Auto merge of #23158 - BartGitHub:promise-constructor, r=jdm

Promise constructor

In this PR, measures are taken that prevent the ```Promise::new``` constructor from being used outside a compartment.

---
<!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `___` with appropriate data: -->
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #22982 (GitHub issue number if applicable)

<!-- Either: -->
- [x] These changes do not require tests because no new functionality is added.

<!-- Also, please make sure that "Allow edits from maintainers" checkbox is checked, so that we can help you if you get stuck somewhere along the way.-->

<!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. -->

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/23158)
<!-- Reviewable:end -->

components/script/body.rs

@@ -49,8 +49,9 @@ pub enum FetchedData {
 
 // https://fetch.spec.whatwg.org/#concept-body-consume-body
 #[allow(unrooted_must_root)]
+#[allow(unsafe_code)]
 pub fn consume_body<T: BodyOperations + DomObject>(object: &T, body_type: BodyType) -> Rc<Promise> {
-    let promise = Promise::new(&object.global());
+    let promise = unsafe { Promise::new_in_current_compartment(&object.global()) };
 
     // Step 1
     if object.get_body_used() || object.is_locked() {

components/script/dom/audiocontext.rs

@@ -107,9 +107,10 @@ impl AudioContextMethods for AudioContext {
     }
 
     // https://webaudio.github.io/web-audio-api/#dom-audiocontext-suspend
+    #[allow(unsafe_code)]
     fn Suspend(&self) -> Rc<Promise> {
         // Step 1.
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // Step 2.
         if self.context.control_thread_state() == ProcessingState::Closed {
@@ -168,9 +169,10 @@ impl AudioContextMethods for AudioContext {
     }
 
     // https://webaudio.github.io/web-audio-api/#dom-audiocontext-close
+    #[allow(unsafe_code)]
     fn Close(&self) -> Rc<Promise> {
         // Step 1.
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // Step 2.
         if self.context.control_thread_state() == ProcessingState::Closed {

components/script/dom/baseaudiocontext.rs

@@ -273,9 +273,10 @@ impl BaseAudioContextMethods for BaseAudioContext {
     }
 
     /// https://webaudio.github.io/web-audio-api/#dom-baseaudiocontext-resume
+    #[allow(unsafe_code)]
     fn Resume(&self) -> Rc<Promise> {
         // Step 1.
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // Step 2.
         if self.audio_context_impl.state() == ProcessingState::Closed {
@@ -405,6 +406,7 @@ impl BaseAudioContextMethods for BaseAudioContext {
     }
 
     // https://webaudio.github.io/web-audio-api/#dom-baseaudiocontext-decodeaudiodata
+    #[allow(unsafe_code)]
     fn DecodeAudioData(
         &self,
         audio_data: CustomAutoRooterGuard<ArrayBuffer>,
@@ -412,7 +414,7 @@ impl BaseAudioContextMethods for BaseAudioContext {
         decode_error_callback: Option<Rc<DecodeErrorCallback>>,
     ) -> Rc<Promise> {
         // Step 1.
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let global = self.global();
         let window = global.as_window();
 

components/script/dom/bluetooth.rs

@@ -278,6 +278,7 @@ pub fn response_async<T: AsyncBluetoothListener + DomObject + 'static>(
 }
 
 // https://webbluetoothcg.github.io/web-bluetooth/#getgattchildren
+#[allow(unsafe_code)]
 pub fn get_gatt_children<T, F>(
     attribute: &T,
     single: bool,
@@ -291,7 +292,7 @@ where
     T: AsyncBluetoothListener + DomObject + 'static,
     F: FnOnce(StringOrUnsignedLong) -> Fallible<UUID>,
 {
-    let p = Promise::new(&attribute.global());
+    let p = unsafe { Promise::new_in_current_compartment(&attribute.global()) };
 
     let result_uuid = if let Some(u) = uuid {
         // Step 1.
@@ -530,8 +531,9 @@ impl From<BluetoothError> for Error {
 
 impl BluetoothMethods for Bluetooth {
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetooth-requestdevice
+    #[allow(unsafe_code)]
     fn RequestDevice(&self, option: &RequestDeviceOptions) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         // Step 1.
         if (option.filters.is_some() && option.acceptAllDevices) ||
             (option.filters.is_none() && !option.acceptAllDevices)
@@ -548,8 +550,9 @@ impl BluetoothMethods for Bluetooth {
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetooth-getavailability
+    #[allow(unsafe_code)]
     fn GetAvailability(&self) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         // Step 1. We did not override the method
         // Step 2 - 3. in handle_response
         let sender = response_async(&p, self);

components/script/dom/bluetoothdevice.rs

@@ -277,8 +277,9 @@ impl BluetoothDeviceMethods for BluetoothDevice {
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetoothdevice-watchadvertisements
+    #[allow(unsafe_code)]
     fn WatchAdvertisements(&self) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let sender = response_async(&p, self);
         // TODO: Step 1.
         // Note: Steps 2 - 3 are implemented in components/bluetooth/lib.rs in watch_advertisements function

components/script/dom/bluetoothremotegattcharacteristic.rs

@@ -134,8 +134,9 @@ impl BluetoothRemoteGATTCharacteristicMethods for BluetoothRemoteGATTCharacteris
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetoothremotegattcharacteristic-readvalue
+    #[allow(unsafe_code)]
     fn ReadValue(&self) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // Step 1.
         if uuid_is_blocklisted(self.uuid.as_ref(), Blocklist::Reads) {
@@ -167,8 +168,9 @@ impl BluetoothRemoteGATTCharacteristicMethods for BluetoothRemoteGATTCharacteris
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetoothremotegattcharacteristic-writevalue
+    #[allow(unsafe_code)]
     fn WriteValue(&self, value: ArrayBufferViewOrArrayBuffer) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // Step 1.
         if uuid_is_blocklisted(self.uuid.as_ref(), Blocklist::Writes) {
@@ -218,8 +220,9 @@ impl BluetoothRemoteGATTCharacteristicMethods for BluetoothRemoteGATTCharacteris
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetoothremotegattcharacteristic-startnotifications
+    #[allow(unsafe_code)]
     fn StartNotifications(&self) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // Step 1.
         if uuid_is_blocklisted(self.uuid.as_ref(), Blocklist::Reads) {
@@ -255,8 +258,9 @@ impl BluetoothRemoteGATTCharacteristicMethods for BluetoothRemoteGATTCharacteris
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetoothremotegattcharacteristic-stopnotifications
+    #[allow(unsafe_code)]
     fn StopNotifications(&self) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let sender = response_async(&p, self);
 
         // TODO: Step 3 - 4: Implement `active notification context set` for BluetoothRemoteGATTCharacteristic,

components/script/dom/bluetoothremotegattdescriptor.rs

@@ -93,8 +93,9 @@ impl BluetoothRemoteGATTDescriptorMethods for BluetoothRemoteGATTDescriptor {
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetoothremotegattdescriptor-readvalue
+    #[allow(unsafe_code)]
     fn ReadValue(&self) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // Step 1.
         if uuid_is_blocklisted(self.uuid.as_ref(), Blocklist::Reads) {
@@ -125,8 +126,9 @@ impl BluetoothRemoteGATTDescriptorMethods for BluetoothRemoteGATTDescriptor {
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetoothremotegattdescriptor-writevalue
+    #[allow(unsafe_code)]
     fn WriteValue(&self, value: ArrayBufferViewOrArrayBuffer) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // Step 1.
         if uuid_is_blocklisted(self.uuid.as_ref(), Blocklist::Writes) {

components/script/dom/bluetoothremotegattserver.rs

@@ -69,9 +69,10 @@ impl BluetoothRemoteGATTServerMethods for BluetoothRemoteGATTServer {
     }
 
     // https://webbluetoothcg.github.io/web-bluetooth/#dom-bluetoothremotegattserver-connect
+    #[allow(unsafe_code)]
     fn Connect(&self) -> Rc<Promise> {
         // Step 1.
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let sender = response_async(&p, self);
 
         // TODO: Step 3: Check if the UA is currently using the Bluetooth system.

components/script/dom/customelementregistry.rs

@@ -399,20 +399,21 @@ impl CustomElementRegistryMethods for CustomElementRegistry {
     }
 
     /// <https://html.spec.whatwg.org/multipage/#dom-customelementregistry-whendefined>
+    #[allow(unsafe_code)]
     fn WhenDefined(&self, name: DOMString) -> Rc<Promise> {
         let global_scope = self.window.upcast::<GlobalScope>();
         let name = LocalName::from(&*name);
 
         // Step 1
         if !is_valid_custom_element_name(&name) {
-            let promise = Promise::new(global_scope);
+            let promise = unsafe { Promise::new_in_current_compartment(global_scope) };
             promise.reject_native(&DOMException::new(global_scope, DOMErrorName::SyntaxError));
             return promise;
         }
 
         // Step 2
         if self.definitions.borrow().contains_key(&name) {
-            let promise = Promise::new(global_scope);
+            let promise = unsafe { Promise::new_in_current_compartment(global_scope) };
             promise.resolve_native(&UndefinedValue());
             return promise;
         }
@@ -422,7 +423,7 @@ impl CustomElementRegistryMethods for CustomElementRegistry {
 
         // Steps 4, 5
         let promise = map.get(&name).cloned().unwrap_or_else(|| {
-            let promise = Promise::new(global_scope);
+            let promise = unsafe { Promise::new_in_current_compartment(global_scope) };
             map.insert(name, promise.clone());
             promise
         });

components/script/dom/document.rs

@@ -3129,9 +3129,10 @@ impl Document {
     }
 
     // https://fullscreen.spec.whatwg.org/#dom-element-requestfullscreen
+    #[allow(unsafe_code)]
     pub fn enter_fullscreen(&self, pending: &Element) -> Rc<Promise> {
         // Step 1
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let mut error = false;
 
         // Step 4
@@ -3195,10 +3196,11 @@ impl Document {
     }
 
     // https://fullscreen.spec.whatwg.org/#exit-fullscreen
+    #[allow(unsafe_code)]
     pub fn exit_fullscreen(&self) -> Rc<Promise> {
         let global = self.global();
         // Step 1
-        let promise = Promise::new(&global);
+        let promise = unsafe { Promise::new_in_current_compartment(&global) };
         // Step 2
         if self.fullscreen_element.get().is_none() {
             promise.reject_error(Error::Type(String::from("fullscreen is null")));

components/script/dom/htmlmediaelement.rs

@@ -1651,8 +1651,9 @@ impl HTMLMediaElementMethods for HTMLMediaElement {
     }
 
     // https://html.spec.whatwg.org/multipage/#dom-media-play
+    #[allow(unsafe_code)]
     fn Play(&self) -> Rc<Promise> {
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
         // Step 1.
         // FIXME(nox): Reject promise if not allowed to play.
 

components/script/dom/mediadevices.rs

@@ -44,8 +44,9 @@ impl MediaDevices {
 
 impl MediaDevicesMethods for MediaDevices {
     /// https://w3c.github.io/mediacapture-main/#dom-mediadevices-getusermedia
+    #[allow(unsafe_code)]
     fn GetUserMedia(&self, constraints: &MediaStreamConstraints) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let media = ServoMedia::get().unwrap();
         let mut tracks = vec![];
         if let Some(constraints) = convert_constraints(&constraints.audio) {

components/script/dom/navigationpreloadmanager.rs

@@ -43,8 +43,9 @@ impl NavigationPreloadManager {
 
 impl NavigationPreloadManagerMethods for NavigationPreloadManager {
     // https://w3c.github.io/ServiceWorker/#navigation-preload-manager-enable
+    #[allow(unsafe_code)]
     fn Enable(&self) -> Rc<Promise> {
-        let promise = Promise::new(&*self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&*self.global()) };
 
         // 2.
         if self.serviceworker_registration.active().is_none() {
@@ -65,8 +66,9 @@ impl NavigationPreloadManagerMethods for NavigationPreloadManager {
     }
 
     // https://w3c.github.io/ServiceWorker/#navigation-preload-manager-disable
+    #[allow(unsafe_code)]
     fn Disable(&self) -> Rc<Promise> {
-        let promise = Promise::new(&*self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&*self.global()) };
 
         // 2.
         if self.serviceworker_registration.active().is_none() {
@@ -87,8 +89,9 @@ impl NavigationPreloadManagerMethods for NavigationPreloadManager {
     }
 
     // https://w3c.github.io/ServiceWorker/#navigation-preload-manager-setheadervalue
+    #[allow(unsafe_code)]
     fn SetHeaderValue(&self, value: ByteString) -> Rc<Promise> {
-        let promise = Promise::new(&*self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&*self.global()) };
 
         // 2.
         if self.serviceworker_registration.active().is_none() {
@@ -109,8 +112,9 @@ impl NavigationPreloadManagerMethods for NavigationPreloadManager {
     }
 
     // https://w3c.github.io/ServiceWorker/#navigation-preload-manager-getstate
+    #[allow(unsafe_code)]
     fn GetState(&self) -> Rc<Promise> {
-        let promise = Promise::new(&*self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&*self.global()) };
         // 2.
         let mut state = NavigationPreloadState::empty();
 

components/script/dom/navigator.rs

@@ -150,8 +150,9 @@ impl NavigatorMethods for Navigator {
     }
 
     // https://w3c.github.io/webvr/spec/1.1/#navigator-getvrdisplays-attribute
+    #[allow(unsafe_code)]
     fn GetVRDisplays(&self) -> Rc<Promise> {
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let displays = self.Xr().get_displays();
         match displays {
             Ok(displays) => promise.resolve_native(&displays),

components/script/dom/offlineaudiocontext.rs

@@ -113,8 +113,9 @@ impl OfflineAudioContextMethods for OfflineAudioContext {
     }
 
     // https://webaudio.github.io/web-audio-api/#dom-offlineaudiocontext-startrendering
+    #[allow(unsafe_code)]
     fn StartRendering(&self) -> Rc<Promise> {
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
         if self.rendering_started.get() {
             promise.reject_error(Error::InvalidState);
             return promise;

components/script/dom/permissions.rs

@@ -87,6 +87,7 @@ impl Permissions {
     // https://w3c.github.io/permissions/#dom-permissions-query
     // https://w3c.github.io/permissions/#dom-permissions-request
     // https://w3c.github.io/permissions/#dom-permissions-revoke
+    #[allow(unsafe_code)]
     fn manipulate(
         &self,
         op: Operation,
@@ -97,7 +98,7 @@ impl Permissions {
         // (Query, Request) Step 3.
         let p = match promise {
             Some(promise) => promise,
-            None => Promise::new(&self.global()),
+            None => unsafe { Promise::new_in_current_compartment(&self.global()) },
         };
 
         // (Query, Request, Revoke) Step 1.

components/script/dom/promise.rs

@@ -80,14 +80,17 @@ impl Drop for Promise {
 
 impl Promise {
     #[allow(unsafe_code)]
-    pub fn new(global: &GlobalScope) -> Rc<Promise> {
+    pub fn new(global: &GlobalScope, _comp: &JSAutoCompartment) -> Rc<Promise> {
+        unsafe { Promise::new_in_current_compartment(global) }
+    }
+
+    #[allow(unsafe_code)]
+    pub unsafe fn new_in_current_compartment(global: &GlobalScope) -> Rc<Promise> {
         let cx = global.get_cx();
         rooted!(in(cx) let mut obj = ptr::null_mut::<JSObject>());
-        unsafe {
         Promise::create_js_promise(cx, HandleObject::null(), obj.handle_mut());
         Promise::new_with_js_promise(obj.handle(), cx)
     }
-    }
 
     #[allow(unsafe_code)]
     pub fn duplicate(&self) -> Rc<Promise> {

components/script/dom/rtcpeerconnection.rs

@@ -429,8 +429,9 @@ impl RTCPeerConnectionMethods for RTCPeerConnection {
     );
 
     /// https://w3c.github.io/webrtc-pc/#dom-rtcpeerconnection-addicecandidate
+    #[allow(unsafe_code)]
     fn AddIceCandidate(&self, candidate: &RTCIceCandidateInit) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         if candidate.sdpMid.is_none() && candidate.sdpMLineIndex.is_none() {
             p.reject_error(Error::Type(format!(
                 "one of sdpMid and sdpMLineIndex must be set"
@@ -464,8 +465,9 @@ impl RTCPeerConnectionMethods for RTCPeerConnection {
     }
 
     /// https://w3c.github.io/webrtc-pc/#dom-rtcpeerconnection-createoffer
+    #[allow(unsafe_code)]
     fn CreateOffer(&self, _options: &RTCOfferOptions) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         if self.closed.get() {
             p.reject_error(Error::InvalidState);
             return p;
@@ -476,8 +478,9 @@ impl RTCPeerConnectionMethods for RTCPeerConnection {
     }
 
     /// https://w3c.github.io/webrtc-pc/#dom-rtcpeerconnection-createoffer
+    #[allow(unsafe_code)]
     fn CreateAnswer(&self, _options: &RTCAnswerOptions) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         if self.closed.get() {
             p.reject_error(Error::InvalidState);
             return p;
@@ -498,9 +501,10 @@ impl RTCPeerConnectionMethods for RTCPeerConnection {
     }
 
     /// https://w3c.github.io/webrtc-pc/#dom-rtcpeerconnection-setlocaldescription
+    #[allow(unsafe_code)]
     fn SetLocalDescription(&self, desc: &RTCSessionDescriptionInit) -> Rc<Promise> {
         // XXXManishearth validate the current state
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let this = Trusted::new(self);
         let desc: SessionDescription = desc.into();
         let trusted_promise = TrustedPromise::new(p.clone());
@@ -531,9 +535,10 @@ impl RTCPeerConnectionMethods for RTCPeerConnection {
     }
 
     /// https://w3c.github.io/webrtc-pc/#dom-rtcpeerconnection-setremotedescription
+    #[allow(unsafe_code)]
     fn SetRemoteDescription(&self, desc: &RTCSessionDescriptionInit) -> Rc<Promise> {
         // XXXManishearth validate the current state
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         let this = Trusted::new(self);
         let desc: SessionDescription = desc.into();
         let trusted_promise = TrustedPromise::new(p.clone());

components/script/dom/serviceworkercontainer.rs

@@ -54,9 +54,10 @@ impl ServiceWorkerContainerMethods for ServiceWorkerContainer {
     #[allow(unrooted_must_root)] // Job is unrooted
     /// https://w3c.github.io/ServiceWorker/#service-worker-container-register-method and - A
     /// https://w3c.github.io/ServiceWorker/#start-register-algorithm - B
+    #[allow(unsafe_code)]
     fn Register(&self, script_url: USVString, options: &RegistrationOptions) -> Rc<Promise> {
         // A: Step 1
-        let promise = Promise::new(&*self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&*self.global()) };
         let USVString(ref script_url) = script_url;
         let api_base_url = self.global().api_base_url();
         // A: Step 3-5

components/script/dom/testbinding.rs

@@ -1009,6 +1009,7 @@ impl TestBindingMethods for TestBinding {
         );
     }
 
+    #[allow(unsafe_code)]
     fn PromiseNativeHandler(
         &self,
         resolve: Option<Rc<SimpleCallback>>,
@@ -1020,7 +1021,7 @@ impl TestBindingMethods for TestBinding {
             resolve.map(SimpleHandler::new),
             reject.map(SimpleHandler::new),
         );
-        let p = Promise::new(&global);
+        let p = unsafe { Promise::new_in_current_compartment(&global) };
         p.append_native_handler(&handler);
         return p;
 
@@ -1043,8 +1044,9 @@ impl TestBindingMethods for TestBinding {
         }
     }
 
+    #[allow(unsafe_code)]
     fn PromiseAttribute(&self) -> Rc<Promise> {
-        Promise::new(&self.global())
+        unsafe { Promise::new_in_current_compartment(&self.global()) }
     }
 
     fn AcceptPromise(&self, _promise: &Promise) {}

components/script/dom/vrdisplay.rs

@@ -341,8 +341,9 @@ impl VRDisplayMethods for VRDisplay {
     }
 
     // https://w3c.github.io/webvr/#dom-vrdisplay-requestpresent
+    #[allow(unsafe_code)]
     fn RequestPresent(&self, layers: Vec<VRLayer>) -> Rc<Promise> {
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
         // TODO: WebVR spec: this method must be called in response to a user gesture
 
         // WebVR spec: If canPresent is false the promise MUST be rejected
@@ -405,8 +406,9 @@ impl VRDisplayMethods for VRDisplay {
     }
 
     // https://w3c.github.io/webvr/#dom-vrdisplay-exitpresent
+    #[allow(unsafe_code)]
     fn ExitPresent(&self) -> Rc<Promise> {
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // WebVR spec: If the VRDisplay is not presenting the promise MUST be rejected.
         if !self.presenting.get() {

components/script/dom/worklet.rs

@@ -110,9 +110,10 @@ impl Worklet {
 
 impl WorkletMethods for Worklet {
     /// <https://drafts.css-houdini.org/worklets/#dom-worklet-addmodule>
+    #[allow(unsafe_code)]
     fn AddModule(&self, module_url: USVString, options: &WorkletOptions) -> Rc<Promise> {
         // Step 1.
-        let promise = Promise::new(self.window.upcast());
+        let promise = unsafe { Promise::new_in_current_compartment(self.window.upcast()) };
 
         // Step 3.
         let module_url_record = match self.window.Document().base_url().join(&module_url.0) {

components/script/dom/xr.rs

@@ -83,9 +83,10 @@ impl Drop for XR {
 
 impl XRMethods for XR {
     /// https://immersive-web.github.io/webxr/#dom-xr-supportssessionmode
+    #[allow(unsafe_code)]
     fn SupportsSessionMode(&self, mode: XRSessionMode) -> Rc<Promise> {
         // XXXManishearth this should select an XR device first
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
         if mode == XRSessionMode::Immersive_vr {
             promise.resolve_native(&());
         } else {
@@ -97,8 +98,9 @@ impl XRMethods for XR {
     }
 
     /// https://immersive-web.github.io/webxr/#dom-xr-requestsession
+    #[allow(unsafe_code)]
     fn RequestSession(&self, options: &XRSessionCreationOptions) -> Rc<Promise> {
-        let promise = Promise::new(&self.global());
+        let promise = unsafe { Promise::new_in_current_compartment(&self.global()) };
         if options.mode != XRSessionMode::Immersive_vr {
             promise.reject_error(Error::NotSupported);
             return promise;

components/script/dom/xrsession.rs

@@ -89,8 +89,9 @@ impl XRSessionMethods for XRSession {
     }
 
     /// https://immersive-web.github.io/webxr/#dom-xrsession-requestanimationframe
+    #[allow(unsafe_code)]
     fn UpdateRenderState(&self, init: &XRRenderStateInit) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
         self.display.queue_renderstate(init, p.clone());
         p
     }
@@ -111,8 +112,9 @@ impl XRSessionMethods for XRSession {
     }
 
     /// https://immersive-web.github.io/webxr/#dom-xrsession-requestreferencespace
+    #[allow(unsafe_code)]
     fn RequestReferenceSpace(&self, options: &XRReferenceSpaceOptions) -> Rc<Promise> {
-        let p = Promise::new(&self.global());
+        let p = unsafe { Promise::new_in_current_compartment(&self.global()) };
 
         // https://immersive-web.github.io/webxr/#create-a-reference-space
 

components/script/fetch.rs

@@ -127,6 +127,7 @@ fn request_init_from_request(request: NetTraitsRequest) -> NetTraitsRequestInit
 
 // https://fetch.spec.whatwg.org/#fetch-method
 #[allow(unrooted_must_root)]
+#[allow(unsafe_code)]
 pub fn Fetch(
     global: &GlobalScope,
     input: RequestInfo,
@@ -135,7 +136,7 @@ pub fn Fetch(
     let core_resource_thread = global.core_resource_thread();
 
     // Step 1
-    let promise = Promise::new(global);
+    let promise = unsafe { Promise::new_in_current_compartment(global) };
     let response = Response::new(global);
 
     // Step 2