This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
The realm of an object with a constructor is clear. It's the interface object's global object's realm. There should be some way to indicate that if you get window.document, the Document object returned has the same realm as window. And some way to override that, consider <iframe>. (Maybe it should be a default with an explicit opt-out for complicated cases?) Similarly, for document.createElement() the new Element object will have the same realm as document. The complicated case that remains is objects passed to callbacks and events I suppose. Hopefully bug 24403 helps with that?
The complicated case is any time an object can be gotten from more than one place, really. You have to make sure all those places agree on which realm the object is in.
I mentioned Realms to Alex once, and he made a sour-lemon-face. He was worried they are not a good fit for the Web platform. Alex, can you help elaborate?
Regardless of whether they're a good fit, security checks depend on them. http://web.mit.edu/bzbarsky/www/testcases/global-object-association/createImageData.html is something that should be defined once this is fixed.
Dimitri, Realm in this case is just a way to talk about the right global environment. You have to define what global environment a given object is created in. It's totally observable via instanceof Object (and in general in terms of which global's standard prototypes are used for the object being created). The way ES handles this for objects it creates is by having a concept of "current Realm" and defining that unless specified otherwise any time an object is created it uses the standard prototypes of the global of the current Realm.
https://github.com/w3c/web-platform-tests/pull/1381 has a test. It seems [NewObject] APIs behave fairly consistently. Given JavaScript -> IDL -> API spec -> IDL -> JavaScript perhaps the second instance of IDL can take care of setting the correct Realm when a new object is created. That leaves cases such as window.document, window.document.implementation, ... I guess for those objects we should define the lifetime more clearly and use some kind of hook in IDL to set their Realm correctly. Given that those too go through the IDL -> API spec -> IDL cycle it does seem like IDL needs to say what aspects API specs need to define of an IDL value.
To address this issue, I filed bug 27354, bug 27355, and bug 27356. I'm not sure if that leaves anything for this bug, but we can evaluate once the dependencies are fixed.
There will be some complications with async algorithms, especially if they involve "this" values whose global can change (e.g. node adoption, if that changes the global)...
https://github.com/heycam/webidl/commit/c705ce6ce80f0313e323ee024cb13984a538b55b is the main thing here