Chrome incorrectly treats <img> relative URLs in conjunction with <base href> when inserting content into an iframe.
Reported by
chr...@schierla.de,
Oct 21
|
|||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36 Steps to reproduce the problem: 1. Open https://jsfiddle.net/0tkLp92y/ This jsfiddle tries to insert the HTML code <head><base href="http://www.chromium.org/_/rsrc/1438879449147/config/"></head><body>Chromium Logo: <img src="customLogo.gif"></body> into two empty iframes, once using document.open/write/close, and once using document.firstChild.innerHTML. What is the expected behavior? The chromium logo is shown in both iframes What went wrong? Only one chromium logo is shown. Instead of the second one, Chrome tries to load the image from fiddle.jshell.net instead of the given <base href> Did this work before? Yes Chrome version: 70.0.3538.67 Channel: stable OS Version: 10.0 Flash Version:
,
Oct 22
Able to reproduce the issue on the reported chrome 70.0.3538.67, latest canary 72.0.3586.0 using Windows 10, Mac 10.13.6 and Ubuntu 14.04. Below is the Manual bisect (Good behavior seen on dot build) information for same. Bisect Info: ================ Good build: 69.0.3497.100 Bad build: 69.0.3497.128 CHANGELOG URL: https://chromium.googlesource.com/chromium/src/+log/69.0.3497.100..69.0.3497.128?pretty=fuller&n=10000 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1240742 Xianzhu Wang:Please confirm the issue and help in re-assigning if it is not related to your change.Adding RBS label for M-70 feel free to change it if not required. Thanks!
,
Oct 22
This looks a URL resolution issue. The bisected range in #c2 is too wide. phanindra.mandapaka@ can you do another bisect using bisect-builds.py?
,
Oct 23
As per comment #3 retested the issue and got near range also observed good and bad behavior seen on dot build. Able to reproduce the issue on the reported chrome 70.0.3538.67, latest canary 72.0.3586.0 using Windows 10, Mac 10.13.6 and Ubuntu 14.04. Below is the Manual bisect information for same form (https://omahaproxy.appspot.com/). Bisect Info: ================ Good build: 69.0.3497.128 (Inconsistent behavior observed) Bad build: 70.0.3498.0 CHANGELOG URL: https://chromium.googlesource.com/chromium/src/+log/69.0.3497.0..70.0.3498.0?pretty=fuller&n=10000 Reviewed-on: https://chromium-review.googlesource.com/1144256 Reviewed-by: Chris Harrelson <chrishtr@chromium.org> Chris Harrelson:Please confirm the issue and help in re-assigning if it is not related to your change. Adding RBS label for M-70 feel free to change it if not required. As it is showing Dev not available (Last visit > 30 days ago).Hence Assigning to chrishtr@chromium.org. Thanks..!
,
Oct 23
It's more likely that this got exposed by https://chromium-review.googlesource.com/1141121
,
Oct 23
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/8141424398744e03f92ba07957eb3612a6f2c054 commit 8141424398744e03f92ba07957eb3612a6f2c054 Author: vmpstr <vmpstr@chromium.org> Date: Tue Oct 23 21:55:48 2018 Ensure to reschedule an image update if base url changed. We're careful not to update the image loader when it is inserted into but nothing has changed. However, if we're inserted into a subtree such that the base element is now different, we do need to schedule a new run since the final URL may be different. R=fs@opera.com, chrishtr@chromium.org Bug: 897545 Change-Id: Id84894049c52e8f28a7ae581c3a626da5550207f Reviewed-on: https://chromium-review.googlesource.com/c/1296506 Commit-Queue: vmpstr <vmpstr@chromium.org> Reviewed-by: Fredrik Söderquist <fs@opera.com> Reviewed-by: Chris Harrelson <chrishtr@chromium.org> Cr-Commit-Position: refs/heads/master@{#602119} [add] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/WebKit/LayoutTests/images/image-load-reset-on-new-base-expected.html [add] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/WebKit/LayoutTests/images/image-load-reset-on-new-base.html [add] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/WebKit/LayoutTests/images/resources/base-test-resources/success.png [add] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/WebKit/LayoutTests/images/svg-image-load-reset-on-new-base-expected.html [add] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/WebKit/LayoutTests/images/svg-image-load-reset-on-new-base.html [modify] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/blink/renderer/core/html/html_image_element.cc [modify] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/blink/renderer/core/loader/image_loader.cc [modify] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/blink/renderer/core/loader/image_loader.h [modify] https://crrev.com/8141424398744e03f92ba07957eb3612a6f2c054/third_party/blink/renderer/core/svg/svg_image_element.cc
,
Oct 23
As per C#5, since the suspected CL first landed in 70.0.3498.0 hence adding RegressedIn-70.
,
Oct 24
Should be fixed by #6. I'll wait a couple of days to see how it does in canary and request a merge to 71. I think it might be too late for 70 at this point.
,
Oct 25
,
Oct 29
M71 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. Thank you.
,
Oct 29
M71 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. Thank you.
,
Oct 31
Let's target M71 for this fix.
,
Nov 1
This issue is marked as a release blocker with no milestone associated. Please add an appropriate milestone. All release blocking issues should have milestones associated to it, so that the issue can tracked and the fixes can be pushed promptly. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Nov 2
pdr@, if you don't have time for merges then I can do it.
,
Nov 5
M71 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. Thank you.
,
Nov 6
Requesting merge into M71
,
Nov 6
This bug requires manual review: M71 has already been promoted to the beta branch, so this requires manual review Please contact the milestone owner if you have questions. Owners: benmason@(Android), kariahda@(iOS), kbleicher@(ChromeOS), govind@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Nov 6
Approving merge to M71 branch 3578. Please merge ASAP. Thank you.
,
Nov 6
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/0f6617e283866e554239dca4483ce06eb82e7cb4 Commit: 0f6617e283866e554239dca4483ce06eb82e7cb4 Author: vmpstr@chromium.org Commiter: pdr@chromium.org Date: 2018-11-06 22:28:18 +0000 UTC Ensure to reschedule an image update if base url changed. We're careful not to update the image loader when it is inserted into but nothing has changed. However, if we're inserted into a subtree such that the base element is now different, we do need to schedule a new run since the final URL may be different. R=fs@opera.com, chrishtr@chromium.org Bug: 897545 Change-Id: Id84894049c52e8f28a7ae581c3a626da5550207f Reviewed-on: https://chromium-review.googlesource.com/c/1296506 Commit-Queue: vmpstr <vmpstr@chromium.org> Reviewed-by: Fredrik Söderquist <fs@opera.com> Reviewed-by: Chris Harrelson <chrishtr@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#602119}(cherry picked from commit 8141424398744e03f92ba07957eb3612a6f2c054) Reviewed-on: https://chromium-review.googlesource.com/c/1321158 Reviewed-by: Philip Rogers <pdr@chromium.org> Cr-Commit-Position: refs/branch-heads/3578@{#548} Cr-Branched-From: 4226ddf99103e493d7afb23a4c7902ee496108b6-refs/heads/master@{#599034}
,
Nov 6
,
Nov 6
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/0f6617e283866e554239dca4483ce06eb82e7cb4 commit 0f6617e283866e554239dca4483ce06eb82e7cb4 Author: vmpstr <vmpstr@chromium.org> Date: Tue Nov 06 22:28:18 2018 Ensure to reschedule an image update if base url changed. We're careful not to update the image loader when it is inserted into but nothing has changed. However, if we're inserted into a subtree such that the base element is now different, we do need to schedule a new run since the final URL may be different. R=fs@opera.com, chrishtr@chromium.org Bug: 897545 Change-Id: Id84894049c52e8f28a7ae581c3a626da5550207f Reviewed-on: https://chromium-review.googlesource.com/c/1296506 Commit-Queue: vmpstr <vmpstr@chromium.org> Reviewed-by: Fredrik Söderquist <fs@opera.com> Reviewed-by: Chris Harrelson <chrishtr@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#602119}(cherry picked from commit 8141424398744e03f92ba07957eb3612a6f2c054) Reviewed-on: https://chromium-review.googlesource.com/c/1321158 Reviewed-by: Philip Rogers <pdr@chromium.org> Cr-Commit-Position: refs/branch-heads/3578@{#548} Cr-Branched-From: 4226ddf99103e493d7afb23a4c7902ee496108b6-refs/heads/master@{#599034} [add] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/WebKit/LayoutTests/images/image-load-reset-on-new-base-expected.html [add] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/WebKit/LayoutTests/images/image-load-reset-on-new-base.html [add] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/WebKit/LayoutTests/images/resources/base-test-resources/success.png [add] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/WebKit/LayoutTests/images/svg-image-load-reset-on-new-base-expected.html [add] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/WebKit/LayoutTests/images/svg-image-load-reset-on-new-base.html [modify] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/blink/renderer/core/html/html_image_element.cc [modify] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/blink/renderer/core/loader/image_loader.cc [modify] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/blink/renderer/core/loader/image_loader.h [modify] https://crrev.com/0f6617e283866e554239dca4483ce06eb82e7cb4/third_party/blink/renderer/core/svg/svg_image_element.cc |
|||||||||||||||
►
Sign in to add a comment |
|||||||||||||||
Comment 1 by swarnasree.mukkala@chromium.org
, Oct 22