[whatwg] DOM-related and API-related feedback

[Ian Hickson]

On Sun, 28 Dec 2008, Adam Barth wrote:
> > On Fri, 13 Jun 2008, Adam Barth wrote:
> >> 3) The document's origin and effective script origin become the 
> >> origin and the effective script origin of the currently executing 
> >> script. (Note: actually, the origins are aliased, as in the 
> >> about:blank case, so that changes to one of the document's 
> >> document.domain property affects the other.)
> >
> > Does the aliasing happen with all browsers?
> 
> Test case: http://www.webblaze.org/tests/alias/
> 
> Browsers that alias: Firefox 3, Safari 3.1.2, Chrome.
> Browsers that do not alias: Internet Explorer 7, Opera 9.5.2
> 
> This looks like a Firefox-ism that I copied into WebKit.  We added 
> aliasing to WebKit because, without it, we failed a regression test. 
> I'll investigate whether that test is based on a real web site.  Jonas 
> has previously said he thinks the aliasing is important for web 
> compatibility.  Jonas, do you know of actual web sites that will break 
> if we follow the current HTML 5 text?

On Sun, 28 Dec 2008, Jonas Sicking wrote:
> 
> I don't know of any websites unfortunately. I've cc'ed Boris who might 
> know.
> 
> In general, if IE doesn't do it it seems unlikely that many sites depend 
> on it.

On Sun, 28 Dec 2008, Boris Zbarsky wrote:
> 
> Agreed on the latter.
> 
> On the former, it wouldn't be a problem for websites per se, but the 
> aliasing needs to happen when a page whose origin is a globally unique 
> identifier has an about:blank iframe.  Or rather, the origin of the 
> iframe needs to be the _same_ globally unique identifier.  In Gecko this 
> is implemented by simply using the same origin object for both.
> 
> Note that in IE the security model around about:blank is pretty weird 
> last I checked, so I'd want to see some pretty exhaustive tests before 
> changing Gecko behavior in web-facing about:blank.

I haven't changed the spec here, because it's not clear to me exactly what 
should be changed any why. If there is a specific thing in the spec that 
needs changing, please let me know (ideally with the URL of a site that 
depends on it), so that I can make the change.

As a general rule I'd like the spec to line up as closely as possible to 
IE, since IE's behavior has generally been considered the "de facto" 
standard and since, well, to put it bluntly, I expect it will be easier 
for us to get non-Microsoft browsers to line up on what IE does than vice 
versa for a lot of this stuff.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'