Enumerable cross-origin properties don't seem to be web-compatible

[bzbarsky]

Updating Firefox to #2777 caused a web compat issue: if a cross-origin window makes its way into jQuery.extend, that function will go into an infinite loop. This is turning up as a problem on actual sites. See https://bugzilla.mozilla.org/show_bug.cgi?id=1412741 for details.

I will be backing out the corresponding changes from Firefox.

[bzbarsky]

//cc @domenic @annevk

[bzbarsky]

And @cdumez because he was working on this stuff in WebKit...

[cdumez]

I may be able to reproduce in WebKit ToT. No infinite loops but login fails and I get this error in console:
RangeError: Maximum call stack size exceeded.

[bzbarsky]

Right, I should have said "infinite recursion", not "infinite loop". In Gecko the infinite recursion didn't run out of stack space in the amount of time I was willing to wait...

[domenic]

We'll try to fix this ASAP. Sorry to put everyone through this.

To help us understand: this problem would also occur with a same-origin window, right? It's just bad luck that the code in question is only passing cross-origin windows and expecting them to work?

[bzbarsky]

To help us understand: this problem would also occur with a same-origin window, right?

No, because the recursive step in jQuery.extend only happens for things that test true for Array.isArray or jQuery.isPlainObject. And jQuery.isPlainObject is false for same-origin windows (not least because toString.call( obj ) !== "[object Object]" returns true). But it's true for cross-origin windows, because that test returns false and the object has a null proto. See https://code.jquery.com/jquery-3.2.1.js around line 300.

The problem would occur with an object graph that contains plain objects, has loops, and has non-writable properties so the loops don't get broken by extend() as it traverses the object graph...

[bzbarsky]

Note that after the backout, Firefox will go back to its previous behavior: indexed properties will be enumerable, but other things will not.

[annevk]

@bzbarsky but other things would still be enumerable on same-origin objects, right?

[bzbarsky]

Yes, everything will remain as it was for same-origin objects.

[cdumez]

Will back out change from WebKit as well (https://bugs.webkit.org/show_bug.cgi?id=179117).