Document fallback base URL should not rely on parent browsing context

[jdm]

https://html.spec.whatwg.org/multipage/urls-and-fetching.html#fallback-base-url describes how to use an initialized about base URL. Our current implementation relies on synchronously querying the parent, which is broken in our current implementation when the iframe is sandboxed.

servo/components/script/dom/document.rs

Lines 814 to 829 in 9a0f2be

	if let Some(browsing_context) = self.browsing_context() {
	// Step 1: If document is an iframe srcdoc document, then return the
	// document base URL of document's browsing context's container document.
	let container_base_url = browsing_context
	.parent()
	.and_then(|parent| parent.document())
	.map(|document| document.base_url());
	if document_url.as_str() == "about:srcdoc" {
	if let Some(base_url) = container_base_url {
	return base_url;
	}
	}
	// Step 2: If document's URL is about:blank, and document's browsing
	// context's creator base URL is non-null, then return that creator base URL.
	if document_url.as_str() == "about:blank" && browsing_context.has_creator_base_url() {
	return browsing_context.creator_base_url().unwrap();

Tests: ./mach test-wpt tests/wpt/tests/html/infrastructure/urls/terminology-0/document-base-url-about-srcdoc.https.window.html

[TimvdLippe]

I am making some progress, but the lack of spec references makes it difficult for me to navigate the code. For example, I am looking where the about base URL is initialized. In the spec I see https://html.spec.whatwg.org/multipage/document-sequences.html#creating-browsing-contexts:concept-document-about-base-url so in the codebase I search for creating-browsing-contexts. There is no such reference to any method, other than the CreatorBrowsingContextInfo. However, that's a struct that contains some information, but it doesn't have the steps.

I have tried to traverse up the callstack to see where CreatorBrowsingContextInfo is referenced, to hopefully find the relevant method. Then I find local_window_proxy and remote_window_proxy which seem to do similar things, but I can't say that for certain.

Ultimately, you say "A sandboxed iframe starts an about:blank load in a new script thread", but I don't see this new script thread being created based on the sandbox attribute. The only reference I see is when it creates the event loop, but I don't see any other usage of the sandbox attribute. On the basis of what do you create new script threads and why is that related to the sandbox attribute? I did find ScriptThreadFactory, but I don't see any business logic related to what you are describing.

TLDR: there are few references to the spec and I am having trouble trying to navigate the code to figure out where I should put what.

[TimvdLippe]

Some other strings I have tried to search for but don't show any references:

• Let topLevelCreationURL be
• Let topLevelOrigin be origin if embedder is null
• Let document be a new
• If creator is non-null

I did find HTMLIframeElement::create_nested_browsing_context when searching for "create a new browsing context", but that talks about about:blank, not about:srcdoc

[TimvdLippe]

Unassigning myself as this requires fixes in the iframe mechanism that I am not familiar with.