Created attachment 58021 [details] Backtrace of postMessage(window) throwing a type error postMessage(window) should throw TypeError: "Cannot post cyclic structures." like it (normally) does in LayoutTests/fast/dom/Window/window-postmessage-clone.html. However, in case the TreeWalker traverses through an input element other than text field before it notices the cyclic structure, it throws TypeError: "Type error". This issue was revealed when adding a new attribute to Element.idl which caused the hash lookup to traverse through the objects/properties in different order in LayoutTests/fast/dom/Window/window-postmessage-clone.html. The issue can also be seen by slightly modifying the test page by e.g. adding a dummy input element on top of the test page with type "button" or "file" (I'll attach a test case for this) The reason why this happens is that when the TreeWalkers in WebCore/bindings/ js/SerializedScriptValue.cpp walk through the objects and their properties, the getProperty function ends up querying the JSHTMLInputElement::selectionStart or JSHTMLInputElement::selectionEnd properties whose getters throw the type error in case the input element is not of type "TextField" (!input->canHaveSelection()) See the example backtrace for further clarification.
Created attachment 58022 [details] LayoutTests/fast/dom/Window/window-postmessage-clone with additional input element Added a test case that is otherwise identical to LayoutTests/fast/dom/Window/window-postmessage-clone.html except one dummy input (type="button") element that is added on top of the page. This dummy input element makes the postMessage(window) test fail prompting: PASS: 'postMessage(window)' threw TypeError: Type error when the expected output would be: PASS: 'postMessage(window)' threw TypeError: Cannot post cyclic structures. Removing the dummy button results in the expected output.
The actual issue is that postMessage should serialise dom objects to null by default and it is being tracked in https://bugs.webkit.org/show_bug.cgi?id=40329 *** This bug has been marked as a duplicate of bug 40329 ***