Bug 246372

Summary: imported/w3c/web-platform-tests/content-security-policy/inheritance/history-iframe.sub.html fails to navigate back in history to srcdoc iframe
Product: WebKit Reporter: Ryan Reno <rreno>
Component: HistoryAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description Ryan Reno 2022-10-11 16:03:25 PDT
We're timing out on the srcdoc subtests of the named WPT. After playing with this a little bit I believe this is because when we navigate back in history with window.history.back() we aren't navigating back to the srcdoc but instead to the document before we set srcdoc attribute.

I reproduced this by reducing the WPT subtest to this:

message.html:
--------------
<!DOCTYPE html>
<script>
top.postMessage("ready", "*");
</script>

message-and-back.html:
--------------
<!DOCTYPE html>
<script>
top.postMessage({msg:"message-and-back"}, "*");
window.history.back();
</script>

srcdoc.html:
--------------
<!DOCTYPE html>
<script>
const message_from = (starts_with) => {
    return new Promise(resolve => {
      window.addEventListener('message', msg => {
          if (!starts_with || msg.data.msg.startsWith(starts_with))
            resolve(msg.data.msg);
      });
    });
  };

const htmlPayload = `
      <!DOCTYPE html>
      <script>
        function ready() {
            top.postMessage({msg:'sdoc'}, '*');
        }
      <\/script>
      <body onpageshow='ready()'>
          <h1>Hello world!<\/h1>
      <\/body>
      <\/html>
`;

async function run() {
    let i = document.createElement("iframe");
    document.body.appendChild(i);
    i.contentWindow.location = "message.html";
    await message_from("ready");
    i.srcdoc = html_payload;
    await message_from("sdoc");
    i.contentWindow.location = "message-and-back.html";
    await message_from("message-and-back");
    await message_from("sdoc"); // <-- this is where WPT hangs and times out
}
</script>
<body onload="run()"></body>

If I serve and navigate to srcdoc.html and check the inspector, the iframe has the expected srcdoc attribute but the document in the frame is actually the content of message.html

I think we're either mistakenly not putting the srcdoc entry in history or the spec tells us not to and the WPT needs to change. I'll need to take a closer look.
Comment 1 Radar WebKit Bug Importer 2022-10-11 16:03:58 PDT
<rdar://problem/101055087>
Comment 2 Ryan Reno 2022-10-13 10:19:32 PDT
It looks like there's spec work to be done w.r.t srcdoc in history. See https://github.com/whatwg/html/issues/6809