Re: [whatwg] AllowSeamless feedback

On Mon, Jan 14, 2013 at 3:48 PM, Anne van Kesteren <annevk@annevk.nl> wrote:

> On Tue, Jan 15, 2013 at 12:39 AM, Nasko Oskov <nasko@chromium.org> wrote:
> > Based on the existing security concerns listed in the proposal and the
> fact
> > that it might prevent a useful new security architecture in browsers, I
> > would suggest this not be added to the web platform.
>
> FWIW, I think that "limitation" is known. (At least I cannot remember
> the last time someone actually proposed new API surface requiring
> synchronous access between two cross-origin Window objects.) <iframe
> seamless> could still be useful however cross-origin, even without
> cross-boundary events.
>

The input events was just one example. There are other cases where having
an asynchronous boundary can lead to unexpected behavior for developers.

* The current spec (
http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html#attr-iframe-seamless)
calls
for merging the collection of links between seamlessly nested documents:
"For example if the user agent supports listing all the links in a
document, links in "seamlessly" nested documents would be included in that
list without being significantly distinguished from links in the document
itself."
If the parent document is trying to access the set of links, while the link
has been removed from the nested document, there will be a race condition.

* CSS styling can also be problematic, since style computation will have to
be propagated asynchronously between the parent document and the nested one:
"In a CSS-supporting user agent: the user agent must, for the purpose of
CSS property inheritance only, treat the root element of the active
document of the iframe element's nested browsing context as being a child
of the iframe element. (Thus inherited properties on the root element of
the document in the iframe will inherit the computed values of those
properties on the iframe element instead of taking their initial values.)"

* There could be others that I'm missing.

It's not clear whether implementing these asynchronously will lead to a
good experience.

Received on Tuesday, 15 January 2013 00:36:38 UTC