1108054 - Some built-in functions inside iframes revert to their built-in value when the iframe is filled using document.write

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Riccardo Pelizzi]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:33.0) Gecko/20100101 Firefox/33.0
Build ID: 20141105223254

Steps to reproduce:

Load http://plnkr.co/edit/AyR7VoQTdTO00MMhPhYq?p=preview

Override/Wrap document.write inside an empty iframe, then use document.write to fill it with an HTML page.


Actual results:

Depending on whether document.write is used right away or inside setTimeout, the document.write might revert back to its built-in value.

Other built-in functions have their value reverted, but not all of them.


Expected results:

I'm not sure whether this is covered by a standard, but I guess the behavior should be consistent?

In Chrome both cases result in an overridden document.write

Comment 1

[Boris Zbarsky [:bzbarsky]]

Per spec, a document.write at a point when the page is still being parsed just writes the content.  But a document.write after pageload has completed implies a document.open, which creates a new JavaScript environment in the iframe and removes everything that was there previously.  This is why your setTimeout case has different behavior from the non-timeout case.

Chrome doesn't implement the spec correctly, sadly.