New issue
Advanced search Search tips

Issue 695069 link

Starred by 3 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Incorrect behavior of for..in on window

Reported by sandle...@gmail.com, Feb 22 2017

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36

Steps to reproduce the problem:
1. Enter a website that has iframes in it:
https://www.w3schools.com/html/html_iframe.asp

2. Open developer tools, go to console, and run the following:
resultFromObj = Object.getOwnPropertyNames(window)
resultFromFor = []
for (var name in window) {
    resultFromFor.push(name);
}

3. Inspect the results of the commands, using the following commands:
console.log(resultFromObj.indexOf("0") != -1, resultFromObj.indexOf("1") != -1) // Prints false false
console.log(resultFromFor.indexOf("0") != -1, resultFromFor.indexOf("1") != -1) // Prints false false

What is the expected behavior?
Both console.log lines, should return 'true true', which implies that the frames that exist on the page should exist in the resulting arrays.

What went wrong?
Both the for..in loop that was ran, and the Object.getOwnPropertyNames function that was called, did not return the frames that reside inside the window object.
The specific website I've mentioned above, has 2 frames, hence the check for the existance of "0" and "1" in the resulting arrays.
I am reporting this behavior because it does not conform to the defined specifications, which state that both of those enumeration methods, should use [[OwnPropertyKeys]] to get the keys of the object, which should indeed include the frames of the window in it's result.

The specification for [[OwnPropertyKeys]], from which we can tell that the frames should be there is located here:
https://html.spec.whatwg.org/multipage/browsers.html#windowproxy-ownpropertykeys

The specification for the Object.getOwnPropertyNames can be seen here:
https://tc39.github.io/ecma262/#sec-object.getownpropertynames
and subsequently here:
https://tc39.github.io/ecma262/#sec-getownpropertykeys

The specification for the for..in loop is located here:
https://tc39.github.io/ecma262/#sec-enumerate-object-properties

Did this work before? N/A 

Chrome version: 55.0.2883.87  Channel: stable
OS Version: Linux michx 4.9.9-1-ARCH #1 SMP PREEMPT Thu Feb 9 19:07:09 CET 2017 x86_64 GNU/Linux
Flash Version: Shockwave Flash 24.0 r0

Also, from my tests, Mozilla Firefox is already up to spec on this matter, for quite some time.



 
Components: -Blink Blink>JavaScript Blink>Bindings
Cc: jochen@chromium.org

Comment 3 by jochen@chromium.org, Feb 24 2017

Cc: -jochen@chromium.org haraken@chromium.org ca...@igalia.com joc...@chromium.orgm yukishiino@chromium.org
Owner: cbruni@chromium.org

Comment 4 by cbruni@chromium.org, Feb 24 2017

The indexed properties are set non-enumerable:

  Object.getOwnPropertyDescriptor(window, "0")
  >> Object {value: Window, writable: true, enumerable: false, configurable: true}

Hence they will definitely not show up in for-in, will investigate this next week.

Comment 5 by cbruni@chromium.org, Feb 24 2017

Status: Assigned (was: Unconfirmed)
The IndexedPropertyInterceptor is missing the enumerator callback on the V8Window: https://cs.chromium.org/chromium/src/out/Debug/gen/blink/bindings/core/v8/V8Window.cpp?l=7882
Will try to add the enumerator which should fix for-in.
Cc: -yukishiino@chromium.org cbruni@chromium.org
Owner: yukishiino@chromium.org
Assigning over to the bindings team: we should probably add the enumerator and descriptor callback on V8Window (if I understood the code correctly).
Cc: -joc...@chromium.orgm jochen@chromium.org

Sign in to add a comment