DO NOT SUBMIT.

DO NOT SUBMIT.

This is a demonstration of the V8 (?) bug I'm running into at https://code.google.com/p/v8/issues/detail?id=2524.

Not for landing, just for discussion.

[Mike West, 2013-07-09 10:07:54]

Hi Yang. :)

This is a minimal reproduction of the bug I'm running into at
https://code.google.com/p/v8/issues/detail?id=2524. It's probably just as
productive for you to look at these results as it is for me to show them to you
manually.

[Mike West, 2013-07-09 10:09:51]

One helpful note.

https://codereview.chromium.org/18661005/diff/1/LayoutTests/http/tests/securi...
File
LayoutTests/http/tests/security/cross-frame-access-location-get-v8-expected.txt
(right):

https://codereview.chromium.org/18661005/diff/1/LayoutTests/http/tests/securi...
LayoutTests/http/tests/security/cross-frame-access-location-get-v8-expected.txt:2:
CONSOLE MESSAGE: line 24: document.write threw exception of type SecurityError
The exception type here matches the exception type thrown in V8Initializer. I
changed it to "SyntaxError", for example, and this exception changed as well.
That's a bit strange.

[Yang, 2013-07-09 14:09:51]

On 2013/07/09 10:09:51, Mike West (on paternity leave) wrote:
> One helpful note.
> 
>
https://codereview.chromium.org/18661005/diff/1/LayoutTests/http/tests/securi...
> File
>
LayoutTests/http/tests/security/cross-frame-access-location-get-v8-expected.txt
> (right):
> 
>
https://codereview.chromium.org/18661005/diff/1/LayoutTests/http/tests/securi...
>
LayoutTests/http/tests/security/cross-frame-access-location-get-v8-expected.txt:2:
> CONSOLE MESSAGE: line 24: document.write threw exception of type SecurityError
> The exception type here matches the exception type thrown in V8Initializer. I
> changed it to "SyntaxError", for example, and this exception changed as well.
> That's a bit strange.

There is no (longer?) a SecurityError in ExceptionCode.h. I'm changing it to
SECURITY_ERR. Let's see what happens.

[Mike West, 2013-07-09 14:31:44]

On 2013/07/09 14:09:51, Yang wrote:
> On 2013/07/09 10:09:51, Mike West (on paternity leave) wrote:
> > One helpful note.
> > 
> >
>
https://codereview.chromium.org/18661005/diff/1/LayoutTests/http/tests/securi...
> > File
> >
>
LayoutTests/http/tests/security/cross-frame-access-location-get-v8-expected.txt
> > (right):
> > 
> >
>
https://codereview.chromium.org/18661005/diff/1/LayoutTests/http/tests/securi...
> >
>
LayoutTests/http/tests/security/cross-frame-access-location-get-v8-expected.txt:2:
> > CONSOLE MESSAGE: line 24: document.write threw exception of type
SecurityError
> > The exception type here matches the exception type thrown in V8Initializer.
I
> > changed it to "SyntaxError", for example, and this exception changed as
well.
> > That's a bit strange.
> 
> There is no (longer?) a SecurityError in ExceptionCode.h. I'm changing it to
> SECURITY_ERR. Let's see what happens.

SECURITY_ERR changed to SecurityError in
https://codereview.chromium.org/18548003/, which landed yesterday. CodeSearch
hasn't caught up, and you might not have updated your checkout yet. The enum
name isn't the problem, I promise. :)

[Yang, 2013-07-09 14:34:03]

On 2013/07/09 14:31:44, Mike West (on paternity leave) wrote:
> On 2013/07/09 14:09:51, Yang wrote:
> > On 2013/07/09 10:09:51, Mike West (on paternity leave) wrote:
> > > One helpful note.
> > > 
> > >
> >
>
https://codereview.chromium.org/18661005/diff/1/LayoutTests/http/tests/securi...
> > > File
> > >
> >
>
LayoutTests/http/tests/security/cross-frame-access-location-get-v8-expected.txt
> > > (right):
> > > 
> > >
> >
>
https://codereview.chromium.org/18661005/diff/1/LayoutTests/http/tests/securi...
> > >
> >
>
LayoutTests/http/tests/security/cross-frame-access-location-get-v8-expected.txt:2:
> > > CONSOLE MESSAGE: line 24: document.write threw exception of type
> SecurityError
> > > The exception type here matches the exception type thrown in
V8Initializer.
> I
> > > changed it to "SyntaxError", for example, and this exception changed as
> well.
> > > That's a bit strange.
> > 
> > There is no (longer?) a SecurityError in ExceptionCode.h. I'm changing it to
> > SECURITY_ERR. Let's see what happens.
> 
> SECURITY_ERR changed to SecurityError in
> https://codereview.chromium.org/18548003/, which landed yesterday. CodeSearch
> hasn't caught up, and you might not have updated your checkout yet. The enum
> name isn't the problem, I promise. :)

Tests run as expected.

So I guess the thing that's not working is that the exception is delayed
somehow? Instead of triggering the first try-catch in v9.html, it triggers in
the second one.

[Mike West, 2013-07-09 14:38:19]

On 2013/07/09 14:34:03, Yang wrote:

> Tests run as expected.

Right; I should have explained this better. The expectations represent the
behavior with the patch. They are not the behavior I'd expect.

> So I guess the thing that's not working is that the exception is delayed
> somehow? Instead of triggering the first try-catch in v9.html, it triggers in
> the second one.

Correct. In both tests, accessing the property on the location object should
throw the exception, which should be caught in the initial try/catch block. The
next try/catch block should not throw an exception. `document.write()` and
`document.getElementById.innerText` should both just work.

Currently, no exception is thrown for the property access, but the next
JavaScript statement throws the exception that should have been thrown in the
first block.

Does that make sense? I can show it to you tomorrow if not. :)

[Yang, 2013-07-09 14:41:50]

On 2013/07/09 14:38:19, Mike West (on paternity leave) wrote:
> On 2013/07/09 14:34:03, Yang wrote:
> 
> > Tests run as expected.
> 
> Right; I should have explained this better. The expectations represent the
> behavior with the patch. They are not the behavior I'd expect.
> 
> > So I guess the thing that's not working is that the exception is delayed
> > somehow? Instead of triggering the first try-catch in v9.html, it triggers
in
> > the second one.
> 
> Correct. In both tests, accessing the property on the location object should
> throw the exception, which should be caught in the initial try/catch block.
The
> next try/catch block should not throw an exception. `document.write()` and
> `document.getElementById.innerText` should both just work.
> 
> Currently, no exception is thrown for the property access, but the next
> JavaScript statement throws the exception that should have been thrown in the
> first block.
> 
> Does that make sense? I can show it to you tomorrow if not. :)

Totally makes sense. I'll try to create a purely V8 repro.

[Mike West, 2013-07-09 14:44:50]

On 2013/07/09 14:41:50, Yang wrote:

> Totally makes sense. I'll try to create a purely V8 repro.

Thank you for looking into it. I appreciate the effort. :)