Trusted Types sinks use this's relevant global object, but engines use the node document's #13113

What is the issue with the HTML Standard?

HTML's Trusted Types sinks pass this's relevant global object, which doesn't change when an element is adopted into another document. For example, Element's innerHTML setter:

Let (compliantString, compliantOptions) be the result of invoking the get trusted type compliant input algorithm with this's relevant global object, the given value, ...

setHTMLUnsafe(), insertAdjacentHTML(), HTMLScriptElement's src, etc. do the same.

Trusted Types' own attribute handling uses the node document instead (get trusted type compliant attribute value):

element's node document's relevant global object as global

Chrome Canary, Firefox Nightly and Safari TP seem to use the node document for the HTML sinks too. Given a document with require-trusted-types-for 'script' and a same-origin iframe without it, calling innerHTML, setHTMLUnsafe() and insertAdjacentHTML() with a string from the iframe's realm:

• throws a TypeError for a div created in the iframe and adopted into the TT document, and
• doesn't throw for a div created in the TT document and adopted into the iframe's document.

The trusted-types/Element-setAttribute-respects-Elements-node-documents-globals-CSP-after-adoption-* tests check the same thing for attributes.

Maybe HTML's sinks should use this's node document's relevant global object instead, to match engines and Trusted Types' attribute handling. (Found in #12758.)