Open
Description
What is the issue with the HTML Standard?
Let's says there is a document with one iframe (has attribute name="test"
).
This document has unload event handler that executes following code window['test']
If we try to execute unload a document and its descendants algorithm on this document:
- There is one child navigable corresponding to the iframe, so recursive call on step 4.2 results in queuing a task to unload this iframe.
- Queue a task to unload the document (iframe's parent) on step 6.
- Execute a task that unloads iframe's document.
3.1. Iframe's document is destroyed on step 20 while unloading. - Execute a task that unloads iframe's parent document.
4.1. Dispatching "unload" event results in executingwindow['test']
4.2. Window property access triggers execution of "document-tree child navigable target name property set" where access to iframe's active document fails because iframe's document was destroyed while unloading.
Shouldn't we try to maintain invariant that all content navigables present in the DOM tree also need to have an active document until dispatching of unload events is completed?
In Ladybird's implementation I made an attempt to fix that by changing unloading order to:
- Unload documents of all inclusive descendant navigables without destroying them
- Destroy documents of all inclusive descendant navigables
Activity