Bug 1744352 - Part 1: Ensure we set InitialSandboxFlags when opening or replacing toplevel BrowsingContexts, r=mccr8 a=RyanVM

Differential Revision: https://phabricator.services.mozilla.com/D139430

Author: Olli Pettay

Diff for: docshell/base/BrowsingContext.h

@@ -123,6 +123,8 @@ enum class ExplicitActiveStatus : uint8_t {
   FIELD(Muted, bool)                                                          \
   /* See nsSandboxFlags.h for the possible flags. */                          \
   FIELD(SandboxFlags, uint32_t)                                               \
+  /* The value of SandboxFlags when the BrowsingContext is first created.     \
+   * Used for sandboxing the initial about:blank document. */                 \
   FIELD(InitialSandboxFlags, uint32_t)                                        \
   /* A non-zero unique identifier for the browser element that is hosting     \
    * this                                                                     \

Diff for: docshell/base/CanonicalBrowsingContext.cpp

@@ -301,6 +301,11 @@ void CanonicalBrowsingContext::ReplacedBy(
   txn.SetHistoryID(GetHistoryID());
   txn.SetExplicitActive(GetExplicitActive());
   txn.SetHasRestoreData(GetHasRestoreData());
+  // As this is a different BrowsingContext, set InitialSandboxFlags to the
+  // current flags in the new context so that they also apply to any initial
+  // about:blank documents created in it.
+  txn.SetSandboxFlags(GetSandboxFlags());
+  txn.SetInitialSandboxFlags(GetSandboxFlags());
   if (aNewContext->EverAttached()) {
     MOZ_ALWAYS_SUCCEEDS(txn.Commit(aNewContext));
   } else {

Diff for: toolkit/components/windowwatcher/nsWindowWatcher.cpp

@@ -1021,6 +1021,8 @@ nsresult nsWindowWatcher::OpenWindowInternal(
       SANDBOX_PROPAGATES_TO_AUXILIARY_BROWSING_CONTEXTS) {
     MOZ_ASSERT(windowIsNew, "Should only get here for new windows");
     MOZ_ALWAYS_SUCCEEDS(newBC->SetSandboxFlags(activeDocsSandboxFlags));
+    MOZ_ALWAYS_SUCCEEDS(
+        newBC->SetInitialSandboxFlags(newBC->GetSandboxFlags()));
   }
 
   RefPtr<nsGlobalWindowOuter> win(