Bug 187411 – REGRESSION (r219757): Accessing response getter of XHR instance from IFRAME sets constructor to Object from the IFRAME

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

Created attachment 344453 [details]
test case

Scenario:
base page with one same-origin IFRAME
base page creates an XMLHttpRequest instance

Issue:
If the IFRAME adds a `readystatechange` listener to the XMLHttpRequest instance, and it reads the response getter before the `top` context does, the `constructor` of the object will be equivalent to `iframe.contentWindow.Object`, not `top.Object`. 

This "works" in other browsers, including Safari 10.0.1.

Works in 604.5.6.
Fails in 605.1.15.

Code executed in the IFRAME:
xhr.addEventListener('readystatechange', function(){
  xhr.response
})

From this point forward:
xhr.response.constructor === iframe.contentWindow.Object
xhr.response.constructor !== top.Object


See https://cvazac.netlify.com/xhr-response-constructor/ for reproducible case.

[Radar WebKit Bug Importer]

<rdar://problem/41920593>

I attempted to bisect the issue using:
./Tools/Scripts/bisect-builds -c release -p mac-highsierra -s 219162 -e 224949

But every build that attempts to launch gives me:
Starting SafariForWebKitDevelopment with DYLD_FRAMEWORK_PATH set to point to built WebKit in /var/folders/33/prqh7l5n7fgd1l6d3kq6bq_r0000gy/T/tmpK9xc8x/Release.
dyld: Symbol not found: __ZN3WTF8JSONImpl10ObjectBase6removeERKNS_6StringE
  Referenced from: /System/Library/PrivateFrameworks/WebInspector.framework/Versions/A/WebInspector
  Expected in: /var/folders/33/prqh7l5n7fgd1l6d3kq6bq_r0000gy/T/tmpK9xc8x/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore
 in /System/Library/PrivateFrameworks/WebInspector.framework/Versions/A/WebInspector

[Alexey Proskuryakov]

Yes, these WebKit revisions are so old that they don't work with latest Safari.

I bisected to r219757. Sam, Chris, could you take a look?

[Chris Dumez]

Likely caused by us caching the response in the wrapper.

[Chris Dumez]

Created attachment 345483 [details]
Patch

[Chris Dumez]

Comment on attachment 345483 [details]
Patch

ping review?

[WebKit Commit Bot]

Comment on attachment 345483 [details]
Patch

Clearing flags on attachment: 345483

Committed r234188: <https://trac.webkit.org/changeset/234188>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.