Cross-origin objects: symbol properties are not enumerable #6583

annevk · 2017-07-19T12:13:00Z

Second follow-up for #6538.

w3c-bots · 2017-07-19T12:24:53Z

Firefox (nightly)

Testing web-platform-tests at revision c7f4b7f
Using browser at version BuildID 20170719100147; SourceStamp 1b065ffd8a535a0ad4c39a912af18e948e6a42c1
Starting 10 test iterations
All results were stable

All results

2 tests ran

/html/browsers/origin/cross-origin-objects/cross-origin-objects.html

Subtest	Results	Messages
	OK
`Basic sanity-checking`	PASS
`Only whitelisted properties are accessible cross-origin`	PASS
`[[GetPrototypeOf]] should return null`	PASS
`[[SetPrototypeOf]] should return false`	PASS
`[[IsExtensible]] should return true for cross-origin objects`	PASS
`[[PreventExtensions]] should throw for cross-origin objects`	PASS
`[[GetOwnProperty]] - Properties on cross-origin objects should be reported \|own\|`	PASS
`[[GetOwnProperty]] - Property descriptors for cross-origin properties should be set up correctly`	FAIL	`assert_equals: property descriptor for 0 should be enumerable expected true but got false`
`[[Delete]] Should throw on cross-origin objects`	PASS
`[[DefineOwnProperty]] Should throw for cross-origin objects`	PASS
`Can only enumerate safelisted properties`	FAIL	`assert_equals: Enumerate all safelisted cross-origin Window properties expected 15 but got 0`
`[[OwnPropertyKeys]] should return all properties from cross-origin objects`	FAIL	`assert_array_equals: Object.keys() gives the right answer for cross-origin Window lengths differ, expected 15 got 0`
`[[OwnPropertyKeys]] should return the right symbol-named properties for cross-origin objects`	PASS
`[[OwnPropertyKeys]] should place the symbols after the property names after the subframe indices`	PASS
`A and B jointly observe the same identity for cross-origin Window and Location`	PASS
`Cross-origin functions get local Function.prototype`	PASS
`Cross-origin Window accessors get local Function.prototype`	PASS
`Same-origin observers get different functions for cross-origin objects`	PASS
`Same-origin observers get different accessors for cross-origin Window`	PASS
`Same-origin observers get different accessors for cross-origin Location`	PASS
`{}.toString.call() does the right thing on cross-origin objects`	PASS

/html/browsers/the-window-object/window-indexed-properties.html

Subtest	Results	Messages
	OK
`Indexed properties of the window object (non-strict mode)`	PASS
`Ensure indexed properties have the correct configuration`	PASS
`Indexed properties of the window object (non-strict mode) 1`	PASS
`Indexed properties of the window object (non-strict mode) 2`	PASS
`Indexed properties of the window object (non-strict mode) 3`	PASS

w3c-bots · 2017-07-19T12:24:53Z

View the complete job log.

Sauce (safari)

Testing web-platform-tests at revision c7f4b7f
Using browser at version 10.0
Starting 10 test iterations
All results were stable

All results

2 tests ran

/html/browsers/origin/cross-origin-objects/cross-origin-objects.html

Subtest	Results	Messages
	OK
`Basic sanity-checking`	FAIL	`assert_throws: location.pathname throws cross-origin function "function () { C.location.pathname; }" did not throw`
`Only whitelisted properties are accessible cross-origin`	FAIL	`assert_throws: Should throw when accessing testList on Window function "function () { C[prop]; }" did not throw`
`[[GetPrototypeOf]] should return null`	FAIL	`assert_true: cross-origin Window proto is null expected true got false`
`[[SetPrototypeOf]] should return false`	FAIL	`assert_throws: proto set on cross-origin Window function "function () { C.__proto__ = new Object(); }" did not throw`
`[[IsExtensible]] should return true for cross-origin objects`	PASS
`[[PreventExtensions]] should throw for cross-origin objects`	FAIL	`assert_throws: preventExtensions on cross-origin Window should throw function "function () { Object.preventExtensions(C) }" did not throw`
`[[GetOwnProperty]] - Properties on cross-origin objects should be reported \|own\|`	PASS
`[[GetOwnProperty]] - Property descriptors for cross-origin properties should be set up correctly`	FAIL	`assert_equals: property descriptor for 0 should be configurable expected true but got false`
`[[Delete]] Should throw on cross-origin objects`	FAIL	`assert_throws: Can't delete cross-origin indexed property function "function () { delete C[0]; }" did not throw`
`[[DefineOwnProperty]] Should throw for cross-origin objects`	FAIL	`assert_throws: Can't define cross-origin value property length function "function () { Object.defineProperty(obj, prop, valueDesc); }" did not throw`
`Can only enumerate safelisted properties`	FAIL	`assert_equals: Enumerate all safelisted cross-origin Window properties expected 15 but got 0`
`[[OwnPropertyKeys]] should return all properties from cross-origin objects`	FAIL	`assert_array_equals: Object.getOwnPropertyNames() gives the right answer for cross-origin Window lengths differ, expected 15 got 0`
`[[OwnPropertyKeys]] should return the right symbol-named properties for cross-origin objects`	FAIL	`assert_array_equals: Object.getOwnPropertySymbols() should return the three symbol-named properties that are exposed on a cross-origin Window lengths differ, expected 3 got 0`
`[[OwnPropertyKeys]] should place the symbols after the property names after the subframe indices`	FAIL	`assert_array_equals: Reflect.ownKeys should start with the indices exposed on the cross-origin window. lengths differ, expected 2 got 0`
`A and B jointly observe the same identity for cross-origin Window and Location`	PASS
`Cross-origin functions get local Function.prototype`	PASS
`Cross-origin Window accessors get local Function.prototype`	FAIL	`undefined is not an object (evaluating 'f.name')`
`Same-origin observers get different functions for cross-origin objects`	PASS
`Same-origin observers get different accessors for cross-origin Window`	FAIL	`assert_true: different Window accessors per-incumbent script settings object expected true got false`
`Same-origin observers get different accessors for cross-origin Location`	FAIL	`assert_true: different Location accessors per-incumbent script settings object expected true got false`
`{}.toString.call() does the right thing on cross-origin objects`	FAIL	`assert_equals: expected "[object Object]" but got "[object Window]"`

/html/browsers/the-window-object/window-indexed-properties.html

Subtest	Results	Messages
	OK
`Indexed properties of the window object (non-strict mode)`	PASS
`Ensure indexed properties have the correct configuration`	FAIL	`assert_true: expected true got false`
`Indexed properties of the window object (non-strict mode) 1`	FAIL	`assert_throws: function "() => Object.defineProperty(window, 0, { value: "bar" })" did not throw`
`Indexed properties of the window object (non-strict mode) 2`	FAIL	`assert_throws: function "() => Object.defineProperty(window, 1, { value: "bar" })" did not throw`
`Indexed properties of the window object (non-strict mode) 3`	PASS

w3c-bots · 2017-07-19T12:24:54Z

View the complete job log.

Chrome (unstable)

Testing web-platform-tests at revision c7f4b7f
Using browser at version 61.0.3159.5 dev
Starting 10 test iterations
All results were stable

All results

2 tests ran

/html/browsers/origin/cross-origin-objects/cross-origin-objects.html

Subtest	Results	Messages
	OK
`Basic sanity-checking`	PASS
`Only whitelisted properties are accessible cross-origin`	PASS
`[[GetPrototypeOf]] should return null`	PASS
`[[SetPrototypeOf]] should return false`	FAIL	`assert_throws: proto setter \|call\| on cross-origin Window function "function () { protoSetter.call(C, new Object()); }" threw object "SecurityError: Blocked a frame with origin "http://web-platform.test:8000" from accessing a cross-origin frame." ("SecurityError") expected object "TypeError" ("TypeError")`
`[[IsExtensible]] should return true for cross-origin objects`	PASS
`[[PreventExtensions]] should throw for cross-origin objects`	FAIL	`assert_throws: preventExtensions on cross-origin Window should throw function "function () { Object.preventExtensions(C) }" threw object "SecurityError: Blocked a frame with origin "http://web-platform.test:8000" from accessing a cross-origin frame." ("SecurityError") expected object "TypeError" ("TypeError")`
`[[GetOwnProperty]] - Properties on cross-origin objects should be reported \|own\|`	FAIL	`Blocked a frame with origin "http://web-platform.test:8000" from accessing a cross-origin frame.`
`[[GetOwnProperty]] - Property descriptors for cross-origin properties should be set up correctly`	FAIL	`assert_equals: property descriptor for 0 should be enumerable expected true but got false`
`[[Delete]] Should throw on cross-origin objects`	PASS
`[[DefineOwnProperty]] Should throw for cross-origin objects`	PASS
`Can only enumerate safelisted properties`	FAIL	`assert_equals: Enumerate all safelisted cross-origin Window properties expected 15 but got 0`
`[[OwnPropertyKeys]] should return all properties from cross-origin objects`	FAIL	`assert_array_equals: Object.getOwnPropertyNames() gives the right answer for cross-origin Window lengths differ, expected 15 got 13`
`[[OwnPropertyKeys]] should return the right symbol-named properties for cross-origin objects`	FAIL	`assert_array_equals: Object.getOwnPropertySymbols() should return the three symbol-named properties that are exposed on a cross-origin Window lengths differ, expected 3 got 0`
`[[OwnPropertyKeys]] should place the symbols after the property names after the subframe indices`	FAIL	`assert_array_equals: Reflect.ownKeys should start with the indices exposed on the cross-origin window. property 0, expected "0" but got "window"`
`A and B jointly observe the same identity for cross-origin Window and Location`	PASS
`Cross-origin functions get local Function.prototype`	PASS
`Cross-origin Window accessors get local Function.prototype`	FAIL	`Cannot read property 'name' of undefined`
`Same-origin observers get different functions for cross-origin objects`	FAIL	`assert_true: same-origin Window functions get their own object expected true got false`
`Same-origin observers get different accessors for cross-origin Window`	FAIL	`assert_true: different Window accessors per-incumbent script settings object expected true got false`
`Same-origin observers get different accessors for cross-origin Location`	FAIL	`Blocked a frame with origin "http://web-platform.test:8000" from accessing a cross-origin frame.`
`{}.toString.call() does the right thing on cross-origin objects`	FAIL	`assert_equals: expected "[object Object]" but got "[object Location]"`

/html/browsers/the-window-object/window-indexed-properties.html

Subtest	Results	Messages
	OK
`Indexed properties of the window object (non-strict mode)`	PASS
`Ensure indexed properties have the correct configuration`	FAIL	`assert_true: expected true got false`
`Indexed properties of the window object (non-strict mode) 1`	FAIL	`assert_equals: expected false but got true`
`Indexed properties of the window object (non-strict mode) 2`	PASS
`Indexed properties of the window object (non-strict mode) 3`	PASS

w3c-bots · 2017-07-19T12:24:54Z

View the complete job log.

Sauce (MicrosoftEdge)

Testing web-platform-tests at revision c7f4b7f
Using browser at version 14.14393
Starting 10 test iterations
All results were stable

All results

2 tests ran

/html/browsers/origin/cross-origin-objects/cross-origin-objects.html

Subtest	Results	Messages
	OK
`Basic sanity-checking`	FAIL	`assert_throws: location.pathname throws cross-origin function "function () { C.location.pathname; }" threw object "Error: Permission denied" that is not a DOMException SecurityError: property "code" is equal to undefined, expected 18`
`Only whitelisted properties are accessible cross-origin`	FAIL	`assert_throws: Should throw when accessing chrome on Window function "function () { C[prop]; }" threw object "TypeError: Permission denied" that is not a DOMException SecurityError: property "code" is equal to undefined, expected 18`
`[[GetPrototypeOf]] should return null`	FAIL	`assert_throws: __proto__ property not available cross-origin function "function () { C.__proto__; }" threw object "TypeError: Permission denied" that is not a DOMException SecurityError: property "code" is equal to undefined, expected 18`
`[[SetPrototypeOf]] should return false`	FAIL	`assert_throws: proto set on cross-origin Window function "function () { C.__proto__ = new Object(); }" threw object "TypeError: Permission denied" that is not a DOMException SecurityError: property "code" is equal to undefined, expected 18`
`[[IsExtensible]] should return true for cross-origin objects`	FAIL	`assert_true: cross-origin Location should be extensible expected true got false`
`[[PreventExtensions]] should throw for cross-origin objects`	FAIL	`assert_throws: preventExtensions on cross-origin Window should throw function "function () { Object.preventExtensions(C) }" did not throw`
`[[GetOwnProperty]] - Properties on cross-origin objects should be reported \|own\|`	FAIL	`Permission denied`
`[[GetOwnProperty]] - Property descriptors for cross-origin properties should be set up correctly`	FAIL	`Permission denied`
`[[Delete]] Should throw on cross-origin objects`	FAIL	`assert_throws: Can't delete cross-origin indexed property function "function () { delete C[0]; }" threw object "TypeError: Permission denied" that is not a DOMException SecurityError: property "code" is equal to undefined, expected 18`
`[[DefineOwnProperty]] Should throw for cross-origin objects`	FAIL	`assert_throws: Can't define cross-origin value property length function "function () { Object.defineProperty(obj, prop, valueDesc); }" threw object "TypeError: Permission denied" that is not a DOMException SecurityError: property "code" is equal to undefined, expected 18`
`Can only enumerate safelisted properties`	FAIL	`Permission denied`
`[[OwnPropertyKeys]] should return all properties from cross-origin objects`	FAIL	`Permission denied`
`[[OwnPropertyKeys]] should return the right symbol-named properties for cross-origin objects`	FAIL	`Permission denied`
`[[OwnPropertyKeys]] should place the symbols after the property names after the subframe indices`	FAIL	`Permission denied`
`A and B jointly observe the same identity for cross-origin Window and Location`	PASS
`Cross-origin functions get local Function.prototype`	PASS
`Cross-origin Window accessors get local Function.prototype`	FAIL	`Permission denied`
`Same-origin observers get different functions for cross-origin objects`	PASS
`Same-origin observers get different accessors for cross-origin Window`	FAIL	`Permission denied`
`Same-origin observers get different accessors for cross-origin Location`	FAIL	`Object doesn't support this action`
`{}.toString.call() does the right thing on cross-origin objects`	FAIL	`assert_equals: expected "[object Object]" but got "[object Window]"`

/html/browsers/the-window-object/window-indexed-properties.html

Subtest	Results	Messages
	OK
`Indexed properties of the window object (non-strict mode)`	PASS
`Ensure indexed properties have the correct configuration`	FAIL	`assert_false: expected false got true`
`Indexed properties of the window object (non-strict mode) 1`	FAIL	`assert_throws: function "() => Object.defineProperty(window, 0, { value: "bar" })" did not throw`
`Indexed properties of the window object (non-strict mode) 2`	FAIL	`assert_throws: function "() => Object.defineProperty(window, 1, { value: "bar" })" did not throw`
`Indexed properties of the window object (non-strict mode) 3`	PASS

bzbarsky · 2017-07-19T13:45:16Z

Looks good, thank you!

annevk · 2017-07-19T14:10:07Z

Added a test for same-origin indexed properties now. Finds bugs in Chrome and Safari.

annevk · 2017-07-19T14:12:21Z

Filed https://bugs.webkit.org/show_bug.cgi?id=174649 and https://bugs.chromium.org/p/chromium/issues/detail?id=746418.

…le. r=bholley The list of exposed properties can be gotten via Object.getOwnPropertyNames/Symbols already, so there's nothing to be won from the non-enumerability. The web platform test changes are backports of web-platform-tests/wpt#6538 and web-platform-tests/wpt#6571 and web-platform-tests/wpt#6583 The js/xpconnect/tests/mochitest/*crossOriginObject* tests being removed are just older versions of the web platfrom test.

cdumez

LGTM

…le. r=bholley The list of exposed properties can be gotten via Object.getOwnPropertyNames/Symbols already, so there's nothing to be won from the non-enumerability. The web platform test changes are backports of web-platform-tests/wpt#6538 and web-platform-tests/wpt#6571 and web-platform-tests/wpt#6583 The js/xpconnect/tests/mochitest/*crossOriginObject* tests being removed are just older versions of the web platfrom test.

…le. r=bholley The list of exposed properties can be gotten via Object.getOwnPropertyNames/Symbols already, so there's nothing to be won from the non-enumerability. The web platform test changes are backports of web-platform-tests/wpt#6538 and web-platform-tests/wpt#6571 and web-platform-tests/wpt#6583 The js/xpconnect/tests/mochitest/*crossOriginObject* tests being removed are just older versions of the web platfrom test. UltraBlame original commit: be396a7cf55b4a3faebb5ac0f053cfca22199686

Cross-origin objects: symbol properties are not enumerable

6875ece

Second follow-up for #6538.

annevk requested review from cdumez and bzbarsky July 19, 2017 12:13

wpt-pr-bot added the html label Jul 19, 2017

wpt-pr-bot requested review from jdm, jgraham, zcorpan and zqzhang July 19, 2017 12:13

annevk mentioned this pull request Jul 19, 2017

"Cross-origin objects" are to have enumerable properties #6538

Merged

Also test indexed properties same-origin

e57123e

cdumez approved these changes Jul 19, 2017

View reviewed changes

cdumez merged commit 6ed8b83 into master Jul 19, 2017

annevk deleted the annevk/cross-origin-symbol-properties branch July 19, 2017 16:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cross-origin objects: symbol properties are not enumerable #6583

Cross-origin objects: symbol properties are not enumerable #6583

annevk commented Jul 19, 2017 •

edited by wpt-pr-bot

w3c-bots commented Jul 19, 2017 •

edited

w3c-bots commented Jul 19, 2017 •

edited

w3c-bots commented Jul 19, 2017 •

edited

w3c-bots commented Jul 19, 2017 •

edited

bzbarsky commented Jul 19, 2017

annevk commented Jul 19, 2017

annevk commented Jul 19, 2017

cdumez left a comment

Cross-origin objects: symbol properties are not enumerable #6583

Cross-origin objects: symbol properties are not enumerable #6583

Conversation

annevk commented Jul 19, 2017 • edited by wpt-pr-bot

w3c-bots commented Jul 19, 2017 • edited

Firefox (nightly)

All results

w3c-bots commented Jul 19, 2017 • edited

Sauce (safari)

All results

w3c-bots commented Jul 19, 2017 • edited

Chrome (unstable)

All results

w3c-bots commented Jul 19, 2017 • edited

Sauce (MicrosoftEdge)

All results

bzbarsky commented Jul 19, 2017

annevk commented Jul 19, 2017

annevk commented Jul 19, 2017

cdumez left a comment

Choose a reason for hiding this comment

annevk commented Jul 19, 2017 •

edited by wpt-pr-bot

w3c-bots commented Jul 19, 2017 •

edited

w3c-bots commented Jul 19, 2017 •

edited

w3c-bots commented Jul 19, 2017 •

edited

w3c-bots commented Jul 19, 2017 •

edited