Bug 11884 - FunctionProtoFunc::callAsFunction uses the wrong global object as 'this' in the apply case
Summary: FunctionProtoFunc::callAsFunction uses the wrong global object as 'this' in t...
Status: RESOLVED DUPLICATE of bug 64250
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 420+
Hardware: Macintosh OS X 10.4
: P2 Normal
Assignee: Nobody
Keywords: InRadar
Depends on:
Reported: 2006-12-19 16:05 PST by Geoffrey Garen
Modified: 2011-12-25 15:49 PST (History)
6 users (show)

See Also:

reduction (280 bytes, text/html)
2006-12-19 16:06 PST, Geoffrey Garen
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Geoffrey Garen 2006-12-19 16:05:19 PST
See attached test case.
Comment 1 Geoffrey Garen 2006-12-19 16:06:12 PST
Created attachment 11925 [details]
Comment 2 Geoffrey Garen 2006-12-19 16:06:46 PST
We should probably analyze what we use for the global object in other cases, as well.
Comment 3 Geoffrey Garen 2006-12-19 16:09:25 PST
You have to open the reduction locally, to avoid a JavaScript security exception. See bug 11885.
Comment 4 Alexey Proskuryakov 2006-12-19 21:22:23 PST
Is this the same as bug 7831?
Comment 5 Geoffrey Garen 2006-12-20 00:48:47 PST
I think bug 7831 is specifically about eval.apply, and not about apply in general, or multiple global objects. It's possible that fixing one may fix the other, though.
Comment 6 David Kilzer (:ddkilzer) 2008-02-20 06:33:31 PST
Comment 7 Oliver Hunt 2008-06-28 03:47:29 PDT
Sam, this page succeeds in ffx3, but fails with a security check failure in ToT
Comment 8 Sam Weinig 2008-06-28 09:01:56 PDT
We have different rules than Firefox regarding data: urls (we are much more strict).  It doesn't seem like that is what this test is really testing though.  To do the real test, just put the content from the data: url into its own file.

Comment 9 Gavin Barraclough 2011-12-25 15:49:26 PST

*** This bug has been marked as a duplicate of bug 64250 ***