RESOLVED CONFIGURATION CHANGED 21138
DOM Constructors are being cached/looked up with the wrong global object
https://bugs.webkit.org/show_bug.cgi?id=21138
Summary DOM Constructors are being cached/looked up with the wrong global object
Oliver Hunt
Reported 2008-09-26 03:49:20 PDT
Our caching of constructor objects is based on the lexical global object at the time of request rather than the object we're actually lifting these objects off. This means that it is impossible for windowa to directly retrieve a dom constructor from windowb (see the attached testcase).
Attachments
test case (267 bytes, text/html)
2008-09-26 03:49 PDT, Oliver Hunt
no flags
Updated test case (359 bytes, text/html)
2022-09-16 12:55 PDT, Ryosuke Niwa
no flags
Oliver Hunt
Comment 1 2008-09-26 03:49:46 PDT
Created attachment 23845 [details] test case
Ahmad Saleem
Comment 2 2022-09-12 15:31:17 PDT
*** Safari 16 on macOS 12.6 *** In Console: SecurityError: Blocked a frame with origin "https://bug-21138-attachments.webkit.org" from accessing a cross-origin frame. Protocols, domains, and ports must match. *** STP 153 *** In Console: SecurityError: Blocked a frame with origin "https://bug-21138-attachments.webkit.org" from accessing a cross-origin frame. Protocols, domains, and ports must match. *** Chrome Canary 107 ***  attachment.cgi?id=23845:5 Uncaught DOMException: Blocked a frame with origin "https://bug-21138-attachments.webkit.org" from accessing a cross-origin frame. at window.onload (https://bug-21138-attachments.webkit.org/attachment.cgi?id=23845:5:61) *** Firefox Nightly 106 *** Uncaught DOMException: Permission denied to access property "HTMLAnchorElement" on cross-origin object __________ These are results from all browsers. Just wanted to share the results. Thanks!
Ryosuke Niwa
Comment 3 2022-09-16 12:55:22 PDT
Created attachment 462402 [details] Updated test case This test case works in Safari now.
Note You need to log in before you can comment on or make changes to this bug.