Bug 27088 – WebKit constructors use wrong global object/prototype chain

• Status: NEW
• Component: WebCore JavaScript

[Andrew Wilson]

If a child frame accesses a constructor from the parent window (for example: parent.window.Image()) various incorrect behavior results:

1) Typically the wrong constructor is accessed (instead of grabbing the constructor and prototype chain from the specified window, the constructor/prototype is obtained from the lexicalGlobalObject).

2) In some cases, that constructor is then cached back in the parent window, leaving the parent window polluted with prototypes/constructors from the child.

#1 is a similar issue to https://bugs.webkit.org/show_bug.cgi?id=21138, although the reduction in that test doesn't work in Safari due to security constraints on data URLs.

I'll attach a reduction shortly.

[Andrew Wilson]

Created attachment 32496 [details]
reduction that tests all global constructors and exposes this bug

Since the constructor code is looking at the lexical scope, it can be tricky to reproduce this bug (for example, accessing parent.window.Image will show the bug, but calling a function in the parent frame that accesses parent.window.Image won't.

[Eric Seidel (no email)]

Created attachment 32574 [details]
patch

[Eric Seidel (no email)]

Comment on attachment 32574 [details]
patch

Sorry, wrong bug.

[Adam Barth]

Here a test case:

http://webblaze.org/abarth/tests/protoconfused/test1.html

It covers the first level of objects off the global object.

[Adam Barth]

Here's another test.  This one crawls around the object graph for a bit looking for stuff:

http://webblaze.org/abarth/tests/protoconfused/test2.html

I don't certify that the results (PASS / FAIL) are 100% reliable, but its a start.

[Eric Seidel (no email)]

Created attachment 32689 [details]
Add a missing layout test result to improve the quality of life of the Mac buildbots.


* platform/mac/fast/text/international/khmer-selection-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@45838 268f45cc-cd09-0410-ab3c-d52691b4dbfc
---
 2 files changed, 52 insertions(+), 0 deletions(-)

[Eric Seidel (no email)]

Created attachment 32690 [details]
First attempt, does not compile, not for review, will be broken into smaller pieces


---
 26 files changed, 105 insertions(+), 97 deletions(-)

[Eric Seidel (no email)]

Created attachment 33233 [details]
Now compiles, just needs testing


---
 14 files changed, 74 insertions(+), 50 deletions(-)

[Eric Seidel (no email)]

Comment on attachment 33233 [details]
Now compiles, just needs testing

This has a few possible functional changes which could be tested (and/or separated out from this patch):
window.history.constructor
window.location.constructor
document.location.__proto__
document.forms.name.__proto__
(new RGBColor).__proto__
instanceof JSSharedWorkerConstructor

all .constructor accesses could be fixed (although most won't be due to toJS not yet passing enough information)

all autogenerated constructors could have changed instanceof's

[Eric Seidel (no email)]

Comment on attachment 33233 [details]
Now compiles, just needs testing

Using this as a meta bug for now.  Patches will be on sub-bugs.

[Alexey Proskuryakov]

This is very old and probably not applicable any more, but the attached test doesn't work now (even with fixed subresource paths), and I don't have sufficient bindings expertise to verify.