[Webkit-unassigned] [Bug 160952] Wrapper for an adopted node can be created in inconsistent global objects

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Aug 17 18:36:05 PDT 2016


https://bugs.webkit.org/show_bug.cgi?id=160952

--- Comment #2 from Ryosuke Niwa <rniwa at webkit.org> ---
In this demo, a div element is created in document A, and span and b elements are created as descendants of the div via div.innerHTML. The div is then adopted into another document B.

When accessing the span and the b elements in document B, the manner of accessing those nodes determine the global object in which the wrappers are created.  If we're creating via .firstChild or any other property or any method of the div, then we'd create a wrapper using document A's global object.  If it's done via properties or methods on any other object whose global object is that of document B, then we'd create a wrapper using the global object of document B.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160818/6919b863/attachment-0001.html>


More information about the webkit-unassigned mailing list