Repository navigation
Resolve nested element URL getters against the owning document base #904
Description
Parent: #267. Related: #264, #903.
Reproduced in installed unchanged Code OSS
The signed AppScene/WebScene Release from WebScene 5b4739c8, AppScene
36d7a82e and unchanged Code OSS 645f29cc loads the virtual-HTTPS
Markdown prelude. Its nested iframe is owned by that prelude document and
authored as ./fake.html?id=.... In a bounded main-realm native probe,
frame.ownerDocument.baseURI is the virtual-HTTPS prelude URL, while
reading frame.src returns a loopback http://127.0.0.1:<port>/fake.html.
The authored attribute remains relative. Evidence is recorded in
vscode-demo/docs/validation/markdown-preview-layout-20260921.md and
build/appscene-webview-398/native-preview-36d7a82-final-diagnostic.log.
webscene_v8_runtime_dom_properties.inc::get_element_url resolves reflected
src/href against current_base_address(), which selects the caller's
document. Other owner-sensitive paths use effective_document_base and
css_cascade_root_for_node. This observation does not prove the actual
nested navigation requested the wrong origin; that request has a separate
resolution path.
Proposed focused fix and gates
Resolve URL-valued element properties against the element's owning document
base, including same-origin cross-document reads and <base> changes. Keep
getAttribute authored, navigation request URLs and cross-origin access
policy separate. Add a browser-referenced nested relative iframe.src,
img.src, and a.href contract, plus native direct caller/owner realm,
detached node, base mutation, and virtual-origin checks. Compare Chromium
before/after; ensure no additional resource requests or retained documents.
Then rerun unchanged Markdown preview; do not close webview acceptance until
its content paints and passes layout/security/lifecycle/performance gates.
Activity
wieslawsoltes commentedon Sep 21, 2026
Focused WebScene PR #905 is open at
f9e89f1a. It resolves connected nested element URL getters against the owner document base, preserving authored attributes and navigation/security paths. Its Release native iframe lifecycle gate passes: connected nesteda.hrefandinput.srcbefore/after<base>mutation, 100 create/load/write/replace/remove cycles, 1 MiB update p95 3.73 ms versus the 250 ms bound, and flat 1,849,528-byte heap. A checked-in Chrome 152 headless reference returnsPASS. The full WPT matrix, detached-node semantics and unchanged Markdown rendering remain open. The PR is awaiting its related CI runners and will merge when those pass; consolidation PR #76 remains open.wieslawsoltes commentedon Sep 21, 2026
Focused PR #905 merged as WebScene
4715b38don 21 September. The demo locally pins that merge atcbb08c4b/ff404ad7and remains unpushed. The connected nestedhref/srcgetter and<base>mutation regression passed in the native 100-cycle iframe lifecycle gate; checked-in Chrome 152 reference passed. The change-related Linux CI build/test passed before merge, and superseded queued PR workflows were canceled afterward. Keep #904 open for the remaining detached/virtual-origin URL matrix, WPT runner qualification, and unchanged Markdown installed acceptance. The latest signed diagnostic app predates #905 and still shows a 0×0 overlay; #903 owns that CSS/layout blocker. No refreshed #905 SDK/app acceptance is claimed yet.