Repository navigation
Enumerable cross-origin properties don't seem to be web-compatible #3183
Description
Updating Firefox to #2777 caused a web compat issue: if a cross-origin window makes its way into jQuery.extend, that function will go into an infinite loop. This is turning up as a problem on actual sites. See https://bugzilla.mozilla.org/show_bug.cgi?id=1412741 for details.
I will be backing out the corresponding changes from Firefox.
Activity
bzbarsky commentedon Oct 31, 2017
//cc @domenic @annevk
bzbarsky commentedon Oct 31, 2017
And @cdumez because he was working on this stuff in WebKit...
cdumez commentedon Oct 31, 2017
I may be able to reproduce in WebKit ToT. No infinite loops but login fails and I get this error in console:
RangeError: Maximum call stack size exceeded.
bzbarsky commentedon Oct 31, 2017
Right, I should have said "infinite recursion", not "infinite loop". In Gecko the infinite recursion didn't run out of stack space in the amount of time I was willing to wait...
domenic commentedon Oct 31, 2017
We'll try to fix this ASAP. Sorry to put everyone through this.
To help us understand: this problem would also occur with a same-origin window, right? It's just bad luck that the code in question is only passing cross-origin windows and expecting them to work?
bzbarsky commentedon Oct 31, 2017
No, because the recursive step in
jQuery.extendonly happens for things that test true forArray.isArrayorjQuery.isPlainObject. AndjQuery.isPlainObjectis false for same-origin windows (not least becausetoString.call( obj ) !== "[object Object]"returns true). But it's true for cross-origin windows, because that test returns false and the object has a null proto. See https://code.jquery.com/jquery-3.2.1.js around line 300.The problem would occur with an object graph that contains plain objects, has loops, and has non-writable properties so the loops don't get broken by
extend()as it traverses the object graph...bzbarsky commentedon Oct 31, 2017
Note that after the backout, Firefox will go back to its previous behavior: indexed properties will be enumerable, but other things will not.
annevk commentedon Nov 1, 2017
@bzbarsky but other things would still be enumerable on same-origin objects, right?
bzbarsky commentedon Nov 1, 2017
Yes, everything will remain as it was for same-origin objects.
cdumez commentedon Nov 1, 2017
Will back out change from WebKit as well (https://bugs.webkit.org/show_bug.cgi?id=179117).
Regression(r219659): Can no longer log into ifttt.com using Google ac…
Enumerate less cross-origin properties
Enumerate fewer cross-origin properties
Enumerate fewer cross-origin properties
Regression(r219659): Can no longer log into ifttt.com using Google ac…