Bug 27088 - WebKit constructors use wrong global object/prototype chain
Summary: WebKit constructors use wrong global object/prototype chain
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore JavaScript (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on: 27634 27157 27242 27243 27276 27278 27279 27478 27521 27547 27588
Blocks:
  Show dependency treegraph
 
Reported: 2009-07-08 12:39 PDT by Andrew Wilson
Modified: 2010-11-23 22:48 PST (History)
5 users (show)

See Also:


Attachments
reduction that tests all global constructors and exposes this bug (6.28 KB, text/plain)
2009-07-08 18:17 PDT, Andrew Wilson
no flags Details
patch (8.68 KB, patch)
2009-07-10 13:38 PDT, Eric Seidel (no email)
no flags Details | Formatted Diff | Diff
Add a missing layout test result to improve the quality of life of the Mac buildbots. (3.47 KB, patch)
2009-07-13 17:45 PDT, Eric Seidel (no email)
no flags Details | Formatted Diff | Diff
First attempt, does not compile, not for review, will be broken into smaller pieces (37.39 KB, patch)
2009-07-13 17:48 PDT, Eric Seidel (no email)
no flags Details | Formatted Diff | Diff
Now compiles, just needs testing (21.97 KB, patch)
2009-07-21 17:44 PDT, Eric Seidel (no email)
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Wilson 2009-07-08 12:39:40 PDT
If a child frame accesses a constructor from the parent window (for example: parent.window.Image()) various incorrect behavior results:

1) Typically the wrong constructor is accessed (instead of grabbing the constructor and prototype chain from the specified window, the constructor/prototype is obtained from the lexicalGlobalObject).

2) In some cases, that constructor is then cached back in the parent window, leaving the parent window polluted with prototypes/constructors from the child.

#1 is a similar issue to https://bugs.webkit.org/show_bug.cgi?id=21138, although the reduction in that test doesn't work in Safari due to security constraints on data URLs.

I'll attach a reduction shortly.
Comment 1 Andrew Wilson 2009-07-08 18:17:05 PDT
Created attachment 32496 [details]
reduction that tests all global constructors and exposes this bug

Since the constructor code is looking at the lexical scope, it can be tricky to reproduce this bug (for example, accessing parent.window.Image will show the bug, but calling a function in the parent frame that accesses parent.window.Image won't.
Comment 2 Eric Seidel (no email) 2009-07-10 13:38:14 PDT
Created attachment 32574 [details]
patch
Comment 3 Eric Seidel (no email) 2009-07-10 13:39:47 PDT
Comment on attachment 32574 [details]
patch

Sorry, wrong bug.
Comment 4 Adam Barth 2009-07-10 15:37:48 PDT
Here a test case:

http://webblaze.org/abarth/tests/protoconfused/test1.html

It covers the first level of objects off the global object.
Comment 5 Adam Barth 2009-07-10 16:08:35 PDT
Here's another test.  This one crawls around the object graph for a bit looking for stuff:

http://webblaze.org/abarth/tests/protoconfused/test2.html

I don't certify that the results (PASS / FAIL) are 100% reliable, but its a start.
Comment 6 Eric Seidel (no email) 2009-07-13 17:45:30 PDT
Created attachment 32689 [details]
Add a missing layout test result to improve the quality of life of the Mac buildbots.


* platform/mac/fast/text/international/khmer-selection-expected.txt: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@45838 268f45cc-cd09-0410-ab3c-d52691b4dbfc
---
 2 files changed, 52 insertions(+), 0 deletions(-)
Comment 7 Eric Seidel (no email) 2009-07-13 17:48:23 PDT
Created attachment 32690 [details]
First attempt, does not compile, not for review, will be broken into smaller pieces


---
 26 files changed, 105 insertions(+), 97 deletions(-)
Comment 8 Eric Seidel (no email) 2009-07-21 17:44:57 PDT
Created attachment 33233 [details]
Now compiles, just needs testing


---
 14 files changed, 74 insertions(+), 50 deletions(-)
Comment 9 Eric Seidel (no email) 2009-07-22 00:37:52 PDT
Comment on attachment 33233 [details]
Now compiles, just needs testing

This has a few possible functional changes which could be tested (and/or separated out from this patch):
window.history.constructor
window.location.constructor
document.location.__proto__
document.forms.name.__proto__
(new RGBColor).__proto__
instanceof JSSharedWorkerConstructor

all .constructor accesses could be fixed (although most won't be due to toJS not yet passing enough information)

all autogenerated constructors could have changed instanceof's
Comment 10 Eric Seidel (no email) 2009-07-23 17:58:40 PDT
Comment on attachment 33233 [details]
Now compiles, just needs testing

Using this as a meta bug for now.  Patches will be on sub-bugs.