Chrome Version: 70.0.3500.0 (Official Build) canary (64-bit)
OS: macOS 10.13.6
What steps will reproduce the problem?
Serve the provided timer-entry.html and timer-entry.frame.html with a static HTTP server. Launch timer-entry.html.
What is the expected result?
http://localhost:8080/timer-entry.html
This is also the result on Firefox and Safari.
What happens instead?
http://localhost:8080/timer-entry.frame.html
----
Per step 23 of document open steps [1], the URL of the document of the entry settings object should be propagated to the frame's document when document.open() is called. In this case, the entry settings object should be the settings object associated with timer-entry.html. The document.open() function is called from the timer callback, which is in turn called through the "invoke a callback function" algorithm [2] by the timer initialization steps in the HTML Standard [3] (step 7.2, first case). The "invoke a callback function" algorithm then "prepares to run script" [4], which is the algorithm responsible for setting up the correct entry settings object.
Indeed, the source for document.open() (Document::open()) does correctly use the entered document's URL [5]. Yet, the ScheduledAction::Execute() function [6], responsible for invoking the timer callback, calls the function directly instead of going through the IDL Invoke() system, which correctly enters the callback's context [7].
[1]: https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#document-open-steps
[2]: https://heycam.github.io/webidl/#invoke-a-callback-function
[3]: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#timer-initialisation-steps
[4]: https://html.spec.whatwg.org/multipage/webappapis.html#prepare-to-run-script
[5]: https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/dom/document.cc?l=3025-3027&rcl=957f866abf50ff69a919bc2db001e326e142cf38
[6]: https://cs.chromium.org/chromium/src/third_party/blink/renderer/bindings/core/v8/scheduled_action.cc?l=167-169&rcl=653b14f24eee18f1665d8055e86c15811d6166da
[7]: https://cs.chromium.org/chromium/src/out/Debug/gen/third_party/blink/renderer/bindings/core/v8/v8_void_function.cc?dr=CSs&g=0&l=62-64
|
Deleted:
timer-entry.html
310 bytes
|
|
|
Deleted:
timer-entry.frame.html
50 bytes
|
Comment 1 by yukishiino@chromium.org
, Jul 24Owner: yukishiino@chromium.org
Status: Assigned (was: Untriaged)