- From: Maciej Stachowiak <mjs@apple.com>
- Date: Thu, 16 Jul 2009 14:59:16 -0700
- To: Adam Barth <w3c@adambarth.com>
- Cc: public-webapps <public-webapps@w3.org>
On Jul 16, 2009, at 10:45 AM, Adam Barth wrote: > When a browser creates an instance of a DOM object defined by an > WebIDL interface, the browser must choose where to connect it's > prototype chain. For example, consider this case (where frames[0] is > a same-origin child frame): > > var doc = frames[0].document; > > 1) To which global object's prototypes ought |doc| connect to, the > parent frame running the script or the child frame from which we > obtained the document? > > 2) Where is this behavior specified? If the behavior is currently not > specified, which spec ought to contain the requirements? > > My best guess is that the prototype chain ought to connect to the > child's prototype (because the document "is owned by" the child frame) > and that the WebIDL spec ought to include this requirement (because > WebIDL explains how to reify abstract DOM interfaces in ECMAScript). > > Thoughts? One thing to note: any object or method that is exposed cross-origin should specifically *not* have this behavior. Instead, it should create a separate interface object in every frame that accesses the property. window.history, window.location and window.postMessage are examples that require this treatment. Web IDL needs to give a hook to other specs so they can specify that cross-origin properties need to get this different treatment. Regards, Maciej
Received on Thursday, 16 July 2009 21:59:57 UTC