Service Worker: Clients.openWindow() should allow opening x-origin URLs

Service Worker: Clients.openWindow() should allow opening x-origin URLs

Clients.openWindow(url) with a cross-origin url currently rejects with
a SecurityError exception. As per spec:
https://slightlyoff.github.io/ServiceWorker/spec/service_worker/index.html#clients-openwindow
it should open a window and resolve with null.

Checked the expected behavior with @jakearchibald.

Corresponding blink changes: https://codereview.chromium.org/985633003/

BUG=464680

[jungkees, 2015-03-06 10:51:16]

jungkee.song@samsung.com changed reviewers:
+ falken@chromium.org, jakearchibald@google.com, jsbell@chromium.org,
mlamouri@chromium.org

[jsbell, 2015-03-06 16:59:36]

https://codereview.chromium.org/984853003/diff/1/content/browser/service_work...
File content/browser/service_worker/service_worker_version.cc (right):

https://codereview.chromium.org/984853003/diff/1/content/browser/service_work...
content/browser/service_worker/service_worker_version.cc:1155: url)));
I agree this matches the spec, but it's a little weird. An on-origin request
could end up redirecting to an off-origin location. An off-origin request could
end up redirecting to an on-origin - even controlled - location.

[mlamouri (slow - plz ping), 2015-03-06 17:07:20]

What would happen if you open "chrome://settings"?

[jungkees, 2015-03-09 05:52:35]

On 2015/03/06 17:07:20, Mounir Lamouri wrote:
> What would happen if you open "chrome://settings"?

Yes, I'm fine with mlamouri@'s patch: https://codereview.chromium.org/980383004/

So, should I close this issue by myself? (Trying to follow the convention.)

[jungkees, 2015-03-09 05:53:01]

https://codereview.chromium.org/984853003/diff/1/content/browser/service_work...
File content/browser/service_worker/service_worker_version.cc (right):

https://codereview.chromium.org/984853003/diff/1/content/browser/service_work...
content/browser/service_worker/service_worker_version.cc:1155: url)));
On 2015/03/06 16:59:36, jsbell wrote:
> I agree this matches the spec, but it's a little weird. An on-origin request
> could end up redirecting to an off-origin location. An off-origin request
could
> end up redirecting to an on-origin - even controlled - location. 

Filed: https://github.com/slightlyoff/ServiceWorker/issues/646

It seems the document's address after navigation with redirects is set to the
original request's url, though.
(https://html.spec.whatwg.org/multipage/browsers.html#set-the-document's-address)

[jungkees, 2015-03-09 07:26:58]

Closing as commented in https://codereview.chromium.org/985633003/.