Bug 1525355 Comment 0 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

The map in question, per spec, uses a key that is a combination of "current Realm" and "Realm of the Window object".

We optimize out the latter by having the weakmap live in a slot on the WindowProxy, having it be same-realm as the WindowProxy, and having the WindowProxy be same-realm with the Window.

OK, so what happens on navigation?  We create a new WindowProxy (different Realm) and then transplant the old one and the new one.  I can't tell what happens to slots when we do this, but the desired behavior is that the resulting WindowProxy object should have no weakmap hanging off it, because the new global has nothing cached for it yet.  Modulo bug 1525354.

Anyway, the safe thing to do here is to null out the slot prior to transplanting.
The map in question, per spec, uses a key that is a combination of "current Realm" and "Realm of the Window object".

We optimize out the latter by having the weakmap live in a slot on the WindowProxy, having it be same-realm as the WindowProxy, and having the WindowProxy be same-realm with the Window.

OK, so what happens on navigation?  We create a new WindowProxy (different Realm) and then transplant the old one and the new one.  I can't tell what happens to slots when we do this, but the desired behavior is that the resulting WindowProxy object should have no weakmap hanging off it, because the new global has nothing cached for it yet.  Modulo bug 1525354.

Anyway, the safe thing to do here is to empty out the slot prior to transplanting.

Back to Bug 1525355 Comment 0