Re: document.write() and .close() allowed on IFRAME though its document.domain was set

On 1/31/12 3:07 PM, Ian Hickson wrote:
>> It would be good to understand why it works in WebKit; I didn't think
>> they did the same "share the origin object" thing Gecko does here.
>
> We should either change one or more implementations here or change the
> spec.

Yes.  Or both.

> Currently, I think the behaviour you describe for about:blank in Gecko is
> the same as what the spec has for srcdoc="" documents:
>
>    The origin of the Document is the origin of the Document's browsing
>    context's browsing context container's Document.
>
> The behaviour the spec has for about:blank isn't the same:
>
>    The origin of the Document is the origin it was assigned when its
>    browsing context was created.

It's not clear to me how the two differ, unless the parent of the 
subframe can change.  That's for subframes; for things like doing an 
about:blank load in a random browsing context where something else is 
already loaded things are obviously different, since there may not be a 
container document in that case.  Have we done any testing as to what 
UAs do in that case?

> However, in neither case does document.domain in the spec work as you
> describe for Gecko

Yes, I'm aware of that.  At some point we'll revamp how document.domain 
works in Gecko to align better with the spec, I think, but it's been a 
pretty low priority.  And of course if other UAs think the spec should 
change we're somewhat open to that; there's a good bit of lack of 
interop on edge cases with document.domain, obviously.

> I'm open to changing any of this, but it's a pretty hairy part of the spec
> so I'd rather not change it more than once... :-)

Yes, agreed.

I'd still like to understand what the heck Chrome is/was doing with 
about:blank in Hallvord's testing.

-Boris

Received on Tuesday, 31 January 2012 21:48:42 UTC