Re: [heycam/webidl] Introduce a SameRealmBrandCheck extended attribute (#718)

> it allows us to entirely avoid worrying about current realm vs. relevant realm

I have to say, I'm really excited about this part. It would be very difficult to make polyfills in JavaScript that return relevant realm objects (since JS very widely closes over the realm of the method, i.e., the current realm), but @bzbarsky has made strong arguments in issues in this repository that relevant realm is sometimes the right one. With same-realm brand checks, these realms coincide!

> @littledan had some ideas based on, e.g., using the script URL as a source of identity across realms

I'm not sure whether any of those ideas would really work at all; it would take a bit more thought. And from JS, we'd need some new language mechanism to tap into it (a built-in decorator??). Another idea that @tschneidereit suggested was to just allow a user-supplied string or `Symbol.for`-like mechanism end up determining the brand, sort of like COM GUIDs (that is, make it entirely spoof-able from JS, if you know the incantation, but maybe built-ins would have their own separate registry which would reduce that risk).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/heycam/webidl/pull/718#issuecomment-487219524