784892 - Objects frozen by one frame can be modified by another frame

Status: RESOLVED DUPLICATE of bug 674195

(Core :: JavaScript Engine, defect)

Description

[Felix Lee]

Attachment: a.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.81 Safari/537.1

Steps to reproduce:

load the attached a.html in ff15 (beta) or ff16 (aurora)


Actual results:

an alert that says "true,false,,3".  an object frozen in one frame appears unfrozen to another frame, and the supposedly frozen object can be modified by code in the other frame.


Expected results:

an alert that says "true,true,,".  ff14 (release) behaves correctly.

Comment 1

[Mark S. Miller]

I took the liberty of classifying this as "critical" because it breaks a key security invariant.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Presumably broken by cpg, because now there's a cross-compartment wrapper there?  Looks like bug 674195.