W3C home > Mailing lists > Public > www-dom@w3.org > October to December 2012

Re: [dom] Need to describe the interaction of adoptNode with prototype chains

From: Geoffrey Sneddon <gsneddon@opera.com>
Date: Sat, 22 Dec 2012 19:42:41 +0000
Message-ID: <50D60D31.1050301@opera.com>
To: Boris Zbarsky <bzbarsky@MIT.EDU>
CC: www-dom@w3.org
On 22/12/12 19:12, Boris Zbarsky wrote:
> On 12/22/12 4:33 AM, James Ross wrote:
>> http://software.hixie.ch/utilities/js/live-dom-viewer/?saved=2044. IE 10
>> produces the same results as Firefox 17:
> So a few more thoughts on this:
> 1)  Exposing GC behavior is unfortunate, and if we allow JS reflections
> to be collected independent of the underlying node (which at least
> Gecko, WebKit+JSC, WebKit+V8 do, though in WebKit+V8 you have to trigger
> a major collection, which my testcase may not have managed) then not
> exposing it means either remembering the original JS proto forever in
> the node or changing proto on adopt.

I'm definitely against exposing GC behaviour more than we already have 
in the platform (I think it's unfortunate where we already do and would 
quite like to get rid of that, though I'm not sure that's viable).

> 2)  If a script adopts a node from a subframe and then unloads the
> subframe or removes it from the DOM, remembering the proto means you
> leak the entire global object _and_ the entire DOM of the subframe,
> because HTMLElement is reachable from the adopted node (via .__proto__
> and .constructor) and then you can call "new HTMLElement" from the
> now-unloaded subframe Window and now you have a node whose ownerDocument
> is the document that was in the subframe and you can reach its DOM, so
> the the UA has to keep all that stuff alive or has to make some of this
> stuff not work or something.  That seems like a pretty serious footgun
> to me.

And this seems /really/ bad to me.

> I don't really like mutating proto chains either, but I'm not sure we
> have great options here. :(

I'm in favour of mutating the proto on adoption, as much as I hate 
mutating [[Prototype]].

> Do Opera and Chrome really never change the proto observably, or is
> their behavior like Safari's and I'm just failing to trigger a GC that
> collects the relevant object?  Can someone who knows the relevant code
> speak up?

Opera really never changes the prototype observably (or at all).

Geoffrey Sneddon  Opera Software
Received on Saturday, 22 December 2012 19:43:23 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 20 October 2015 10:46:19 UTC