[Webkit-unassigned] [Bug 185906] New: Unexpected constructor / instanceof behavior when retrieving indexedDB data in an iframe

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=185906

            Bug ID: 185906
           Summary: Unexpected constructor / instanceof  behavior when
                    retrieving indexedDB data in an iframe
           Product: WebKit
           Version: Safari 11
          Hardware: Macintosh
                OS: macOS 10.13
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: maxime.rety at gmail.com

There's an unexpected behavior in Safari 11.1 after retrieving data from indexedDB inside an iframe: the values cannot be properly checked against constructors with instanceof.

Pseudo code run in an iframe:

  // Store this record in indexedDB
  const record = { array: [1, 2, 3] };

  // Same record retrieved later from indexedDB:
  const record = event.target.result;
  record.array instanceof Array;               // expected true but false in Safari 11.1
  record.array instanceof window.parent.Array; // expected false but true in Safari 11.1

Tested on Safari Version 11.1 (13605.1.33.1.4) on macOS High Sierra 10.13.4.

The issue also occurs for Uint8Array, a.s.o. and probably all "constructed" types.

A lot of libraries and home-made code rely on instanceof to work as expected on values retrieved from indexedDB in an iframe.

Full test case: https://gist.github.com/maximerety/92431f6f4cc9ea8f684de8c124469995

Related issue: https://github.com/feross/buffer/issues/166

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180523/55e5d63c/attachment.html>