Sizzle calling into attachEvent breaks IE11

[[email protected]…]

This bug affects IE11 and the following code within jQuery:

// Support: IE>8
// If iframe document is assigned to "document" variable and if iframe has been reloaded,
// IE will throw "permission denied" error when accessing "document" variable, see jQuery #13936
if ( parent && parent.frameElement ) {
  parent.attachEvent( "onbeforeunload", function() {
    setDocument();
  });
}

The code assumes that the "attachEvent" method will be available, ​which as of IE11, it is not. If the code is even still required, it should be using "addEventListener".

This is easily reproducible by simply IFRAME-ing a page that uses jQuery. I've created a jsfiddle that demonstrates it here: ​http://jsfiddle.net/Pxnqr/. You'll need to run that using IE11 with the debugger attached and breaking on errors.

[dmethvin]

The problem happens before that, you can see that parent.frameElement gives the "Access is denied" error before it even gets to the .attachEvent() call.

[[email protected]…]

Replying to dmethvin:

The problem happens before that, you can see that parent.frameElement gives the "Access is denied" error before it even gets to the .attachEvent() call.

Sorry that's likely just a same-origin policy bug with with example since the JavaScript can't access objects across different domains. Although that's maybe a separate issue with the code in question. :)

If you had an example where both the parent window and the page inside the iframe were both on the same domain, that should cause the problem.

[dmethvin]

This is easily reproducible

Could you create an example that frames a jsfiddle/jsbin page? You can add "/show" to a jsfiddle URL to just show the page without the editing UI.

[[email protected]…]

Replying to dmethvin:

Could you create an example that frames a jsfiddle/jsbin page? You can add "/show" to a jsfiddle URL to just show the page without the editing UI.

Ok, I've updated the jsfiddle to use two pages on the same domain using the /show/ flag as you suggested. It's now breaking on the "attachEvent" exception instead of the "access denied" one.

Try this guy out: ​http://jsfiddle.net/Pxnqr/3/show/

[gibson042]

Are you sure you got the jQuery version right? This was fixed in 1.10.2 by #13980. I haven't checked if IE11 also exhibits the root issue, but we're no longer accessing frameElement.

[anonymous]

You're correct, I was using 1.10.1 which is all that jsfiddle supports. Switching it manually to 1.10.2 resolves the issue (​http://jsfiddle.net/Pxnqr/5/show/) and looking at the code I can see that the affected block has been modified.

@dmethvin, thanks for the prompt attention on this one. You'll likely see more of this issue from sites using pre-1.10.2 once IE11 goes into the wild. But feel free to close this ticket! :)

[gibson042]

Duplicate of #13980.
It looks like IE11 will continue to throw the cross-window access exception, but unfortunately it can't be isolated with attachEvent like IE9/10: ​http://builds.jenkins.jquery.com/jquery/9bf6aaf4adcd4b4e5ff6e2b5ae6a239d52a1bddc/test/index.html?module=Sizzle

Issue reported to Microsoft: ​https://connect.microsoft.com/IE/feedback/details/802251/script70-permission-denied-error-when-trying-to-access-old-document-from-reloaded-iframe

[anonymous]

simply add a function called attachEvent inside the iframe, and assign the addEventListener - like this (before jQuery script tag in IFRAME): var isIE11 = !!(navigator.userAgent.match(/Trident/) && !navigator.userAgent.match(/MSIE/)); if (isIE11) {

if (typeof window.attachEvent == "undefined"

!window.attachEvent)

window.attachEvent = window.addEventListener;

}