1594986 - Intrinsic sizing of SVG embedded via <object>/<embed> doesn't disappear on navigation

Status: RESOLVED FIXED

(Core :: SVG, defect, P3)

Description

[Boris Zbarsky [:bzbarsky]]

If I do the following:

1. Create a page that loads an SVG via <object>.
2. Navigate the window the SVG is in (via frames[0].location.href) to an HTML page

the size the <object> determined from the SVG does not change when the navigation to the HTML happens (unlike the other direction: going from HTML to SVG resizes the <object>). This is not spec-compliant, and can be an information leak (from the SVG to the following HTML, which might not be same-origin).

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

How surprising. Could we do something like just reframe the whole <object>/<embed> ?

Comment 2

[Emilio Cobos Álvarez [:emilio]]

There should be no need to reframe, just clearing these two on navigation should work: https://searchfox.org/mozilla-central/rev/ace2c59e6c56b2dcba25af1aa8903a5e7f9a5857/dom/base/nsObjectLoadingContent.h#580-588

If the object element knows when it's been navigated then it's trivial to do, otherwise we need to clear it up from the child presumably.

Comment 3

[Andreas Farre [:farre] (PTO -> Dec 7th)]

https://treeherder.mozilla.org/jobs?repo=try&revision=b095e6c00fcbd769d259515f50cf519cfddbbb67&group_state=expanded

Comment 4

[Andreas Farre [:farre] (PTO -> Dec 7th)]

Attachment: Bug 1594986 - Reset subdocument intrinsic size in `UnloadObject`. r=emilio!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/00f3ae2cc1a3
Reset subdocument intrinsic size in `UnloadObject`. r=emilio

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/37166 for changes under testing/web-platform/tests

Comment 7

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/00f3ae2cc1a3

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot