{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/javascript/issues/29","repository_url":"https://api.github.com/repos/whatwg/javascript","labels_url":"https://api.github.com/repos/whatwg/javascript/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/javascript/issues/29/comments","events_url":"https://api.github.com/repos/whatwg/javascript/issues/29/events","html_url":"https://github.com/whatwg/javascript/issues/29","id":132140266,"number":29,"title":"Obsolete this document","user":{"login":"littledan","id":189835,"avatar_url":"https://avatars.githubusercontent.com/u/189835?v=3","gravatar_id":"","url":"https://api.github.com/users/littledan","html_url":"https://github.com/littledan","followers_url":"https://api.github.com/users/littledan/followers","following_url":"https://api.github.com/users/littledan/following{/other_user}","gists_url":"https://api.github.com/users/littledan/gists{/gist_id}","starred_url":"https://api.github.com/users/littledan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/littledan/subscriptions","organizations_url":"https://api.github.com/users/littledan/orgs","repos_url":"https://api.github.com/users/littledan/repos","events_url":"https://api.github.com/users/littledan/events{/privacy}","received_events_url":"https://api.github.com/users/littledan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":14,"created_at":"2016-02-08T13:21:01Z","updated_at":"2016-02-12T19:59:11Z","closed_at":null,"body":"The JavaScript WHATWG spec is pretty small and largely subsumed by TC39 work. There are just a few things left. Ideally, we would bring the remaining items into ECMAScript (e.g., library features like `__defineSetter__` and RegExp legacy $1 properties) and just leave it to HTML/WebIDL to reference ECMAScript and require Annex B. Now that there's the stage process and ecmarkup, we could even have spec text which is at an earlier stage to describe certain features where consensus doesn't yet exist.\r\n\r\n@annevk @domenic @mathiasbynens What do you think?"},"comment":{"url":"https://api.github.com/repos/whatwg/javascript/issues/comments/183467903","html_url":"https://github.com/whatwg/javascript/issues/29#issuecomment-183467903","issue_url":"https://api.github.com/repos/whatwg/javascript/issues/29","id":183467903,"user":{"login":"littledan","id":189835,"avatar_url":"https://avatars.githubusercontent.com/u/189835?v=3","gravatar_id":"","url":"https://api.github.com/users/littledan","html_url":"https://github.com/littledan","followers_url":"https://api.github.com/users/littledan/followers","following_url":"https://api.github.com/users/littledan/following{/other_user}","gists_url":"https://api.github.com/users/littledan/gists{/gist_id}","starred_url":"https://api.github.com/users/littledan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/littledan/subscriptions","organizations_url":"https://api.github.com/users/littledan/orgs","repos_url":"https://api.github.com/users/littledan/repos","events_url":"https://api.github.com/users/littledan/events{/privacy}","received_events_url":"https://api.github.com/users/littledan/received_events","type":"User","site_admin":false},"created_at":"2016-02-12T19:59:11Z","updated_at":"2016-02-12T19:59:11Z","body":"> I don't understand the question. Rephrase?\r\n\r\nI was getting at my understanding of Chrome 48 semantics, so you answered my question.\r\n\r\n> The issue is, what happens when a RegExp.prototype.exec method from one realm is applied to a RegExp instance from another realm. In this cross realm case, info must not leak to either, even if the properties are not deleted.\r\n\r\nI'm not sure if I understand the threat model here. Why wouldn't SES be applied on each realm individually, if these are same-origin realms that are supposed to be isolated? If SES, or another system which freezes things and deletes those problematic RegExp properties, isn't applied to one of them, then I think there are other communication channels besides running RegExp.prototype.exec (for example, simply setting a property on something). Is the idea that it's more ergonomic to just recursively freeze things, and we have to protect against a naive system which would simply do that and fail to first remove those properties?"}}