#717 bug
Paul Sowden

Accessing a DOM node from a parent window in a child iframe moves the prototype to the child iframe and resets it in the parent window

Reported by Paul Sowden | June 19th, 2009 @ 12:28 AM

I just reported this bug against Webkit but it also affects Prototype (see https://bugs.webkit.org/show_bug.cgi?id=26520)

If an element is accessed in a child iframe in Webkit it causes the native DOM prototypes to get moved over to the child iframe and if an element is later accessed in the parent iframe then it doesn't inherit the properties from the prototype that Prototype assumes that it does.

As an example, the following page:

<script type="text/javascript" src="/prototype-"></script>

<iframe src="test-prototype-iframe.html"></iframe>
<form onsubmit="try{Form.serialize(this);}catch(e){alert(e);}finally{return false}"><input nama="fda"><input type="submit" name="fdsa"></form>

with the iframe html (test-prototype-iframe.html):

<script type="text/javascript">

window.onload = function (e) {
    top.document.body.addEventListener('mousedown', function (e) {
        var target = e.target;
    }, true);


Will cause an error to be thrown trying to use getValue on a HTMLInputElement (in Webkit) because the original HTMLInputElement's prototype has been moved to the child iframe and a new blank one now exists in the parent.

Comments and changes to this ticket

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

The Prototype JavaScript library.

Shared Ticket Bins