Window should have its 'constructor' property on the prototype as per:
Similarly to other interfaces. This matches the behavior of Firefox and Chrome also.
Our bindings generator currently puts this attribute on the instance because Window has the [CheckSecurity] IDL extended attribute. However, security-wise, moving 'constructor' to the prototype should be safe considering that it is not possible to access a Window's prototype cross-origin.
We just need to make sure that accessing crossOriginWindow.constructor still fails due to security checks.
Created attachment 271527 [details]
Comment on attachment 271527 [details]
Clearing flags on attachment: 271527
Committed r196690: <http://trac.webkit.org/changeset/196690>
All reviewed patches have been landed. Closing bug.