[Webkit-unassigned] [Bug 11315] Mutating document.constructor.prototype mutates Object.prototype

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Oct 17 20:25:55 PDT 2006


bdash at webkit.org changed:

           What    |Removed                     |Added
            Summary|MS Atlas Safari             |Mutating
                   |Compatibility layer         |document.constructor.prototy
                   |considered harmful          |pe mutates Object.prototype
         Resolution|INVALID                     |
           Priority|P3                          |P2
             Status|RESOLVED                    |UNCONFIRMED
                   |px                          |
                 CC|                            |bleroy at microsoft.com

------- Comment #5 from bdash at webkit.org  2006-10-17 20:25 PDT -------
So I got bored and decided to reduce this issue to see what exactly was going
wrong.  My initial assumption was that the Atlas had been doing something
incorrect inside the Safari-specific portion of the JavaScript.  This code
wasn't easily testable on other browsers, so I have reduced the issue.  The
reduction is available from
<http://bdash.net.nz/files/constructor-prototypes.html>.  The meat of the issue
appears to be that document.constructor.prototype and
document.createTextNode("").constructor.prototype both reference
Object.prototype.  Adding properties to this results in all Object's gaining
the new properties.  Firefox does not exhibit this behaviour on the reduction.

Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

More information about the webkit-unassigned mailing list