Status: Untriaged
Owner: ----
New issue 4234 by [email protected]: Wrapper created from wrong
realm (SHOULD_CREATE_WRAPPER built-in)
https://code.google.com/p/v8/issues/detail?id=4234
Version: 7142b0d211b732e1c119fded80f43fbbd9cea0f8
What steps will reproduce the problem?
1. Run in d8
d8> realmIndex = Realm.create();
d8> Realm.eval(realmIndex, "Array.prototype.map").call([null], function(){
return this }, 123)[0] instanceof Number
What is the expected output?
- Returns true
What do you see instead?
- Returns false
This issue can also be reproduced with other methods, e.g.
Array.prototype.filter, Array.prototype.forEach, Set.prototype.forEach, etc.
html test case:
---
<!doctype html>
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
</head>
<body>
<iframe id="iframe"></iframe>
<script type="text/javascript">
(function(){
var global = window;
var otherGlobal = document.getElementById("iframe").contentWindow;
alert(otherGlobal.eval("Array.prototype.map").call([null], function(){
return this }, 123)[0] instanceof Number);
})();
</script>
</body>
</html>
---
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
