[webkit-dev] ExecState::thisObject()

[Adam Barth]

On Mon, Jul 13, 2009 at 2:26 PM, Maciej Stachowiak<mjs at apple.com> wrote:
> For the few cases where
> cross-origin access is allowed, we would *not* want to expose the home
> window's prototype chain. So for Window.postMessage for instance,
> cross-origin access need to give you a distinct wrapper.

That's correct.  In fact, Firefox had this exact bug as recently as a year ago.

Adam