Bug 169787 – Allow setting the prototype of cross-origin objects, as long as they don't change

• Status: RESOLVED
• Resolution: FIXED
• Component: Bindings

[Domenic Denicola]

A recent spec tweak made WindowProxy and Location consistent with Object.prototype in the ECMAScript spec, in that you are allowed to set their prototype as long as you don't *change* it. Safari Tech Preview implements the spec perfectly before this tweak; sorry to change this from under you.

The following web platform tests should cover the new behavior exhaustively:

- WindowProxy
  - http://w3c-test.org/html/browsers/the-windowproxy-exotic-object/windowproxy-prototype-setting-cross-origin-domain.sub.html
  - http://w3c-test.org/html/browsers/the-windowproxy-exotic-object/windowproxy-prototype-setting-cross-origin.sub.html
  - http://w3c-test.org/html/browsers/the-windowproxy-exotic-object/windowproxy-prototype-setting-goes-cross-origin-domain.sub.html
  - http://w3c-test.org/html/browsers/the-windowproxy-exotic-object/windowproxy-prototype-setting-same-origin-domain.sub.html
  - http://w3c-test.org/html/browsers/the-windowproxy-exotic-object/windowproxy-prototype-setting-same-origin.html
- Location
  - http://w3c-test.org/html/browsers/history/the-location-interface/location-prototype-setting-cross-origin-domain.sub.html
  - http://w3c-test.org/html/browsers/history/the-location-interface/location-prototype-setting-cross-origin.sub.html
  - http://w3c-test.org/html/browsers/history/the-location-interface/location-prototype-setting-goes-cross-origin-domain.sub.html
  - http://w3c-test.org/html/browsers/history/the-location-interface/location-prototype-setting-same-origin-domain.sub.html
  - http://w3c-test.org/html/browsers/history/the-location-interface/location-prototype-setting-same-origin.html

[Chris Dumez]

Created attachment 304710 [details]
WIP Patch

[Build Bot]

Comment on attachment 304710 [details]
WIP Patch

Attachment 304710 [details] did not pass jsc-ews (mac):
Output: http://webkit-queues.webkit.org/results/3343789

New failing tests:
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/prototype-assignment.js.misc-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-ftl
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-ftl-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-dfg-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-llint

[Build Bot]

Comment on attachment 304710 [details]
WIP Patch

Attachment 304710 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/3343804

New failing tests:
http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto.html
imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/allow_prototype_cycle_through_location.sub.html
js/object-literal-shorthand-construction.html
http/tests/security/cross-frame-access-object-setPrototypeOf.html
js/dom/setPrototypeOf-location-window.html
js/prototype-assignment.html
fast/dom/Window/window-custom-prototype-crash.html

[Build Bot]

Created attachment 304719 [details]
Archive of layout-test-results from ews107 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6

[Chris Dumez]

Created attachment 304721 [details]
WIP Patch

[Build Bot]

Comment on attachment 304721 [details]
WIP Patch

Attachment 304721 [details] did not pass jsc-ews (mac):
Output: http://webkit-queues.webkit.org/results/3344358

New failing tests:
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/prototype-assignment.js.misc-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-ftl
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-ftl-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-dfg-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-llint

[Build Bot]

Comment on attachment 304721 [details]
WIP Patch

Attachment 304721 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/3344622

New failing tests:
http/tests/security/xss-DENIED-regular-propterty-with-iframe-proto.html
imported/w3c/web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects.html
js/object-literal-shorthand-construction.html
http/tests/security/cross-frame-access-object-setPrototypeOf.html
js/dom/setPrototypeOf-location-window.html
js/prototype-assignment.html
fast/dom/Window/window-custom-prototype-crash.html

[Build Bot]

Created attachment 304734 [details]
Archive of layout-test-results from ews114 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews114  Port: mac-elcapitan  Platform: Mac OS X 10.11.6

[Chris Dumez]

Created attachment 304748 [details]
Patch

[Build Bot]

Comment on attachment 304748 [details]
Patch

Attachment 304748 [details] did not pass jsc-ews (mac):
Output: http://webkit-queues.webkit.org/results/3346337

New failing tests:
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/prototype-assignment.js.misc-ftl-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-ftl
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-ftl-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-dfg-eager-no-cjit
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout
jsc-layout-tests.yaml/js/script-tests/object-literal-shorthand-construction.js.layout-no-llint

[Chris Dumez]

Comment on attachment 304748 [details]
Patch

Will look into the JSC test failures tomorrow.

[Chris Dumez]

Created attachment 304789 [details]
Patch

[Chris Dumez]

Comment on attachment 304789 [details]
Patch

All green, ready for review.

[Build Bot]

Comment on attachment 304789 [details]
Patch

Attachment 304789 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/3350533

New failing tests:
webrtc/peer-connection-audio-mute2.html

[Build Bot]

Created attachment 304796 [details]
Archive of layout-test-results from ews106 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6

[Chris Dumez]

Comment on attachment 304789 [details]
Patch

Flake!

[Mark Lam]

Comment on attachment 304789 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=304789&action=review

> Source/WebCore/page/DOMWindow.idl:40
> -    IsImmutablePrototypeExoticObject,
>      IsImmutablePrototypeExoticObjectOnPrototype,

If IsImmutablePrototypeExoticObject has no effect on the Window, does it have any effect elsewhere?  Or should it be removed completely everywhere?  If it has effect elsewhere, I'd be curious to know why it's different here.

Secondly, is IsImmutablePrototypeExoticObjectOnPrototype needed still?

[Chris Dumez]

Comment on attachment 304789 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=304789&action=review

>> Source/WebCore/page/DOMWindow.idl:40
>>      IsImmutablePrototypeExoticObjectOnPrototype,
> 
> If IsImmutablePrototypeExoticObject has no effect on the Window, does it have any effect elsewhere?  Or should it be removed completely everywhere?  If it has effect elsewhere, I'd be curious to know why it's different here.
> 
> Secondly, is IsImmutablePrototypeExoticObjectOnPrototype needed still?

As I explained in the Changelog, the reason it has no effect on Window is because Window has a proxy and its proxy already takes care of throwing when setting the prototype (see JSProxy::setPrototypeOf()).

[Chris Dumez]

Comment on attachment 304789 [details]
Patch

Trying something else based on Mark's offline feedback.

[Chris Dumez]

Created attachment 304851 [details]
Patch

[Mark Lam]

Comment on attachment 304851 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=304851&action=review

Nice.  r=me

> Source/JavaScriptCore/ChangeLog:17
> +        In particular, we need to call [[GetPrototypeOf]] and return true it returns the same

typo: /true it/true if it/.

> Source/JavaScriptCore/ChangeLog:26
> +        Handling in immutable prototype exotic objects in that method does the right thing for

typo: /Handing in immutable/Handling immutable/.

[Chris Dumez]

Committed r214135: <http://trac.webkit.org/changeset/214135>