Bug 40232 – postMessage(window) throws "Type error" with input elements other than text fields

• Component: New Bugs
• Status: RESOLVED DUPLICATE

[Kim Grönholm]

Created attachment 58021 [details]
Backtrace of postMessage(window) throwing a type error

postMessage(window) should throw TypeError: "Cannot post cyclic structures."
like it (normally) does in LayoutTests/fast/dom/Window/window-postmessage-clone.html.
However, in case the TreeWalker traverses through an input element other than
text field before it notices the cyclic structure, it throws TypeError: "Type 
error".

This issue was revealed when adding a new attribute to Element.idl which
caused the hash lookup to traverse through the objects/properties in different
order in LayoutTests/fast/dom/Window/window-postmessage-clone.html. The issue can
also be seen by slightly modifying the test page by e.g. adding a dummy input
element on top of the test page with type "button" or "file" (I'll attach a
test case for this)

The reason why this happens is that when the TreeWalkers in WebCore/bindings/
js/SerializedScriptValue.cpp walk through the objects and their properties,
the getProperty function ends up querying the JSHTMLInputElement::selectionStart
or JSHTMLInputElement::selectionEnd properties whose getters throw the type
error in case the input element is not of type "TextField" (!input->canHaveSelection())

See the example backtrace for further clarification.

[Kim Grönholm]

Created attachment 58022 [details]
LayoutTests/fast/dom/Window/window-postmessage-clone with additional input element

Added a test case that is otherwise identical to 
LayoutTests/fast/dom/Window/window-postmessage-clone.html except one
dummy input (type="button") element that is added on top of the page.

This dummy input element makes the postMessage(window) test fail
prompting:
PASS: 'postMessage(window)' threw TypeError: Type error

when the expected output would be:
PASS: 'postMessage(window)' threw TypeError: Cannot post cyclic structures.

Removing the dummy button results in the expected output.

[Kim Grönholm]

The actual issue is that postMessage should serialise dom objects to null by default and it is being tracked in https://bugs.webkit.org/show_bug.cgi?id=40329

*** This bug has been marked as a duplicate of bug 40329 ***