Bug 11399 – window.eval runs in the global scope of the calling window

• Component: WebCore JavaScript
• Status: RESOLVED FIXED

If you call the following code in a window loaded inside an IFRAME:

    window.parent.eval( 'var MyObject = new Object();' )

... "MyObject" is created at the "window" global scope, not at "window.parent".

The URL points to a simple test case. It works well with IE, Firefox and Opera.

Any temporary workaround to evaluate a script in a specific window is welcome.

[Mark Rowe (bdash)]

Confirmed in 418.9 and ToT.

[Alexey Proskuryakov]

(In reply to comment #0)
> Any temporary workaround to evaluate a script in a specific window is welcome.

Will document.write()'ing it there work?

May be related to bugs 3791, 7783.

document.write will not work because the parent document has already been loaded. So, when calling document.write, the document will be cleared and a new stream will be opened.

[Mark Rowe (bdash)]

A workaround that will work is to insert a script element via DOM manipulation.  See <http://bdash.net.nz/files/bug-11399-1.html> for an example of a document in an iframe evaluating a script in the context of its parent document.

Nice move Mark... your workaround worked like a charm. I was too concentrated on making eval working.

I'll be committing the changes I've made on FCKeditor today, so the next nightly (of FCKeditor) will finally load in Safari (420+) (See bug #9915). It will not work properly, but at least will load. Now we can continue debugging further.

Thanks for it.

[Mark Rowe (bdash)]

<rdar://problem/4928617>

[Geoffrey Garen]

Created attachment 14669 [details]
test case for eval scope

Firefox, IE, Opera, and Safari all disagree about this.

IE has no eval method in inner windows.

Firefox uses the inner window as the front of the scope chain, the variable object, but not 'this'.

Opera uses the inner window as the front of the scope chain, the variable object, and 'this'.

Safari uses the outer window as the front of the scope chain and 'this', and a separate object that is not the inner window as the variable object.

[David Kilzer (:ddkilzer)]

See also: http://bugs.webkit.org/show_bug.cgi?id=12912#c6

[Antti Koivisto]

Fixed along with <rdar://problem/5445058>

Sending        JavaScriptCore/ChangeLog
Sending        JavaScriptCore/kjs/function.cpp
Sending        LayoutTests/ChangeLog
Sending        LayoutTests/fast/js/window-eval-context-expected.txt
Sending        LayoutTests/fast/js/window-eval-context.html
Transmitting file data .....
Committed revision 25535.

[Timothy Hatcher]

Removed the wworkaround we hand in the Inspector in r31683.