Implement the 'document.origin' accessor.

Implement the 'document.origin' accessor.

Recently added to DOM at https://dom.spec.whatwg.org/#dom-document-origin.
Firefox is working on an implementation in
https://bugzilla.mozilla.org/show_bug.cgi?id=931884.

BUG=436377
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=186330

[Mike West, 2014-11-25 09:57:14]

mkwst@chromium.org changed reviewers:
+ jochen@chromium.org

[Mike West, 2014-11-25 09:57:14]

Hey Jochen, WDYT? I think this is too small to go through the intent process,
but I'm happy to start a thread on blink-dev@ if you'd prefer.

[sof, 2014-11-25 10:46:41]

On 2014/11/25 09:57:14, Mike West wrote:
> Hey Jochen, WDYT? I think this is too small to go through the intent process,
> but I'm happy to start a thread on blink-dev@ if you'd prefer.

Is this a shorthand for document.location.origin ?

[Mike West, 2014-11-25 10:53:05]

On 2014/11/25 10:46:41, sof wrote:
> On 2014/11/25 09:57:14, Mike West wrote:
> > Hey Jochen, WDYT? I think this is too small to go through the intent
process,
> > but I'm happy to start a thread on blink-dev@ if you'd prefer.
> 
> Is this a shorthand for document.location.origin ?

No.

Consider the document at `http://example.com/document.html`:

* If loaded as a top-level document, `document.location.origin` and
`document.origin` will return the same values.
* If loaded in a sandboxed iframe, `document.location.origin` will return the
origin of the document's location (`http://example.com`), and `document.origin`
will return `null`, as the document has been sandboxed into a unique origin.

[mlamouri (slow - plz ping), 2014-11-25 11:02:12]

mlamouri@chromium.org changed reviewers:
+ mlamouri@chromium.org

[mlamouri (slow - plz ping), 2014-11-25 11:02:13]

https://codereview.chromium.org/758913002/diff/1/Source/core/dom/Document.idl
File Source/core/dom/Document.idl (right):

https://codereview.chromium.org/758913002/diff/1/Source/core/dom/Document.idl...
Source/core/dom/Document.idl:60: readonly attribute DOMString? origin;
Mozilla patch and DOM spec says |readonly attribute DOMString origin;|. Could
you point to the part of the spec that says that the origin should be null in
some cases?

[Mike West, 2014-11-25 11:26:16]

Thanks, Mounir!

https://codereview.chromium.org/758913002/diff/1/Source/core/dom/Document.idl
File Source/core/dom/Document.idl (right):

https://codereview.chromium.org/758913002/diff/1/Source/core/dom/Document.idl...
Source/core/dom/Document.idl:60: readonly attribute DOMString? origin;
On 2014/11/25 11:02:13, Mounir Lamouri wrote:
> Mozilla patch and DOM spec says |readonly attribute DOMString origin;|. Could
> you point to the part of the spec that says that the origin should be null in
> some cases?

Nope. This was a mistake on my part; we can return the string "null", but not
the object null. Fixed in the next patchset.

[mlamouri (slow - plz ping), 2014-11-25 13:51:59]

On 2014/11/25 11:26:16, Mike West wrote:
> Thanks, Mounir!
> 
> https://codereview.chromium.org/758913002/diff/1/Source/core/dom/Document.idl
> File Source/core/dom/Document.idl (right):
> 
>
https://codereview.chromium.org/758913002/diff/1/Source/core/dom/Document.idl...
> Source/core/dom/Document.idl:60: readonly attribute DOMString? origin;
> On 2014/11/25 11:02:13, Mounir Lamouri wrote:
> > Mozilla patch and DOM spec says |readonly attribute DOMString origin;|.
Could
> > you point to the part of the spec that says that the origin should be null
in
> > some cases?
> 
> Nope. This was a mistake on my part; we can return the string "null", but not
> the object null. Fixed in the next patchset.

I'm trying to understand why you return 'null'.

Is it because of:
https://html.spec.whatwg.org/multipage/browsers.html#unicode-serialisation-of...
and:
https://html.spec.whatwg.org/multipage/browsers.html#sandboxed-origin-browsin...
?

[Mike West, 2014-11-25 13:58:41]

On 2014/11/25 13:51:59, Mounir Lamouri wrote:
> On 2014/11/25 11:26:16, Mike West wrote:
> > Thanks, Mounir!
> > 
> >
https://codereview.chromium.org/758913002/diff/1/Source/core/dom/Document.idl
> > File Source/core/dom/Document.idl (right):
> > 
> >
>
https://codereview.chromium.org/758913002/diff/1/Source/core/dom/Document.idl...
> > Source/core/dom/Document.idl:60: readonly attribute DOMString? origin;
> > On 2014/11/25 11:02:13, Mounir Lamouri wrote:
> > > Mozilla patch and DOM spec says |readonly attribute DOMString origin;|.
> Could
> > > you point to the part of the spec that says that the origin should be null
> in
> > > some cases?
> > 
> > Nope. This was a mistake on my part; we can return the string "null", but
not
> > the object null. Fixed in the next patchset.
> 
> I'm trying to understand why you return 'null'.
> 
> Is it because of:
>
https://html.spec.whatwg.org/multipage/browsers.html#unicode-serialisation-of...
> and:
>
https://html.spec.whatwg.org/multipage/browsers.html#sandboxed-origin-browsin...
> ?

Correct. The string "null" is the serialization of a unique origin, which is
what you end up with when a document is sandboxed without the
'allow-same-origin' flag.

[mlamouri (slow - plz ping), 2014-11-25 14:37:50]

lgtm

https://codereview.chromium.org/758913002/diff/20001/Source/core/dom/Document.h
File Source/core/dom/Document.h (right):

https://codereview.chromium.org/758913002/diff/20001/Source/core/dom/Document...
Source/core/dom/Document.h:352: String origin() const { return
securityOrigin()->toString(); }
nit: could that be implemented in the cpp file and let the compiler decide
whether it should be inlined? I remember some Chrome Android folks complaining
about the binary size being bloated by forced inline such as this.

[jochen (gone - plz use gerrit), 2014-11-25 15:53:50]

https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
File LayoutTests/http/tests/security/document-origin.html (right):

https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
LayoutTests/http/tests/security/document-origin.html:6: <iframe id="srcdoc"
srcdoc="<p>yay</p>"></iframe>
where do you check the origin in the srcdoc?

https://codereview.chromium.org/758913002/diff/20001/Source/core/dom/Document...
File Source/core/dom/Document.idl (right):

https://codereview.chromium.org/758913002/diff/20001/Source/core/dom/Document...
Source/core/dom/Document.idl:60: readonly attribute DOMString origin;
is returning null for unique origins correct? Do you test it?

https://codereview.chromium.org/758913002/diff/20001/Source/core/dom/Document...
Source/core/dom/Document.idl:60: readonly attribute DOMString origin;
is returning null for unique origins correct? Do you test it?

[Mike West, 2014-11-25 15:56:35]

https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
File LayoutTests/http/tests/security/document-origin.html (right):

https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
LayoutTests/http/tests/security/document-origin.html:6: <iframe id="srcdoc"
srcdoc="<p>yay</p>"></iframe>
On 2014/11/25 15:53:49, jochen (slow) wrote:
> where do you check the origin in the srcdoc?

I thought I did, but I apparently didn't.

Fixing!

https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
LayoutTests/http/tests/security/document-origin.html:84:
assert_equals(e.data.origin, 'null');
This test and the one below test that sandboxed iframes return 'null'.

[Mike West, 2014-11-25 17:36:48]

On 2014/11/25 15:56:35, Mike West wrote:
>
https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
> File LayoutTests/http/tests/security/document-origin.html (right):
> 
>
https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
> LayoutTests/http/tests/security/document-origin.html:6: <iframe id="srcdoc"
> srcdoc="<p>yay</p>"></iframe>
> On 2014/11/25 15:53:49, jochen (slow) wrote:
> > where do you check the origin in the srcdoc?
> 
> I thought I did, but I apparently didn't.
> 
> Fixing!
> 
>
https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
> LayoutTests/http/tests/security/document-origin.html:84:
> assert_equals(e.data.origin, 'null');
> This test and the one below test that sandboxed iframes return 'null'.

Updated. Do you think this needs an intent, Jochen?

[jochen (gone - plz use gerrit), 2014-11-26 14:01:02]

On 2014/11/25 at 17:36:48, mkwst wrote:
> On 2014/11/25 15:56:35, Mike West wrote:
> >
https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
> > File LayoutTests/http/tests/security/document-origin.html (right):
> > 
> >
https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
> > LayoutTests/http/tests/security/document-origin.html:6: <iframe id="srcdoc"
> > srcdoc="<p>yay</p>"></iframe>
> > On 2014/11/25 15:53:49, jochen (slow) wrote:
> > > where do you check the origin in the srcdoc?
> > 
> > I thought I did, but I apparently didn't.
> > 
> > Fixing!
> > 
> >
https://codereview.chromium.org/758913002/diff/20001/LayoutTests/http/tests/s...
> > LayoutTests/http/tests/security/document-origin.html:84:
> > assert_equals(e.data.origin, 'null');
> > This test and the one below test that sandboxed iframes return 'null'.
> 
> Updated. Do you think this needs an intent, Jochen?

wouldn't hurt

[philipj_slow, 2014-11-28 09:07:30]

philipj@opera.com changed reviewers:
+ philipj@opera.com

[philipj_slow, 2014-11-28 09:07:31]

https://codereview.chromium.org/758913002/diff/40001/LayoutTests/http/tests/s...
File LayoutTests/http/tests/security/document-origin.html (right):

https://codereview.chromium.org/758913002/diff/40001/LayoutTests/http/tests/s...
LayoutTests/http/tests/security/document-origin.html:20: (function() {
You can get rid of the function blocks with async_test(function(t){t.step(...)},
"test name").

[Mike West, 2014-11-28 09:10:55]

https://codereview.chromium.org/758913002/diff/40001/LayoutTests/http/tests/s...
File LayoutTests/http/tests/security/document-origin.html (right):

https://codereview.chromium.org/758913002/diff/40001/LayoutTests/http/tests/s...
LayoutTests/http/tests/security/document-origin.html:20: (function() {
On 2014/11/28 09:07:31, philipj wrote:
> You can get rid of the function blocks with
async_test(function(t){t.step(...)},
> "test name").

Oh, cool.

I'll clean these up in a subsequent CL, along with the
http/tests/credentialmanager/ tests from which I copied the pattern. Thanks!

[philipj_slow, 2014-11-28 09:12:46]

https://codereview.chromium.org/758913002/diff/40001/LayoutTests/http/tests/s...
File LayoutTests/http/tests/security/document-origin-domain.html (right):

https://codereview.chromium.org/758913002/diff/40001/LayoutTests/http/tests/s...
LayoutTests/http/tests/security/document-origin-domain.html:17: document.domain
= "example.test";
Can you also assert the value of document.domain before and after setting it to
clearly show that document.origin and document.domain start out in agreement
(right?) and then disagree?

[Mike West, 2014-12-02 19:49:47]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2014-12-02 19:50:14]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/758913002/60001

[commit-bot: I haz the power, 2014-12-02 19:56:37]

Committed patchset #4 (id:60001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=186330