1525355 - Clear out the cross-origin function weakmap from the windowproxy slot before transplanting

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement)

Description

[Boris Zbarsky [:bzbarsky]]

The map in question, per spec, uses a key that is a combination of "current Realm" and "Realm of the Window object".

We optimize out the latter by having the weakmap live in a slot on the WindowProxy, having it be same-realm as the WindowProxy, and having the WindowProxy be same-realm with the Window.

OK, so what happens on navigation? We create a new WindowProxy (different Realm) and then transplant the old one and the new one. I can't tell what happens to slots when we do this, but the desired behavior is that the resulting WindowProxy object should have no weakmap hanging off it, because the new global has nothing cached for it yet. Modulo bug 1525354.

Anyway, the safe thing to do here is to empty out the slot prior to transplanting.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Bug 1525355. Make sure to clear out the cached-function-map slot on WindowProxy before we transplant it. r=peterv

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b7646b8ccfd3
Make sure to clear out the cached-function-map slot on WindowProxy before we transplant it.  r=peterv

Comment 3

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/b7646b8ccfd3