[Webkit-unassigned] [Bug 133531] REGRESSION prototype chain ignored accessing variables at global scope

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=133531





--- Comment #1 from Geoffrey Garen <ggaren at apple.com>  2014-06-05 12:33:08 PST ---
I wrote this test page to try to replicate what you described in runnable code:

<script>
a = {};
this.__proto__ = a;
a.f = 5;
console.log(f);
</script>

What I found was that older versions of Safari, and the latest version of Safari, both throw a ReferenceError on the last line, because "f" is not in lexical scope.

The reason this happens is that "this" is a forwarding proxy for the lexical global object, and when you change the prototype of "this", rather than changing the prototype of the lexical global object, you disconnect the forwarding proxy from the lexical global object's prototype.

The reason you didn't notice this behavior using the JavaScriptCore API outside the WebKit context is that the forwarding proxy behavior used to be built into WebKit, and now it is built into JavaScriptCore.

Another way to install a bag of properties onto the lexical global object is this:

function installProperties(bag)
{
    for (var p in bag)
        this[p] = bag[p];
}

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.