Created attachment 344453 [details] test case Scenario: base page with one same-origin IFRAME base page creates an XMLHttpRequest instance Issue: If the IFRAME adds a `readystatechange` listener to the XMLHttpRequest instance, and it reads the response getter before the `top` context does, the `constructor` of the object will be equivalent to `iframe.contentWindow.Object`, not `top.Object`. This "works" in other browsers, including Safari 10.0.1. Works in 604.5.6. Fails in 605.1.15. Code executed in the IFRAME: xhr.addEventListener('readystatechange', function(){ xhr.response }) From this point forward: xhr.response.constructor === iframe.contentWindow.Object xhr.response.constructor !== top.Object See https://cvazac.netlify.com/xhr-response-constructor/ for reproducible case.
<rdar://problem/41920593>
I attempted to bisect the issue using: ./Tools/Scripts/bisect-builds -c release -p mac-highsierra -s 219162 -e 224949 But every build that attempts to launch gives me: Starting SafariForWebKitDevelopment with DYLD_FRAMEWORK_PATH set to point to built WebKit in /var/folders/33/prqh7l5n7fgd1l6d3kq6bq_r0000gy/T/tmpK9xc8x/Release. dyld: Symbol not found: __ZN3WTF8JSONImpl10ObjectBase6removeERKNS_6StringE Referenced from: /System/Library/PrivateFrameworks/WebInspector.framework/Versions/A/WebInspector Expected in: /var/folders/33/prqh7l5n7fgd1l6d3kq6bq_r0000gy/T/tmpK9xc8x/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore in /System/Library/PrivateFrameworks/WebInspector.framework/Versions/A/WebInspector
Yes, these WebKit revisions are so old that they don't work with latest Safari. I bisected to r219757. Sam, Chris, could you take a look?
Likely caused by us caching the response in the wrapper.
Created attachment 345483 [details] Patch
Comment on attachment 345483 [details] Patch ping review?
Comment on attachment 345483 [details] Patch Clearing flags on attachment: 345483 Committed r234188: <https://trac.webkit.org/changeset/234188>
All reviewed patches have been landed. Closing bug.