Should we restrict certain iframe-initiated popups from satisfying the popup heuristic?

[amaliev]

More details in the explainer, under "Initiating frame for popup heuristic"

We opted to allow popup heuristics for all popups with opener access, as documented in the explainer and spec.

• This matches the behavior on Firefox and Safari
• This fixes certain observed breakages, e.g. the Facebook comments widget

However, we might want to include one or both of the following restrictions to avoid privacy and security pitfalls:

• Disallow a third-party popup opened from a same-site third-party iframe from the popup heuristic.
• Disallow a third-party popup opened from a different third-party iframe from the popup heuristic.

We need to experiment more, and collaborate with other browsers, to ensure these changes don't result in more breakages.