Burning Chrome

Events get double-wrapped when going into chrome...

You could cheat, possibly. For example, send an "attr modified" mutation event with your string in the attr value....

Or you could try looking at the event's wrappedJSObject in your chrome listener and see whether that helps.

But keep in mind what I said about security holes the first time around. Getting a property off a content object in chrome is generally exploitable.

I worked around this problem by creating a custom DOM node that is the origin of the event (linked with evt.target) and putting the data into attributes. Not really nice, but it works... See http://forums.mozillazine.org/viewtopic.php?p=1005555#1005555

Umm, in your last post, jensb linked to his forum post where he creates a DOM element, sets attributes on it, and uses that as the event target... Would that work? :) (Since getAttribute is part of the nsIDOMElement IDL, it should work...)

That's still limited to strings, of course. If you actually have arbitary JS objects, you need to actually describe them :)

They're no longer available because your message had to cross over XPConnect (or rather you had to access it via an XPConnect wrapper) and your properties weren't mentioned in any of the xpt files for the interfaces your object implemented. All you have to do though is to create and implement an interface that has atributes for the data you want to send or implement something generic like nsIProperties.

I'm not sure if it's even desirable to be able to send arbitrary message from the content sandbox to the high-privilege chrome code - it paves the way for some dangerous code to infect the client computer. TJavaScript is prototype-based, which makes it even harder to handle the problem securely.

(From Alex: I'm talking about sending string values, for which there must be code in the chrome to receive them. That code would be suicidal not to check the inputs it receives -- and I'm not quite that stupid. :-)

I'm currently thinking of implementing a JS-based XPCOM component which would be available to content as sidebar is, and use the nsIObserverService to forward the message through.)

I'm working on something similar and I would like to know if there's an elegant solution. The somewhat ugly solution I found to work is the following:
* The page holds a static object, called A
* The static object is added as an attribute of a DOM element, say a div with id "B". So B.foo = A
* When the page finishes loading, the chrome gets the object using the DOM: c = getElementById("B").foo
* The chrome also adds a custom event listener to B, or whatever object should capture the event
* The event you want to capture triggers a function on the page, which sets some attributes in A and then dispatches the custom event, without setting anything on the event itself
* The chrome captures the event and can get the message by querying "c"

I know, it's not pretty, but it works and it's relatively simple. Any thoughts?