Window should have its 'constructor' property on the prototype as per: http://heycam.github.io/webidl/#interface-prototype-object Similarly to other interfaces. This matches the behavior of Firefox and Chrome also. Our bindings generator currently puts this attribute on the instance because Window has the [CheckSecurity] IDL extended attribute. However, security-wise, moving 'constructor' to the prototype should be safe considering that it is not possible to access a Window's prototype cross-origin.
We just need to make sure that accessing crossOriginWindow.constructor still fails due to security checks.
<rdar://problem/24689078>
Created attachment 271527 [details] Patch
Comment on attachment 271527 [details] Patch Clearing flags on attachment: 271527 Committed r196690: <http://trac.webkit.org/changeset/196690>
All reviewed patches have been landed. Closing bug.