- From: Bobby Holley <bobbyholley@gmail.com>
- Date: Fri, 9 Nov 2012 08:59:12 -0800
- To: Adam Barth <w3c@adambarth.com>
- Cc: whatwg <whatwg@lists.whatwg.org>, Matt Wobensmith <mwobensmith@mozilla.com>, Boris Zbarsky <bzbarsky@mit.edu>, Johnny Stenback <jst@mozilla.com>
On Thu, Nov 8, 2012 at 6:09 PM, Adam Barth <w3c@adambarth.com> wrote:
> I'm not sure I quite understand what you mean here. Can you describe
> an experiment that would distinguish these cases? I looked at [1],
> but it was too complicated for me to understand quickly.
>
> Consider the following case:
>
> == Document A ==
> <script>
> Object.prototype.foo = "A1";
> window.location.bar = "A2";
>
> function f() {
> var loc = window.location;
> print(loc.foo); // print is a magic function that lets me see this value
> print(loc.bar);
> }
> </script>
>
> == Document B ==
> <script>
> Object.prototype.foo = "B1";
> window.location.bar = "B2";
> </script>
>
> 1) Document A is displayed in browsing context X.
> 2) Browsing context X is navigated and now displays document B.
> 3) Function f is called.
>
> What values are printed?
>
Under the proposed behavior, both documents share the same Location object.
So when f() is called for on the navigated-away-from scope, loc.bar is "B2"
(assuming that print() is magic enough to get around origin restrictions).
"A2" is cleared on navigation per [3] (check out the automated tests in
Patch 7 in the bug), so if B2 was never set, loc.bar would be undefined.
As for loc.foo, our new implementation would give "B1", because the
Location object has entirely transplanted into the new Document's scope.
This seems sane to me, but it's certainly up for discussion. Matt, can you
add an expando on Object.prototype in your tests and see what happens?
Cheers,
bholley
Received on Friday, 9 November 2012 17:44:33 UTC