231506 2021-10-11 03:10:02 -0700 Investigate `JSGlobalObject == JSDOMGlobalObject` WebCore assumption in presence of Shadow Realms 2022-02-16 13:57:44 -0800 1 1 1 Unclassified WebKit WebCore JavaScript WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 230602 1 pmates webkit-unassigned joseph.j.griego webkit-bug-importer ysuzuki oldest_to_newest 1802563 0 pmates 2021-10-11 03:10:02 -0700 A lot of WebCore code assumes that JSGlobalObject instances are the JSDOMGlobalObject subclass. For example, when `incumbentDOMWindow` is traversing JSGlobalObjects in the callstack, and it assumes that these ones are JSDOMWindow. After introducing Shadow Realms, via https://bugs.webkit.org/show_bug.cgi?id=230602, this won't necessarily be true. That is WebCore's assumption that `JSGlobalObject == JSDOMGlobalObject` might no longer be valid. This ticket a is a reminder that we need to investigate this and properly adapt the code if needed 1805506 1 webkit-bug-importer 2021-10-18 03:10:17 -0700 <rdar://problem/84363152> 1808479 2 pmates 2021-10-25 10:54:00 -0700 Yusuke, you raised this initially. Looking at `incumbentDOMWindow`, it doesn't seem to be used in api contexts that the shadow realm has access to. For example, in the derived JSDOMWindow.cpp, `incumbentDOMWindow` is used for `postMessage`, `closeBody`, `focusBody`, etc, which won't be exposed to the shadow realm global object. Can you think of other areas we need to look out for, or perhaps this assumption isn't an issue? 1808508 3 ysuzuki 2021-10-25 12:02:25 -0700 (In reply to Phillip Mates from comment #2) > Yusuke, you raised this initially. Looking at `incumbentDOMWindow`, it > doesn't seem to be used in api contexts that the shadow realm has access to. > For example, in the derived JSDOMWindow.cpp, `incumbentDOMWindow` is used > for `postMessage`, `closeBody`, `focusBody`, etc, which won't be exposed to > the shadow realm global object. > > Can you think of other areas we need to look out for, or perhaps this > assumption isn't an issue? What happens if you pass these functions to ShadowRealm and calling it inside ShadowRealm's user function? 1842514 4 joseph.j.griego 2022-02-16 13:57:44 -0800 As mentioned on Slack (https://webkit.slack.com/archives/CTV4FGWF4/p1644353301940789) I think we are pretty comfortable not worrying about this, by the usual design of shadow realms, since when we call into parts of the runtime expecting a JSDOMObject on the stack, we will have the incubating realm's global object installed there because of the existing function wrapping; I'm gonna leave this open, for now, though; since this does change when we install web APIs into the shadow realm context.