In the test case we extend the prototype of HTMLInputElement to add a property "foo". In the child iframe I extend the prototype of HTMLInputElement to add a property "bar". In the child iframe we hook up an event listener to the parent window's body and access e.target.
When clicking the submit button we should expect to see "foo", which is the property we added to the HTMLInputElement's prototype, but instead we see "undefined". Removing the line in the iframe which accesses e.target causes the alert to display "foo", as expected.
It looks like when e.target is accessed in the child iframe it creates the HTMLElement DOM wrapper and this causes the prototypes from the parent window to be moved to the child iframe, then when we handle the onsubmit event in the parent window it lazyilly creates the HTMLElement DOM wrapper but with a blank prototype that now exists in the parent window.
The extended prototypes are getting incorrectly moved between the two window objects.
This looks like it could be related to bug 24795 but the testcase attached to that bug seems to work in the latest nightly so I suspect that it could actually be a different issue.
Confirming as a difference with Firefox.
This is a dup of another bug that I can't put my fingers on immediately. This is also related to a recent thread on webkit-dev.
The bug URL is no longer valid. Could you please attach the test case to the bug?
Created attachment 49673 [details]
Testcase for the main page (requires test-prototype-iframe.html as well)
Created attachment 49674 [details]
Testcase for the iframe (is loaded by the first testcase page)
I can reproduce with Safari/WebKit 4.0.4, but this appears fixed with recent WebKit builds (I tried r55339).
For reference, I'm pretty sure this was fixed in r46444.
Maybe we need to land this test case then - r46444 didn't include tests. Re-opening for that.
Created attachment 49692 [details]
Test committed <http://trac.webkit.org/changeset/55396>.