doc(script): we don't do cross-compartment brain transplantation anymore

This commit is contained in:
yvt 2021-07-07 22:21:26 +09:00
parent 5871d09c26
commit d597264d1b

View file

@ -637,13 +637,11 @@ impl WindowProxy {
// The old window proxy no longer owns this browsing context. // The old window proxy no longer owns this browsing context.
SetProxyReservedSlot(old_js_proxy.get(), 0, &PrivateValue(ptr::null_mut())); SetProxyReservedSlot(old_js_proxy.get(), 0, &PrivateValue(ptr::null_mut()));
// Brain transpant the window proxy. // Brain transpant the window proxy. Brain transplantation is
// We need to do this, because the Window and WindowProxy // usually done to move a window proxy between compartments, but
// objects need to be in the same realm. // that's not what we are doing here. We need to do this just
// JS_TransplantObject does this by copying the contents // because we want to replace the wrapper's `ProxyTraps`, but we
// of the old window proxy to the new window proxy, then // don't want to update its identity.
// making the old window proxy a cross-realm wrapper
// pointing to the new window proxy.
rooted!(in(*cx) let new_js_proxy = NewWindowProxy(*cx, window_jsobject, handler)); rooted!(in(*cx) let new_js_proxy = NewWindowProxy(*cx, window_jsobject, handler));
debug!( debug!(
"Transplanting proxy from {:p} to {:p}.", "Transplanting proxy from {:p} to {:p}.",