Window's [[Get]] can fail an assert

[bzbarsky]

Consider this testcase, where "win" is a cross-origin window with no subframes:

win[1000];

What happens? We land in https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-get and:

1. W is the window, fine.
2. IsPlatformObjectSameOrigin returns false.
3. Call CrossOriginGet.

So that calls https://html.spec.whatwg.org/multipage/browsers.html#crossoriginget-(-o,-p,-receiver-) which does:

1. Let desc be ? O.[[GetOwnProperty]](P).
2. Assert: desc is not undefined.

OK, so what happened under [[GetOwnProperty]]? It called https://html.spec.whatwg.org/multipage/window-object.html#windowproxy-getownproperty and did:

1. W is the window.
2. P is an array index property name.
   2.1 index is 1000.
   2.2 maxProperties is 0.
   2.3 value is undefined.
   2.4 maxProperties is not greater than 0.
   2.5 value is undefined, so return undefined.

So it sure looks to me like we would fail that "desc is not undefined" assert.

[bzbarsky]

@annevk @domenic

[bzbarsky]

Looks like [[Set]] has the same issue at https://html.spec.whatwg.org/multipage/browsers.html#crossoriginset-(-o,-p,-v,-receiver-) step 2.

[bzbarsky]

Testing browsers, what they seem to do is that step 2.5 of [[GetOwnProperty]] throws a SecurityError, as far as I can tell. It looks like we don't have tests for this case in wpt; I'll try to add some.

[bzbarsky]

what they seem to do is that step 2.5 of [[GetOwnProperty]] throws a SecurityError, as far as I can tell

When IsPlatformObjectSameOrigin is false, that is. When it's true, [[GetOwnProperty]] can in fact return undefined for out-of-range indexed props, and that's OK.