Repository navigation
Resolve nested element URL getters against the owning document base #904
Description
Activity
Focused WebScene PR #905 is open at
f9e89f1a. It resolves connected nested element URL getters against the owner document base, preserving authored attributes and navigation/security paths. Its Release native iframe lifecycle gate passes: connected nesteda.hrefandinput.srcbefore/after<base>mutation, 100 create/load/write/replace/remove cycles, 1 MiB update p95 3.73 ms versus the 250 ms bound, and flat 1,849,528-byte heap. A checked-in Chrome 152 headless reference returnsPASS. The full WPT matrix, detached-node semantics and unchanged Markdown rendering remain open. The PR is awaiting its related CI runners and will merge when those pass; consolidation PR #76 remains open.Focused PR #905 merged as WebScene
4715b38don 21 September. The demo locally pins that merge atcbb08c4b/ff404ad7and remains unpushed. The connected nestedhref/srcgetter and<base>mutation regression passed in the native 100-cycle iframe lifecycle gate; checked-in Chrome 152 reference passed. The change-related Linux CI build/test passed before merge, and superseded queued PR workflows were canceled afterward. Keep #904 open for the remaining detached/virtual-origin URL matrix, WPT runner qualification, and unchanged Markdown installed acceptance. The latest signed diagnostic app predates #905 and still shows a 0×0 overlay; #903 owns that CSS/layout blocker. No refreshed #905 SDK/app acceptance is claimed yet.
Parent: #267. Related: #264, #903.
Reproduced in installed unchanged Code OSS
The signed AppScene/WebScene Release from WebScene
5b4739c8, AppScene36d7a82eand unchanged Code OSS645f29ccloads the virtual-HTTPSMarkdown prelude. Its nested iframe is owned by that prelude document and
authored as
./fake.html?id=.... In a bounded main-realm native probe,frame.ownerDocument.baseURIis the virtual-HTTPS prelude URL, whilereading
frame.srcreturns a loopbackhttp://127.0.0.1:<port>/fake.html.The authored attribute remains relative. Evidence is recorded in
vscode-demo/docs/validation/markdown-preview-layout-20260921.mdandbuild/appscene-webview-398/native-preview-36d7a82-final-diagnostic.log.webscene_v8_runtime_dom_properties.inc::get_element_urlresolves reflectedsrc/hrefagainstcurrent_base_address(), which selects the caller'sdocument. Other owner-sensitive paths use
effective_document_baseandcss_cascade_root_for_node. This observation does not prove the actualnested navigation requested the wrong origin; that request has a separate
resolution path.
Proposed focused fix and gates
Resolve URL-valued element properties against the element's owning document
base, including same-origin cross-document reads and
<base>changes. KeepgetAttributeauthored, navigation request URLs and cross-origin accesspolicy separate. Add a browser-referenced nested relative
iframe.src,img.src, anda.hrefcontract, plus native direct caller/owner realm,detached node, base mutation, and virtual-origin checks. Compare Chromium
before/after; ensure no additional resource requests or retained documents.
Then rerun unchanged Markdown preview; do not close webview acceptance until
its content paints and passes layout/security/lifecycle/performance gates.