Status: Assigned
Owner: [email protected]
CC: [email protected], [email protected], [email protected]
Labels: Type-Bug Priority-Medium Area-Language
New issue 4289 by [email protected]: Array.prototype.concat's [[Get]] of
@@isConcatSpreadable fails when combined with cross-origin security checks
https://code.google.com/p/v8/issues/detail?id=4289
Consider this test case (also attached):
<iframe style="display:none" src="http://example.com/";
onload="go()"></iframe>
<div id="console"></div>
<script>
function go() {
var console = document.getElementById('console');
var otherWindow = frames[0];
try {
[].concat(otherWindow);
console.innerHTML = 'PASS: no exception thrown';
} catch (e) {
console.innerHTML = 'FAIL: ' + e;
}
}
</script>
Without @@isConcatSpreadable, it prints "PASS", but with
@@isConcatSpreadable it prints "FAIL", because the attempt to look up the
symbol on the window runs afoul of the cross-origin security check.
This could be the root cause of
https://code.google.com/p/chromium/issues/detail?id=507553, though I
haven't traced through that test case to say definitively one way or the
other.
Attachments:
concat-spreadable-window.html 371 bytes
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
