Bug 167681 – REGRESSION(r205136): {}.toString.call(crossOriginWindow) should not throw

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Chris Dumez]

{}.toString.call(crossOriginWindow) should not throw.

Firefox and Chrome do not throw but WebKit ToT does (this may be a recent regression).

Test cases:
- http://w3c-test.org/html/browsers/origin/cross-origin-objects/cross-origin-objects.html
- http://stuff.schub.io/mozilla/testcases/1321299/

[Radar WebKit Bug Importer]

<rdar://problem/30301117>

[Ryosuke Niwa]

This is indeed a regression from http://trac.webkit.org/changeset/205136.

[Chris Dumez]

From https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-)
"""
If P is @@toStringTag, @@hasInstance, or @@isConcatSpreadable, then return PropertyDescriptor{ [[Value]]: undefined, [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
"""

I think this is the part we are missing.

[Chris Dumez]

Created attachment 300338 [details]
Patch

[Mark Lam]

Comment on attachment 300338 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=300338&action=review

r=me with comment.

> LayoutTests/imported/w3c/web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt:24
> -FAIL {}.toString.call() does the right thing on cross-origin objects Blocked a frame with origin "http://localhost:8800" from accessing a frame with origin "http://127.0.0.1:8800". Protocols, domains, and ports must match.
> +FAIL {}.toString.call() does the right thing on cross-origin objects assert_equals: expected "[object Object]" but got "[object Window]"

Can you fix the test to expect the correct thing?

[Chris Dumez]

(In reply to comment #5)
> Comment on attachment 300338 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=300338&action=review
> 
> r=me with comment.
> 
> > LayoutTests/imported/w3c/web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt:24
> > -FAIL {}.toString.call() does the right thing on cross-origin objects Blocked a frame with origin "http://localhost:8800" from accessing a frame with origin "http://127.0.0.1:8800". Protocols, domains, and ports must match.
> > +FAIL {}.toString.call() does the right thing on cross-origin objects assert_equals: expected "[object Object]" but got "[object Window]"
> 
> Can you fix the test to expect the correct thing?

I think the test is correct. We are supposed to return "[object Object]" but we report "[object Window]".

[Chris Dumez]

Created attachment 300343 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 300343 [details]
Patch

Clearing flags on attachment: 300343

Committed r211504: <http://trac.webkit.org/changeset/211504>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.