951245 - Forwarding to outer should probably check for active document, not current inner

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Otherwise the patch for bug 936056 is broken on this testcase, loaded in an iframe that's same-origin with the parent:

  function foo() {
    document.open();
    alert(parent);
  }
  window.onload = foo;

because the parent getter sees a non-current inner and throws a security exception.  This happens in content/html/content/test/test_bug209275.xhtml for example.

Comment 1

[Boris Zbarsky [:bzbarsky]]

We'll need this on 27/28, since bug 936056 landed there.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Forwarding to outer should check for active document, not current inner, to handle document.open() cases.

Comment 3

[Boris Zbarsky [:bzbarsky]]

> since bug 936056 landed there

I meant bug 938640.

Comment 4

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/104ac316a399

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8349573 [details] [diff] [review]
Forwarding to outer should check for active document, not current inner, to handle document.open() cases.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 938640
User impact if declined: Incorrect functioning of some web pages after
   document.open.
Testing completed (on m-c, etc.): Passes tests.
Risk to taking this patch (and alternatives if risky): Low risk.  Aligns us
   better with spec.
String or IDL/UUID changes made by this patch:  None.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch for beta 27

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/104ac316a399

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/b15394225283
https://hg.mozilla.org/releases/mozilla-beta/rev/54ba69e5c5f9

Is this something we need on b2g26/esr24 as well given bug 936056?

Comment 9

[Boris Zbarsky [:bzbarsky]]

This is a fix to the code added in bug 938640, so only really needs to land on the branches where that code landed.

This only blocks bug 936056 because on branches where bug 938640 has landed but this bug has not the fix for bug 936056 will turn the tree orange.

Comment 10

[Boris Zbarsky [:bzbarsky]]

On the other hand, this patch depends on the one in bug 932309; without that the mDoc check doesn't work right.  :(