[whatwg/dom] shadowRoot.innerHTML parsing elements from another realm/iframe (#977)

Based on https://bugs.chromium.org/p/chromium/issues/detail?id=1199886#c7, I have a cross browser inconsistency in a still-clouded spec part.

This happens when shadowRoot.innerHTML renders native elements from the one document while rendering custom elements from the current document. This behavior differs between Chrome and other browsers. Matching consistency is key and this issue might require updating the spec to indicate which direction to follow.

This is the code to reproduce:

```html
<body>
    <iframe hidden></iframe>
    <script>
        const iframe = document.querySelector('iframe');
        class Bar extends (iframe.contentWindow.HTMLElement) {
            constructor() {
                super();
                this.attachShadow({ mode: 'open' });
            }
        }
        iframe.contentWindow.customElements.define('x-bar', Bar);
        iframe.contentWindow.customElements.define('x-baz', class Baz extends (iframe.contentWindow.HTMLElement) {
            constructor() {
                super();
                this.innerHTML = '<p>x-baz from iframe</p>';
            }
        });
        class Baz extends HTMLElement {
            constructor() {
                super();
                this.innerHTML = '<p>x-baz from doc</p>';
            }
        }
        customElements.define('x-baz', Baz);
        const elmFromAnotherDoc = new Bar();
        document.body.appendChild(elmFromAnotherDoc);
        elmFromAnotherDoc.shadowRoot.innerHTML = '<p>what paragraph is this?</p><x-baz></x-baz>';
        console.log('Is instance of <p> from main window?', elmFromAnotherDoc.shadowRoot.firstChild instanceof HTMLParagraphElement);
        console.log('Is instance of <x-baz> from main window\'s registry?', elmFromAnotherDoc.shadowRoot.lastChild instanceof Baz);
    </script>
</body>
```

In the devtools console:

```
# Chrome
Is instance of <p> from main window? false
Is instance of <x-baz> from main window's registry? true

# Firefox, Safari
Is instance of <p> from main window? true
Is instance of <x-baz> from main window's registry? true
```

Our preference, and expectation, is for the browsers to follow the Firefox, Safari behavior, which seems appropriate for the case.

---


@domenic's comment in the linked thread is relevant here:

    This is a very interesting convoluted case.

    Note that `elmFromAnotherDoc` has:

    - A relevant realm of outer frame (it's an instance of a class declared in the outer frame)
    - A node document of the outer frame (it's appended to document.body)
    - __proto__.__proto__ equal to HTMLElement from the inner frame

    In particular this means that the setter for innerHTML, which is derived from __proto__.__proto__.__proto__ (ShadowRoot from the inner frame) runs in the inner frame realm. I.e., the current realm at the time that setter runs is the inner frame, while the relevant realm of this (= the relevant realm of elmFromAnotherDoc) is the outer frame.

    Here's what the spec says. https://dom.spec.whatwg.org/#concept-create-element is the relevant algorithm:

    - Step 6.1.2 constructs from the constructor for the custom element case. The constructor is looked up from the registry, which is derived from the document passed to that algorithm, which is ultimately derived from the node document (outer frame) in https://html.spec.whatwg.org/#create-an-element-for-the-token step 1.

    - Step 7.1 gets the element interface. It isn't clear what realm it uses.

    So per spec, the answer should be:

    - Is instance of <p> from main window? unknown
    - Is instance of <x-baz> from main window's registry? false

    I imagine the next step here will be spec discussion to answer: (1) what do different browsers do in these different cases? (2) should these be consistent, or no? (3) what should the answer be?

---



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/issues/977

Received on Tuesday, 4 May 2021 00:31:33 UTC