[Webkit-unassigned] [Bug 11315] Mutating document.constructor.prototype mutates Object.prototype

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=11315


bdash at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|MS Atlas Safari             |Mutating
                   |Compatibility layer         |document.constructor.prototy
                   |considered harmful          |pe mutates Object.prototype
         Resolution|INVALID                     |
           Priority|P3                          |P2
             Status|RESOLVED                    |UNCONFIRMED
                URL|http://atlas.asp.net/atlasto|http://bdash.net.nz/files/co
                   |olkit/Accordion/Accordion.as|nstructor-prototypes.html
                   |px                          |
                 CC|                            |bleroy at microsoft.com




------- Comment #5 from bdash at webkit.org  2006-10-17 20:25 PDT -------
So I got bored and decided to reduce this issue to see what exactly was going
wrong.  My initial assumption was that the Atlas had been doing something
incorrect inside the Safari-specific portion of the JavaScript.  This code
wasn't easily testable on other browsers, so I have reduced the issue.  The
reduction is available from
<http://bdash.net.nz/files/constructor-prototypes.html>.  The meat of the issue
appears to be that document.constructor.prototype and
document.createTextNode("").constructor.prototype both reference
Object.prototype.  Adding properties to this results in all Object's gaining
the new properties.  Firefox does not exhibit this behaviour on the reduction.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.