[w3c/browser-payment-api] Time validity of updateWith() (#188)

I think this is probably what everyone has in mind, but we should be clear: updateWith() needs to be valid only during the event processing loop its corresponding event fires in. We want to make sure that the web page cannot update the value *except* when the UI is frozen as described in updateWith() processing. (Race conditions between update and submit could end up being dangerous, especially when cryptocurrencies are involved).

For example, something like this should not work:

```javascript
payment.onmailingaddresschange=function(e) {
  setTimeout(function() {
    e.updateWith(...);
  }, 1000));
}
```

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/188