[Webkit-unassigned] [Bug 27088] New: WebKit constructors use wrong global object/prototype chain

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=27088

           Summary: WebKit constructors use wrong global object/prototype
                    chain
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore JavaScript
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: atwilson at google.com


If a child frame accesses a constructor from the parent window (for example:
parent.window.Image()) various incorrect behavior results:

1) Typically the wrong constructor is accessed (instead of grabbing the
constructor and prototype chain from the specified window, the
constructor/prototype is obtained from the lexicalGlobalObject).

2) In some cases, that constructor is then cached back in the parent window,
leaving the parent window polluted with prototypes/constructors from the child.

#1 is a similar issue to https://bugs.webkit.org/show_bug.cgi?id=21138,
although the reduction in that test doesn't work in Safari due to security
constraints on data URLs.

I'll attach a reduction shortly.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.