1813499 - Element prototype modified by appending it into iframe

Status: RESOLVED DUPLICATE of bug 1470017

(Core :: DOM: Core & HTML, defect)

Description

[Samuel Degueldre]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36

Steps to reproduce:

iframe = document.createElement("iframe");
document.body.appendChild(iframe);
div = document.createElement("div");
HTMLElement.prototype.test = 2;
console.log(div.test);
iframe.contentDocument.body.appendChild(div);
console.log(div.test);
console.log(div instanceof HTMLElement)
console.log(div instanceof iframe.contentDocument.defaultView.HTMLElement)

Actual results:

These are the logs of the previous snippet:
2
undefined
false
true

Expected results:

This is what I expected to be logged, and also the behaviour in firefox 108 (and chrome):
2
2
true
false

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Core & HTML' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

peterv: Do you have any ideas about this?

Comment 4

[Samuel Degueldre]

I was under the incorrect impression that this was a regression introduced by firefox 108 but it was a result from my incorrect testing. I can confirm that this behaviour is in fact not new and I don't have a strong opinion on whether this should be changed, please disregard.