Inserting an iframe into a non-fully active document creates a child navigable #13085

Activity

1. zcorpan commented on Oct 16, 2026

   

   zcorpan

   on Oct 16, 2026

   MemberAuthor

   More actions

   cc @foolip
2. zcorpan

   added

   topic: frames/navigables/browsing contexts

   on Oct 16, 2026
3. shannonbooth commented on Oct 16, 2026

   

   shannonbooth

   on Oct 16, 2026

   Member

   More actions

   https://github.com/LadybirdBrowser/ladybird/blob/2347e56772355691ec1ba1487d06120f3d4a2176/Libraries/LibWeb/HTML/HTMLIFrameElement.cpp#L108 not that it matters too much for webcompat purposes, but we actually have the exact workaround suggested here, but I hadn't gotten around to filing spec issue / fixing yet since there are some other workarounds I hadn't investigated fully yet
4. zcorpan commented on Oct 19, 2026

   

   zcorpan

   on Oct 19, 2026

   MemberAuthor

   More actions

   Thanks @shannonbooth, good to know!

   I asked Claude to look into what Gecko, Chromium, and WebKit do here, and what the options for a spec fix are:

   In the crashtest's case, Gecko, Chromium, and WebKit bail out because the old document lost its window/frame when the iframe navigated:

   • Gecko: nsFrameLoader::CreateBrowsingContext returns null since the owner document has no inner window. MaybeCreateDocShell also rejects documents that aren't IsActive(), which includes bfcached ones.
   • Chromium: HTMLFrameElementBase::DidNotifySubtreeInsertionsToDocument returns if the document has no frame; FrameLoader::DetachDocument shuts down the old document, which clears it.
   • WebKit: HTMLFrameElementBase::postConnectionSteps returns if the document has no frame; Document::willBeRemovedFromFrame detaches it on navigation.

   All three only put top-level pages in bfcache (Gecko, Chromium, WebKit), so an iframe's own navigation destroys its previous document. The spec allows that, since intendToKeepInBfcache in unload a document is up to the user agent. So this is reachable in a user agent that keeps such documents, or for a document in a bfcached page that script can still reach (e.g., from an opener).

   Options:

   1. Return early from the iframe and frame post-connection steps if the node document isn't fully active. object already checks this when determining what it represents, and so does embed's "potentially active". This matches Ladybird and Gecko's IsActive() check.
   2. Require intendToKeepInBfcache to be false for child navigables' documents, to match browsers. Then traversing back within an iframe repopulates the entry instead of reusing the document, since destroying it sets the entry's document to null. That doesn't cover documents in a bfcached page, so 1 seems needed either way.