManagers)

  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSharedData)

NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END

NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsFrameMessageManager)

  NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mInitialProcessData)

NS_IMPL_CYCLE_COLLECTION_TRACE_END

NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsFrameMessageManager)

  NS_IMPL_CYCLE_COLLECTION_UNLINK(mListeners)

  for (int32_t i = tmp->mChildManagers.Length(); i > 0; --i) {

    tmp->mChildManagers[i - 1]->Disconnect(false);

  }

  NS_IMPL_CYCLE_COLLECTION_UNLINK(mChildManagers)

  NS_IMPL_CYCLE_COLLECTION_UNLINK(mSharedData)

  tmp->mInitialProcessData.setNull();

NS_IMPL_CYCLE_COLLECTION_UNLINK_END

NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsFrameMessageManager)

  NS_INTERFACE_MAP_ENTRY(nsISupports)

  /* Message managers in child process implement nsIMessageSender.

     Message managers in the chrome process are

     either broadcasters (if they have subordinate/child message

     managers) or they're simple message senders. */

  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIMessageSender, !mChrome || !mIsBroadcaster)

NS_INTERFACE_MAP_END

NS_IMPL_CYCLE_COLLECTING_ADDREF(nsFrameMessageManager)

NS_IMPL_CYCLE_COLLECTING_RELEASE(nsFrameMessageManager)

void

MessageManagerCallback::DoGetRemoteType(nsAString& aRemoteType,

                                        ErrorResult& aError) const

{

  aRemoteType.Truncate();

  mozilla::dom::ProcessMessageManager* parent = GetProcessMessageManager();

  if (!parent) {

    return;

  }

  parent->GetRemoteType(aRemoteType, aError);

}

bool

MessageManagerCallback::BuildClonedMessageDataForParent(nsIContentParent* aParent,

                                                        StructuredCloneData& aData,

                                                        ClonedMessageData& aClonedData)

{

  return aData.BuildClonedMessageDataForParent(aParent, aClonedData);

}

bool

MessageManagerCallback::BuildClonedMessageDataForChild(nsIContentChild* aChild,

                                                       StructuredCloneData& aData,

                                                       ClonedMessageData& aClonedData)

{

  return aData.BuildClonedMessageDataForChild(aChild, aClonedData);

}

void

mozilla::dom::ipc::UnpackClonedMessageDataForParent(const ClonedMessageData& aClonedData,

                                                    StructuredCloneData& aData)

{

  aData.BorrowFromClonedMessageDataForParent(aClonedData);

}

void

mozilla::dom::ipc::UnpackClonedMessageDataForChild(const ClonedMessageData& aClonedData,

                                                   StructuredCloneData& aData)

{

  aData.BorrowFromClonedMessageDataForChild(aClonedData);

}

bool

SameProcessCpowHolder::ToObject(JSContext* aCx,

                                JS::MutableHandle<JSObject*> aObjp)

{

  if (!mObj) {

    return true;

  }

  aObjp.set(mObj);

  return JS_WrapObject(aCx, aObjp);

}

void

nsFrameMessageManager::AddMessageListener(const nsAString& aMessageName,

                                          MessageListener& aListener,

                                          bool aListenWhenClosed,

                                          ErrorResult& aError)

{

  auto listeners = mListeners.LookupForAdd(aMessageName).OrInsert([]() {

      return new nsAutoTObserverArray<nsMessageListenerInfo, 1>();

    });

  uint32_t len = listeners->Length();

  for (uint32_t i = 0; i < len; ++i) {

    MessageListener* strongListener = listeners->ElementAt(i).mStrongListener;

    if (strongListener && *strongListener == aListener) {

      return;

    }

  }

  nsMessageListenerInfo* entry = listeners->AppendElement();

  entry->mStrongListener = &aListener;

  entry->mListenWhenClosed = aListenWhenClosed;

}

void

nsFrameMessageManager::RemoveMessageListener(const nsAString& aMessageName,

                                             MessageListener& aListener,

                                             ErrorResult& aError)

{

  nsAutoTObserverArray<nsMessageListenerInfo, 1>* listeners =

    mListeners.Get(aMessageName);

  if (listeners) {

    uint32_t len = listeners->Length();

    for (uint32_t i = 0; i < len; ++i) {

      MessageListener* strongListener = listeners->ElementAt(i).mStrongListener;

      if (strongListener && *strongListener == aListener) {

        listeners->RemoveElementAt(i);

        return;

      }

    }

  }

}

static already_AddRefed<nsISupports>

ToXPCOMMessageListener(MessageListener& aListener)

{

  return CallbackObjectHolder<mozilla::dom::MessageListener,

                              nsISupports>(&aListener).ToXPCOMCallback();

}

void

nsFrameMessageManager::AddWeakMessageListener(const nsAString& aMessageName,

                                              MessageListener& aListener,

                                              ErrorResult& aError)

{

  nsCOMPtr<nsISupports> listener(ToXPCOMMessageListener(aListener));

  nsWeakPtr weak = do_GetWeakReference(listener);

  if (!weak) {

    aError.Throw(NS_ERROR_NO_INTERFACE);

    return;

  }

#ifdef DEBUG

  // It's technically possible that one object X could give two different

  // nsIWeakReference*'s when you do_GetWeakReference(X).  We really don't want

  // this to happen; it will break e.g. RemoveWeakMessageListener.  So let's

  // check that we're not getting ourselves into that situation.

  nsCOMPtr<nsISupports> canonical = do_QueryInterface(listener);

  for (auto iter = mListeners.Iter(); !iter.Done(); iter.Next()) {

    nsAutoTObserverArray<nsMessageListenerInfo, 1>* listeners = iter.UserData();

    uint32_t count = listeners->Length();

    for (uint32_t i = 0; i < count; i++) {

      nsWeakPtr weakListener = listeners->ElementAt(i).mWeakListener;

      if (weakListener) {

        nsCOMPtr<nsISupports> otherCanonical = do_QueryReferent(weakListener);

        MOZ_ASSERT((canonical == otherCanonical) == (weak == weakListener));

      }

    }

  }

#endif

  auto listeners = mListeners.LookupForAdd(aMessageName).OrInsert([]() {

      return new nsAutoTObserverArray<nsMessageListenerInfo, 1>();

    });

  uint32_t len = listeners->Length();

  for (uint32_t i = 0; i < len; ++i) {

    if (listeners->ElementAt(i).mWeakListener == weak) {

      return;

    }

  }

  nsMessageListenerInfo* entry = listeners->AppendElement();

  entry->mWeakListener = weak;

  entry->mListenWhenClosed = false;

}

void

nsFrameMessageManager::RemoveWeakMessageListener(const nsAString& aMessageName,

                                                 MessageListener& aListener,

                                                 ErrorResult& aError)

{

  nsCOMPtr<nsISupports> listener(ToXPCOMMessageListener(aListener));

  nsWeakPtr weak = do_GetWeakReference(listener);

  if (!weak) {

    aError.Throw(NS_ERROR_NO_INTERFACE);

    return;

  }

  nsAutoTObserverArray<nsMessageListenerInfo, 1>* listeners =

    mListeners.Get(aMessageName);

  if (!listeners) {

    return;

  }

  uint32_t len = listeners->Length();

  for (uint32_t i = 0; i < len; ++i) {

    if (listeners->ElementAt(i).mWeakListener == weak) {

      listeners->RemoveElementAt(i);

      return;

    }

  }

}

void

nsFrameMessageManager::LoadScript(const nsAString& aURL,

                                  bool aAllowDelayedLoad,

                                  bool aRunInGlobalScope,

                                  ErrorResult& aError)

{

  if (aAllowDelayedLoad) {

    // Cache for future windows or frames

    mPendingScripts.AppendElement(aURL);

    mPendingScriptsGlobalStates.AppendElement(aRunInGlobalScope);

  }

  if (mCallback) {

#ifdef DEBUG_smaug

    printf("Will load %s \n", NS_ConvertUTF16toUTF8(aURL).get());

#endif

    if (!mCallback->DoLoadMessageManagerScript(aURL, aRunInGlobalScope)) {

      aError.Throw(NS_ERROR_FAILURE);

      return;

    }

  }

  for (uint32_t i = 0; i < mChildManagers.Length(); ++i) {

    RefPtr<nsFrameMessageManager> mm = mChildManagers[i];

    if (mm) {

      // Use false here, so that child managers don't cache the script, which

      // is already cached in the parent.

      mm->LoadScript(aURL, false, aRunInGlobalScope, IgnoreErrors());

    }

  }

}

void

nsFrameMessageManager::RemoveDelayedScript(const nsAString& aURL)

{

  for (uint32_t i = 0; i < mPendingScripts.Length(); ++i) {

    if (mPendingScripts[i] == aURL) {

      mPendingScripts.RemoveElementAt(i);

      mPendingScriptsGlobalStates.RemoveElementAt(i);

      break;

    }

  }

}

void

nsFrameMessageManager::GetDelayedScripts(JSContext* aCx,

                                         nsTArray<nsTArray<JS::Value>>& aList,

                                         ErrorResult& aError)

{

  // Frame message managers may return an incomplete list because scripts

  // that were loaded after it was connected are not added to the list.

  if (!IsGlobal() && !IsBroadcaster()) {

    NS_WARNING("Cannot retrieve list of pending frame scripts for frame"

               "message managers as it may be incomplete");

    aError.Throw(NS_ERROR_NOT_IMPLEMENTED);

    return;

  }

  aError.MightThrowJSException();

  aList.SetCapacity(mPendingScripts.Length());

  for (uint32_t i = 0; i < mPendingScripts.Length(); ++i) {

    JS::Rooted<JS::Value> url(aCx);

    if (!ToJSValue(aCx, mPendingScripts[i], &url)) {

      aError.NoteJSContextException(aCx);

      return;

    }

    nsTArray<JS::Value>* array = aList.AppendElement(2);

    array->AppendElement(url);

    array->AppendElement(JS::BooleanValue(mPendingScriptsGlobalStates[i]));

  }

}

static bool

GetParamsForMessage(JSContext* aCx,

                    const JS::Value& aValue,

                    const JS::Value& aTransfer,

                    StructuredCloneData& aData)

{

  // First try to use structured clone on the whole thing.

  JS::RootedValue v(aCx, aValue);

  JS::RootedValue t(aCx, aTransfer);

  ErrorResult rv;

  aData.Write(aCx, v, t, rv);

  if (!rv.Failed()) {

    return true;

  }

  rv.SuppressException();

  JS_ClearPendingException(aCx);

  nsCOMPtr<nsIConsoleService> console(do_GetService(NS_CONSOLESERVICE_CONTRACTID));

  if (console) {

    nsAutoString filename;

    uint32_t lineno = 0, column = 0;

    nsJSUtils::GetCallingLocation(aCx, filename, &lineno, &column);

    nsCOMPtr<nsIScriptError> error(do_CreateInstance(NS_SCRIPTERROR_CONTRACTID));

    error->Init(NS_LITERAL_STRING("Sending message that cannot be cloned. Are you trying to send an XPCOM object?"),

                filename, EmptyString(), lineno, column,

                nsIScriptError::warningFlag, "chrome javascript",

                false /* from private window */);

    console->LogMessage(error);

  }

  // Not clonable, try JSON

  //XXX This is ugly but currently structured cloning doesn't handle

  //    properly cases when interface is implemented in JS and used

  //    as a dictionary.

  nsAutoString json;

  NS_ENSURE_TRUE(nsContentUtils::StringifyJSON(aCx, &v, json), false);

  NS_ENSURE_TRUE(!json.IsEmpty(), false);

  JS::Rooted<JS::Value> val(aCx, JS::NullValue());

  NS_ENSURE_TRUE(JS_ParseJSON(aCx, static_cast<const char16_t*>(json.get()),

                              json.Length(), &val), false);

  aData.Write(aCx, val, rv);

  if (NS_WARN_IF(rv.Failed())) {

    rv.SuppressException();

    return false;

  }

  return true;

}

static bool sSendingSyncMessage = false;

static bool

AllowMessage(size_t aDataLength, const nsAString& aMessageName)

{

  // A message includes more than structured clone data, so subtract

  // 20KB to make it more likely that a message within this bound won't

  // result in an overly large IPC message.

  static const size_t kMaxMessageSize = IPC::Channel::kMaximumMessageSize - 20 * 1024;

  if (aDataLength < kMaxMessageSize) {

    return true;

  }

  NS_ConvertUTF16toUTF8 messageName(aMessageName);

  messageName.StripTaggedASCII(ASCIIMask::Mask0to9());

  Telemetry::Accumulate(Telemetry::REJECTED_MESSAGE_MANAGER_MESSAGE,

                        messageName);

  return false;

}

void

nsFrameMessageManager::SendMessage(JSContext* aCx,

                                   const nsAString& aMessageName,

                                   JS::Handle<JS::Value> aObj,

                                   JS::Handle<JSObject*> aObjects,

                                   nsIPrincipal* aPrincipal,

                                   bool aIsSync,

                                   nsTArray<JS::Value>& aResult,

                                   ErrorResult& aError)

{

  NS_ASSERTION(!IsGlobal(), "Should not call SendSyncMessage in chrome");

  NS_ASSERTION(!IsBroadcaster(), "Should not call SendSyncMessage in chrome");

  NS_ASSERTION(!GetParentManager(),

               "Should not have parent manager in content!");

  AUTO_PROFILER_LABEL_DYNAMIC_LOSSY_NSSTRING(

    "nsFrameMessageManager::SendMessage", OTHER, aMessageName);

  if (sSendingSyncMessage && aIsSync) {

    // No kind of blocking send should be issued on top of a sync message.

    aError.Throw(NS_ERROR_UNEXPECTED);

    return;

  }

  StructuredCloneData data;

  if (!aObj.isUndefined() &&

      !GetParamsForMessage(aCx, aObj, JS::UndefinedHandleValue, data)) {

    aError.Throw(NS_ERROR_DOM_DATA_CLONE_ERR);

    return;

  }

#ifdef FUZZING

  if (data.DataLength() > 0) {

    MessageManagerFuzzer::TryMutate(

      aCx,

      aMessageName,

      &data,

      JS::UndefinedHandleValue);

  }

#endif

  if (!AllowMessage(data.DataLength(), aMessageName)) {

    aError.Throw(NS_ERROR_FAILURE);

    return;

  }

  if (!mCallback) {

    aError.Throw(NS_ERROR_NOT_INITIALIZED);

    return;

  }

  nsTArray<StructuredCloneData> retval;

  TimeStamp start = TimeStamp::Now();

  sSendingSyncMessage |= aIsSync;

  bool ok = mCallback->DoSendBlockingMessage(aCx, aMessageName, data, aObjects,

                                             aPrincipal, &retval, aIsSync);

  if (aIsSync) {

    sSendingSyncMessage = false;

  }

  uint32_t latencyMs = round((TimeStamp::Now() - start).ToMilliseconds());

  if (latencyMs >= kMinTelemetrySyncMessageManagerLatencyMs) {

    NS_ConvertUTF16toUTF8 messageName(aMessageName);

    // NOTE: We need to strip digit characters from the message name in order to

    // avoid a large number of buckets due to generated names from addons (such

    // as "ublock:sb:{N}"). See bug 1348113 comment 10.

    messageName.StripTaggedASCII(ASCIIMask::Mask0to9());

    Telemetry::Accumulate(Telemetry::IPC_SYNC_MESSAGE_MANAGER_LATENCY_MS,

                          messageName, latencyMs);

  }

  if (!ok) {

    return;

  }

  uint32_t len = retval.Length();

  aResult.SetCapacity(len);

  for (uint32_t i = 0; i < len; ++i) {

    JS::Rooted<JS::Value> ret(aCx);

    retval[i].Read(aCx, &ret, aError);

    if (aError.Failed()) {

      MOZ_ASSERT(false, "Unable to read structured clone in SendMessage");

      return;

    }

    aResult.AppendElement(ret);

  }

}

nsresult

nsFrameMessageManager::DispatchAsyncMessageInternal(JSContext* aCx,

                                                    const nsAString& aMessage,

                                                    StructuredCloneData& aData,

                                                    JS::Handle<JSObject *> aCpows,

                                                    nsIPrincipal* aPrincipal)

{

  if (mIsBroadcaster) {

    uint32_t len = mChildManagers.Length();

    for (uint32_t i = 0; i < len; ++i) {

      mChildManagers[i]->

         DispatchAsyncMessageInternal(aCx, aMessage, aData, aCpows, aPrincipal);

    }

    return NS_OK;

  }

  if (!mCallback) {

    return NS_ERROR_NOT_INITIALIZED;

  }

  nsresult rv = mCallback->DoSendAsyncMessage(aCx, aMessage, aData, aCpows, aPrincipal);

  if (NS_FAILED(rv)) {

    return rv;

  }

  return NS_OK;

}

void

nsFrameMessageManager::DispatchAsyncMessage(JSContext* aCx,

                                            const nsAString& aMessageName,

                                            JS::Handle<JS::Value> aObj,

                                            JS::Handle<JSObject*> aObjects,

                                            nsIPrincipal* aPrincipal,

                                            JS::Handle<JS::Value> aTransfers,

                                            ErrorResult& aError)

{

  StructuredCloneData data;

  if (!aObj.isUndefined() && !GetParamsForMessage(aCx, aObj, aTransfers, data)) {

    aError.Throw(NS_ERROR_DOM_DATA_CLONE_ERR);

    return;

  }

#ifdef FUZZING

  if (data.DataLength()) {

    MessageManagerFuzzer::TryMutate(aCx, aMessageName, &data, aTransfers);

  }

#endif

  if (!AllowMessage(data.DataLength(), aMessageName)) {

    aError.Throw(NS_ERROR_FAILURE);

    return;

  }

  aError = DispatchAsyncMessageInternal(aCx, aMessageName, data, aObjects,

                                        aPrincipal);

}

class MMListenerRemover

{

public:

  explicit MMListenerRemover(nsFrameMessageManager* aMM)

    : mWasHandlingMessage(aMM->mHandlingMessage)

    , mMM(aMM)

  {

    mMM->mHandlingMessage = true;

  }

  ~MMListenerRemover()

  {

    if (!mWasHandlingMessage) {

      mMM->mHandlingMessage = false;

      if (mMM->mDisconnected) {

        mMM->mListeners.Clear();

      }

    }

  }

  bool mWasHandlingMessage;

  RefPtr<nsFrameMessageManager> mMM;

};

// When recording or replaying, return whether a message should be received in

// the middleman process instead of the recording/replaying process.

static bool

DirectMessageToMiddleman(const nsAString& aMessage)

{

  // Middleman processes run developer tools server code and need to receive

  // debugger related messages. The session store flush message needs to be

  // received in order to cleanly shutdown the process.

  return (StringBeginsWith(aMessage, NS_LITERAL_STRING("debug:")) &&

          recordreplay::parent::DebuggerRunsInMiddleman())

      || aMessage.EqualsLiteral("SessionStore:flush");

}

void

nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,

                                      nsFrameLoader* aTargetFrameLoader,

                                      bool aTargetClosed,

                                      const nsAString& aMessage,

                                      bool aIsSync,

                                      StructuredCloneData* aCloneData,

                                      mozilla::jsipc::CpowHolder* aCpows,

                                      nsIPrincipal* aPrincipal,

                                      nsTArray<StructuredCloneData>* aRetVal,

                                      ErrorResult& aError)

{

  // If we are recording or replaying, we will end up here in both the

  // middleman process and the recording/replaying process. Ignore the message

  // in one of the processes, so that it is only received in one place.

  if (recordreplay::IsRecordingOrReplaying()) {

    if (DirectMessageToMiddleman(aMessage)) {

      return;

    }

  } else if (recordreplay::IsMiddleman()) {

    if (!DirectMessageToMiddleman(aMessage)) {

      return;

    }

  }

  MOZ_ASSERT(aTarget);

  nsAutoTObserverArray<nsMessageListenerInfo, 1>* listeners =

    mListeners.Get(aMessage);

  if (listeners) {

    MMListenerRemover lr(this);

    nsAutoTObserverArray<nsMessageListenerInfo, 1>::EndLimitedIterator

      iter(*listeners);

    while(iter.HasMore()) {

      nsMessageListenerInfo& listener = iter.GetNext();

      // Remove mListeners[i] if it's an expired weak listener.

      nsCOMPtr<nsISupports> weakListener;

      if (listener.mWeakListener) {

        weakListener = do_QueryReferent(listener.mWeakListener);

        if (!weakListener) {

          listeners->RemoveElement(listener);

          continue;

        }

      }

      if (!listener.mListenWhenClosed && aTargetClosed) {

        continue;

      }

      JS::RootingContext* rcx = RootingCx();

      JS::Rooted<JSObject*> object(rcx);

      JS::Rooted<JSObject*> objectGlobal(rcx);

      RefPtr<MessageListener> webIDLListener;

      if (!weakListener) {

        webIDLListener = listener.mStrongListener;

        object = webIDLListener->CallbackOrNull();

        objectGlobal = webIDLListener->CallbackGlobalOrNull();

      } else {

        nsCOMPtr<nsIXPConnectWrappedJS> wrappedJS = do_QueryInterface(weakListener);

        if (!wrappedJS) {

          continue;

        }

        object = wrappedJS->GetJSObject();

        objectGlobal = wrappedJS->GetJSObjectGlobal();

      }

      if (!object) {

        continue;

      }

      AutoEntryScript aes(js::UncheckedUnwrap(object), "message manager handler");

      JSContext* cx = aes.cx();

      // We passed the unwrapped object to AutoEntryScript so we now need to

      // enter the realm of the global object that represents the realm of our

      // callback.

      JSAutoRealm ar(cx, objectGlobal);

      RootedDictionary<ReceiveMessageArgument> argument(cx);

      JS::Rooted<JSObject*> cpows(cx);

      if (aCpows && !aCpows->ToObject(cx, &cpows)) {

        aError.Throw(NS_ERROR_UNEXPECTED);

        return;

      }

      if (!cpows) {

        cpows = JS_NewPlainObject(cx);

        if (!cpows) {

          aError.Throw(NS_ERROR_UNEXPECTED);

          return;

        }

      }

      argument.mObjects = cpows;

      JS::Rooted<JS::Value> json(cx, JS::NullValue());

      if (aCloneData && aCloneData->DataLength()) {

        aCloneData->Read(cx, &json, aError);

        if (NS_WARN_IF(aError.Failed())) {

          aError.SuppressException();

          JS_ClearPendingException(cx);

          return;

        }

      }

      argument.mData = json;

      argument.mJson = json;

      // Get cloned MessagePort from StructuredCloneData.

      if (aCloneData) {

        Sequence<OwningNonNull<MessagePort>> ports;

        if (!aCloneData->TakeTransferredPortsAsSequence(ports)) {

          aError.Throw(NS_ERROR_FAILURE);

          return;

        }

        argument.mPorts.Construct(std::move(ports));

      }

      argument.mName = aMessage;

      argument.mPrincipal = aPrincipal;

      argument.mSync = aIsSync;

      argument.mTarget = aTarget;

      if (aTargetFrameLoader) {

        argument.mTargetFrameLoader.Construct(*aTargetFrameLoader);

      }

      JS::Rooted<JS::Value> thisValue(cx, JS::UndefinedValue());

      if (JS::IsCallable(object)) {

        // A small hack to get 'this' value right on content side where

        // messageManager is wrapped in TabChildMessageManager's global.

        nsCOMPtr<nsISupports> defaultThisValue;

        if (mChrome) {

          defaultThisValue = do_QueryObject(this);

        } else {

          defaultThisValue = aTarget;

        }

        js::AssertSameCompartment(cx, object);

        aError = nsContentUtils::WrapNative(cx, defaultThisValue, &thisValue);

        if (aError.Failed()) {

          return;

        }

      }

      JS::Rooted<JS::Value> rval(cx, JS::UndefinedValue());

      if (webIDLListener) {

        webIDLListener->ReceiveMessage(thisValue, argument, &rval, aError);

        if (aError.Failed()) {

          // At this point the call to ReceiveMessage will have reported any exceptions

          // (we kept the default of eReportExceptions). We suppress the failure in the

          // ErrorResult and continue.

          aError.SuppressException();

          continue;

        }

      } else {

        JS::Rooted<JS::Value> funval(cx);

        if (JS::IsCallable(object)) {

          // If the listener is a JS function:

          funval.setObject(*object);

        } else {

          // If the listener is a JS object which has receiveMessage function:

          if (!JS_GetProperty(cx, object, "receiveMessage", &funval) ||

              !funval.isObject()) {

            aError.Throw(NS_ERROR_UNEXPECTED);

            return;

          }

          // Check if the object is even callable.

          if (!JS::IsCallable(&funval.toObject())) {

            aError.Throw(NS_ERROR_UNEXPECTED);

            return;

          }

          thisValue.setObject(*object);

        }

        JS::Rooted<JS::Value> argv(cx);

        if (!ToJSValue(cx, argument, &argv)) {

          aError.Throw(NS_ERROR_UNEXPECTED);

          return;

        }

        {

          JS::Rooted<JSObject*> thisObject(cx, thisValue.toObjectOrNull());

          js::AssertSameCompartment(cx, thisObject);

          if (!JS_CallFunctionValue(cx, thisObject, funval,

                                    JS::HandleValueArray(argv), &rval)) {

            // Because the AutoEntryScript is inside the loop this continue will make us

            // report any exceptions (after which we'll move on to the next listener).

            continue;

          }

        }

      }

      if (aRetVal) {

        StructuredCloneData* data = aRetVal->AppendElement();

        data->InitScope(JS::StructuredCloneScope::DifferentProcess);

        data->Write(cx, rval, aError);

        if (NS_WARN_IF(aError.Failed())) {

          aRetVal->RemoveLastElement();

          nsString msg = aMessage + NS_LITERAL_STRING(": message reply cannot be cloned. Are you trying to send an XPCOM object?");

          nsCOMPtr<nsIConsoleService> console(do_GetService(NS_CONSOLESERVICE_CONTRACTID));

          if (console) {

            nsCOMPtr<nsIScriptError> error(do_CreateInstance(NS_SCRIPTERROR_CONTRACTID));

            error->Init(msg, EmptyString(), EmptyString(),

                        0, 0, nsIScriptError::warningFlag, "chrome javascript",

                        false /* from private window */);

            console->LogMessage(error);

          }

          JS_ClearPendingException(cx);

          continue;

        }

      }

    }

  }

  RefPtr<nsFrameMessageManager> kungFuDeathGrip = GetParentManager();

  if (kungFuDeathGrip) {

    kungFuDeathGrip->ReceiveMessage(aTarget, aTargetFrameLoader, aTargetClosed, aMessage,

                                    aIsSync, aCloneData, aCpows, aPrincipal, aRetVal,

                                    aError);

  }

}