Add a javascript: URL navigation test which checks the parent's snapshotted CSP is checked during task creation, not during task execution

[mbrodesser-Igalia]

Preparation for fixing whatwg/html#4651.

[domenic]

Really clever work here at creating a deterministic test for the differences in approaches. I might have spotted a bug, or maybe I just managed to confuse myself...

[domenic]

This looks like a great strategy! I will approve since I think the things I found do not affect test correctness. But let me know if you want another double-check after changing those.

[domenic]

Is the iframe necessary or helpful here anymore?

[mbrodesser-Igalia]

Yes, it ensures the parent's CSP is checked.

A separate test for checking the target's CSP is needed. The desired behavior for that is unclear to me, given whatwg/html#4651 (comment). I'll test locally and open a separate PR.

[mbrodesser-Igalia]

@domenic: the test is still wrong. It may pass erroneously, because:

https://github.com/web-platform-tests/wpt/pull/49403/files#diff-7827e8417fc230100eb3bf6171e46dc9330bafb73831ff7c1234d40709ab1474R17

doesn't necessarily immediately schedule a task for a "securitypolicyviolation". If the snapshotted CSP is checked during task execution, a task for "javascript-h" will be scheduled. In that case the behavior is:

     [...]
      // Actually after step 3:
      //   Queue 1: [javascript-f, javascript-g]
      //   After javascript-f:
      //     Queue 1: [javascript-g, javascript-h]
      //     After javascript-g:
      //       Queue 1: [javascript-h], Queue 2: [e1]
      //       After javascript-h:
      //         Queue 2: [e1, e2]

So the the order of e1, e2 would let the test pass.

Potentially a fix is to change https://github.com/web-platform-tests/wpt/pull/49403/files#diff-7827e8417fc230100eb3bf6171e46dc9330bafb73831ff7c1234d40709ab1474R17
to iframe.src = "http://example.com"; because that immediately queues a "securitypolicyviolation", relying on other functionality than the one here being tested.
However, the setter for iframe.src is pretty complex, so I don't know if that behavior is specified. Do you know?

[domenic]

However, the setter for iframe.src is pretty complex, so I don't know if that behavior is specified. Do you know?

I traced through the spec for iframe.src and it synchronously reaches https://html.spec.whatwg.org/#navigate .

We then go in-parallel. The request gets created in https://html.spec.whatwg.org/#create-navigation-params-by-fetching ... and we run into whatwg/html#10796 , ugh. So it's not even well-defined what CSP is consulted.

I'll comment over there, but, this is discouraging.