Scripts moving between documents

[domenic]

Diffing https://html.spec.whatwg.org/commit-snapshots/c9e804f04d03a0658bfa689cb0f368a4d2e37936 against the current spec, I seem to have inadvertently modified the semantics of what happens when:

1. A script is inserted into document old, causing it to fetch
2. While it is being fetched, the script is moved to document new
3. The fetch finishes and the script executes

In the old spec (which only contained classic scripts), the script would execute in document new.

In the current spec, both classic and module scripts execute in document old.

I'm not sure exactly what the consequences of executing in a document are for classic scripts; I need to research a bit more. For module scripts it impacts which module map they go into.

I doubt changing from executing in new to old is web-compatible. new is probably better anyway. So I just need to fix the spec most likely. I'll be sure to add tests when I do (especially for module scripts).

/cc @whatwg/modules discovered by @hiroshige-g

[rniwa]

What do existing browsers do with respect to classic scripts?

[domenic]

Yeah, fair point, I'd better test that everywhere. Blink apparently uses document new.

[domenic]

Note: I bungled the original post here, and my follow-up, by confusing "document A" and "document B" in a few places. I've since edited it to use documents new and old, and to state things correctly instead of backward. Apologies!

[zcorpan]

This seems related to #2137 except not involving the parser, right?

Test for classic script: http://software.hixie.ch/utilities/js/live-dom-viewer/saved/4982

Firefox does not execute the script at all.

[domenic]

Neither does Edge, according to that test case!

Both Chrome and Safari TP log "inner: delayed-script", so they go with the document new.

I imagine Firefox probably doesn't want to enable this behavior for similar reasons as they don't want to for #2137, but I haven't reviewed those reasons recently; maybe they were parser-specific.

Well, this kind of sucks. I guess the spec is definitely wrong since it says old, but now I'm not sure what to do...

[domenic]

Talking with @nyaxt and @hiroshige-g we are all tentatively fans of the Edge and Firefox behavior. Notably there have been several bad XSS-related bugs in Chrome due to this code path, and since it seems likely web-compatible to just make scripts moving between documents never execute, we'd like to try that.

@rniwa, if we can show that's web-compatible by shipping it in Chrome, does it seem like a reasonable thing for us to spec and for you to implement in WebKit?

/cc @bzbarsky

[domenic]

It appears I mis-tested Edge, and it does execute... we're still hoping to try this in Chrome though.

[domenic]

I take it back. Edge does not execute, but if you type anything into live-dom-viewer it will. Proper web platform tests (uploading momentarily) show that it does not.

Firefox, notably, fires the onerror event. I don't think that's correct, so I'll test that it's not allowed.