| 05:36 | <dominicc> | domenic: Setting the src navigates the iframe, surely? We don't know what javascript:... evaluates to in general without running it—see halting problem—and we usually shouldn't run arbitrary JavaScript in the existing document of the iframe—SOP. So I think setting src=javascript:undefined should navigate once. There is a kind of cancelled navigation |
| 05:36 | <dominicc> | there, the second one where undefined, not being a string, turns into 204. (How many times do Chrome et al navigate?) |
| 08:21 | <annevk> | dominicc: isn't cross-origin simply blocked? |
| 08:21 | <annevk> | dominicc: but I should prolly study this first before chiming in |
| 08:33 | <dominicc> | annevk: Yes, cross-origin is blocked. domenic: I need to understand what you think this should be changed to. |
| 08:35 | <annevk> | dominicc: FWIW, suspect he's asleep, but whatwg/html has a number of issues and Domenic added a PR around this I saw |
| 13:28 | <Domenic> | dominicc: did you see https://github.com/whatwg/html/issues/1896 ? |
| 13:29 | <Domenic> | Setting to javascript:undefined should navigate zero times. Or rather, it should invoke the navigation algorithm, which aborts early. |
| 13:29 | <Domenic> | In Chrome it aborts early for a href and location.href but not for iframe.src |
| 13:32 | <dominicc> | looking |
| 13:36 | <dominicc> | domenic: OK, read that. This is not really my area, but I think the spectrum of browser behavior/bugginess is even broader than your table, for example what happens when you assign location in a JavaScript link URL, etc. |
| 13:37 | <Domenic> | Hmm yeah it's possible there might be special cases for that that don't just fall under the existing ones. |
| 13:37 | <dominicc> | Domenic: When Boris says "a quick check suggests that at least Chrome and Safari seem to convert non-string values to the string "" and then proceed to load that as the response body" I think there's some missing qualifiers there, like <iframe src="javascript:document.write('hi');"> the iframe displays 'hi' and not whatever you get from loading an empty |
| 13:37 | <dominicc> | string response body. But maybe you two were talking about JavaScript URLs in links. |
| 13:39 | <dominicc> | domenic: re: special cases, for example this: https://bugzilla.mozilla.org/show_bug.cgi?id=1281375 |
| 13:39 | <Domenic> | I see, yeah, I guess by the existing rules that would not work... Definitely worth testing. |
| 13:40 | <Domenic> | Thanks |
| 13:41 | <dominicc> | domenic: But I think the characterization that Blinks implementation is a bit whacky is fair. "navigation" is blurry. |
| 13:44 | <Domenic> | The web compat constraints are worrying though. Especially since they apparently take 12-18 weeks to discover :/ |