Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2118488d189965301716accec578190bb80af2cd
https://github.com/WebKit/WebKit/commit/2118488d189965301716accec578190bb80af2cd
Author: Chris Dumez <[email protected]>
Date: 2026-08-06 (Thu, 06 Aug 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value-cross-realm-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.serviceworker-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.sharedworker-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.worker-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/html/browsers/windows/embedded-opener-remove-frame-expected.txt
M Source/WebCore/bindings/js/JSDOMCastThisValue.h
Log Message:
-----------
Global object attribute getters/setters throw when called as bare functions
from global scope
https://bugs.webkit.org/show_bug.cgi?id=321066
Reviewed by Darin Adler.
When a global attribute's getter or setter is resolved from the global lexical
environment and invoked as a bare call (e.g. `const f = descriptor.get; f();`),
JSC hands the JSGlobalLexicalEnvironment object itself as the |this| value
rather than undefined (bug 225397, FunctionCallResolveNode passing the resolved
scope as |this|). For ordinary JS-function callees this is normalized away by
the op_to_this prologue, but host functions such as the custom getter/setter
functions have no such prologue, so the raw scope leaked into castThisValue().
There it is neither undefined/null nor a JSGlobalProxy/global object, so the
cast failed and we threw a TypeError ("The Window.location getter can only be
used on instances of Window").
Normalize this in castThisValue() by treating a leaked scope as undefined, which
then substitutes to the global object below. This fixes the getter and setter
paths (which route through IDLAttribute) at a single shared point.
We must not use JSValue::toThis() to do this normalization: a global object
(Window / RemoteDOMWindow) is itself a JSScope, so toThis(strict) would map a
legitimate |this| window to undefined. For a cross-origin access such as
`crossOriginWindow.location`, JSGlobalProxy dispatches the getter/setter with
the target window as |this|; mapping that to undefined would substitute the
caller's global object, reading/writing the wrong window and defeating the
cross-origin security check. Instead we only normalize a scope that is not
itself a global object (i.e. the leaked JSGlobalLexicalEnvironment), leaving
real windows and global proxies untouched.
Covered by imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/
global-object-implicit-this-value.any.html (and its worker, sharedworker, and
serviceworker variants), which now pass the previously-failing "getter/setter
works when called on null / undefined" subtests. Those tests were already
passing in both Chrome and Firefox.
*
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value-cross-realm-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.serviceworker-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.sharedworker-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.worker-expected.txt:
* Source/WebCore/bindings/js/JSDOMCastThisValue.h:
(WebCore::castThisValue):
Canonical link: https://commits.webkit.org/318748@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
