If a child frame accesses a constructor from the parent window (for example: parent.window.Image()) various incorrect behavior results: 1) Typically the wrong constructor is accessed (instead of grabbing the constructor and prototype chain from the specified window, the constructor/prototype is obtained from the lexicalGlobalObject). 2) In some cases, that constructor is then cached back in the parent window, leaving the parent window polluted with prototypes/constructors from the child. #1 is a similar issue to https://bugs.webkit.org/show_bug.cgi?id=21138, although the reduction in that test doesn't work in Safari due to security constraints on data URLs. I'll attach a reduction shortly.
Created attachment 32496 [details] reduction that tests all global constructors and exposes this bug Since the constructor code is looking at the lexical scope, it can be tricky to reproduce this bug (for example, accessing parent.window.Image will show the bug, but calling a function in the parent frame that accesses parent.window.Image won't.
Created attachment 32574 [details] patch
Comment on attachment 32574 [details] patch Sorry, wrong bug.
Here a test case: http://webblaze.org/abarth/tests/protoconfused/test1.html It covers the first level of objects off the global object.
Here's another test. This one crawls around the object graph for a bit looking for stuff: http://webblaze.org/abarth/tests/protoconfused/test2.html I don't certify that the results (PASS / FAIL) are 100% reliable, but its a start.
Created attachment 32689 [details] Add a missing layout test result to improve the quality of life of the Mac buildbots. * platform/mac/fast/text/international/khmer-selection-expected.txt: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@45838 268f45cc-cd09-0410-ab3c-d52691b4dbfc --- 2 files changed, 52 insertions(+), 0 deletions(-)
Created attachment 32690 [details] First attempt, does not compile, not for review, will be broken into smaller pieces --- 26 files changed, 105 insertions(+), 97 deletions(-)
Created attachment 33233 [details] Now compiles, just needs testing --- 14 files changed, 74 insertions(+), 50 deletions(-)
Comment on attachment 33233 [details] Now compiles, just needs testing This has a few possible functional changes which could be tested (and/or separated out from this patch): window.history.constructor window.location.constructor document.location.__proto__ document.forms.name.__proto__ (new RGBColor).__proto__ instanceof JSSharedWorkerConstructor all .constructor accesses could be fixed (although most won't be due to toJS not yet passing enough information) all autogenerated constructors could have changed instanceof's
Comment on attachment 33233 [details] Now compiles, just needs testing Using this as a meta bug for now. Patches will be on sub-bugs.
This is very old and probably not applicable any more, but the attached test doesn't work now (even with fixed subresource paths), and I don't have sufficient bindings expertise to verify.