Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Adam Barth
On Tue, Jan 8, 2013 at 5:56 AM, Boris Zbarsky bzbar...@mit.edu wrote: On 1/8/13 8:14 AM, Boris Zbarsky wrote: On 1/8/13 2:09 AM, Ian Hickson wrote: In the spec's security model, origins are never relevant for elements except when we're looking at the element's data. Yes. I think the spec's

Re: [whatwg] Script-related feedback

2013-01-09 Thread Adam Barth
On Mon, Jan 7, 2013 at 7:51 PM, Ian Hickson i...@hixie.ch wrote: On Mon, 7 Jan 2013, Adam Barth wrote: Why not just introduce a keyword or pragma to JavaScript that tells the user agent to act as if the end of the Program production had been reached, and that it should treat the remainder

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Boris Zbarsky
On 1/9/13 3:11 AM, Adam Barth wrote: I'm not convinced of that. I understand that Gecko need to deal with these complications because of a number of Mozilla-proprietary APIs, Actually, what I'm talking about here has nothing to do with APIs but everything to do with wanting to write web

[whatwg] Canvas 2D memory management

2013-01-09 Thread Ashley Gullen
Some developers are starting to design large scale games using our HTML5 game engine, and we're finding we're running in to memory management issues. Consider a device with 50mb of texture memory available. A game might contain 100mb of texture assets, but only use a maximum of 30mb of them at a

Re: [whatwg] Proposal: Add CanvasRenderingContext2D.fillRule with nonzero (default) and evenodd options

2013-01-09 Thread Dean Jackson
On 09/01/2013, at 4:08 PM, Dirk Schulze dschu...@adobe.com wrote: On Jan 8, 2013, at 9:35 AM, Rik Cabanier caban...@gmail.com wrote: I looked at pdf2js which is using this fillRule property. As I expected, introduction of the property results in code like this: eoFill: function

Re: [whatwg] Proposal: Add CanvasRenderingContext2D.fillRule with nonzero (default) and evenodd options

2013-01-09 Thread Rik Cabanier
Thanks for investigating this! I opened a moderately complex file [1] and it had 19200 fills. The overhead in ms then becomes enumboolean Firefox .5 .25 Safari.9 .6 Chrome 1.1 8 Opera3 1.6 This is assuming that the extra

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Adam Barth
It seems like your arguments all originate from wanting to support an asymmetric access relation. Supporting an asymmetric access relation is a bad idea, and we shouldn't do it. I understand that Mozilla already has technology for implementing an asymmetric access relation and that you're using

Re: [whatwg] Proposal: Add CanvasRenderingContext2D.fillRule with nonzero (default) and evenodd options

2013-01-09 Thread Rik Cabanier
On Wed, Jan 9, 2013 at 10:27 AM, Dean Jackson d...@apple.com wrote: On 09/01/2013, at 4:08 PM, Dirk Schulze dschu...@adobe.com wrote: On Jan 8, 2013, at 9:35 AM, Rik Cabanier caban...@gmail.com wrote: I looked at pdf2js which is using this fillRule property. As I expected,

Re: [whatwg] Canvas in Workers

2013-01-09 Thread Stephen White
On Thu, Jan 3, 2013 at 7:46 PM, Gregg Tavares g...@google.com wrote: On Tue, Dec 11, 2012 at 9:04 AM, Ian Hickson i...@hixie.ch wrote: On Tue, 11 Dec 2012, Gregg Tavares (社ç~T¨) wrote: discussion seems to have died down here but I'd like to bring up another issue In WebGL land

Re: [whatwg] Proposal: Add CanvasRenderingContext2D.fillRule with nonzero (default) and evenodd options

2013-01-09 Thread Dirk Schulze
On Jan 9, 2013, at 11:42 AM, Rik Cabanier caban...@gmail.commailto:caban...@gmail.com wrote: On Wed, Jan 9, 2013 at 10:27 AM, Dean Jackson d...@apple.commailto:d...@apple.com wrote: On 09/01/2013, at 4:08 PM, Dirk Schulze dschu...@adobe.commailto:dschu...@adobe.com wrote: On Jan 8,

Re: [whatwg] Canvas in Workers

2013-01-09 Thread Ian Hickson
On Wed, 9 Jan 2013, Stephen White wrote: Right now by 2d canvases are effectively single buffered. At the appropriate time a copy of the canvas is made and passed to the compositor. This copy is slow, especially on mobile. Currently, to lower the VRAM footprint and improve

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Boris Zbarsky
On 1/9/13 2:30 PM, Adam Barth wrote: As a consequence, I would recommend that you do not use asymmetric access relations in features that you would like other browser vendors to implement in the future. Browsers have asymmetric access relations all the time; they just have some of the code

Re: [whatwg] Canvas in Workers

2013-01-09 Thread Justin Novosad
On Wed, Jan 9, 2013 at 2:50 PM, Stephen White senorbla...@chromium.orgwrote: Currently, to lower the VRAM footprint and improve performance, we don't do a copy in 2d canvas. We temporarily transfer ownership of the texture to the compositor at commit time, and block the renderer until the

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Boris Zbarsky
On 1/9/13 3:12 PM, Adam Barth wrote: As I've stated several times on this thread (any many times over the years), my opinion is that we should not expose an asymmetric access relation to the web platform. OK, let's agree to disagree on this one for now. Do we at least agree that this code:

Re: [whatwg] Script-related feedback

2013-01-09 Thread Ian Hickson
On Wed, 9 Jan 2013, Adam Barth wrote: Working through some examples, that seems really strange: foo(); breakParsing(); bar(); In this case, breakParsing() works a bit like yield() in other programming languages: first foo() executes, then the event loop spins, then bar() executes.

Re: [whatwg] Canvas in Workers

2013-01-09 Thread Ian Hickson
On Wed, 9 Jan 2013, James Robinson wrote: On Wed, Jan 9, 2013 at 11:59 AM, Ian Hickson i...@hixie.ch wrote: On Wed, 9 Jan 2013, Stephen White wrote: Right now by 2d canvases are effectively single buffered. At the appropriate time a copy of the canvas is made and passed to the

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Adam Barth
On Wed, Jan 9, 2013 at 12:23 PM, Boris Zbarsky bzbar...@mit.edu wrote: On 1/9/13 3:12 PM, Adam Barth wrote: As I've stated several times on this thread (any many times over the years), my opinion is that we should not expose an asymmetric access relation to the web platform. OK, let's agree

Re: [whatwg] Proposal: Add CanvasRenderingContext2D.fillRule with nonzero (default) and evenodd options

2013-01-09 Thread Rik Cabanier
Thanks for your feedback! Based on this, I propose the following: 1. create an enum for the winding rule: enum CanvasWindingRule { nonzero http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-context-2d-fillrule-nonzero, evenodd

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Ian Hickson
On Wed, 9 Jan 2013, Adam Barth wrote: The Document interface (which is what we started this thread discussing) is never visible across origins and so does not have any of these complexities. Actually Document objects can be visible across origins per spec, but none of their properties ever

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Anne van Kesteren
On Tue, Jan 8, 2013 at 7:46 AM, Boris Zbarsky bzbar...@mit.edu wrote: Actually, that's not enough. You have to security-check arguments too. Otherwise this: document.createTreeWalker(crossFrameDoc, etc); would be bad. (Note that right now the DOM spec fails to handle this, which is

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Adam Barth
On Wed, Jan 9, 2013 at 1:28 PM, Ian Hickson i...@hixie.ch wrote: On Wed, 9 Jan 2013, Adam Barth wrote: The Document interface (which is what we started this thread discussing) is never visible across origins and so does not have any of these complexities. Actually Document objects can be

Re: [whatwg] seamless iframes and event propagation

2013-01-09 Thread Anne van Kesteren
On Tue, Jan 8, 2013 at 6:32 PM, Dimitri Glazkov dglaz...@chromium.org wrote: 1) For a tree a -- [shadow root] - b -- [shadow root] - c (where - denotes child-parent relationship and -- denotes host-root relationship) 2) if an event is dispatched on c 3) where is the event target's adjusted?

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Boris Zbarsky
On 1/9/13 4:12 PM, Adam Barth wrote: window.addEventListener.call(otherWindow, click, function() {}); This example does not appear to throw an exception in Chrome. It appears to just returns undefined without doing anything (except logging a security error to the debug console). Hmm. I

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Boris Zbarsky
On 1/9/13 4:33 PM, Adam Barth wrote: For what it's worth, that doesn't appear to be necessary for web compatibility. Any time WebKit would return a Document to a script in another origin, WebKit returns null instead. The HTML spec requires that property access on documents use effective

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Boris Zbarsky
On 1/9/13 4:28 PM, Anne van Kesteren wrote: You didn't file a bug on this I think. Yes, because the DOM spec is not the right place to address it, imo. -Boris

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Boris Zbarsky
On 1/9/13 5:19 PM, Adam Barth wrote: Those checks are neither required for compatibility nor security. The spec might say to perform the checks, but they aren't needed to build a secure, compatible browser. OK. So what checks do you believe are required, then? Just effective script origin

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread James Graham
On Wed, 9 Jan 2013, Boris Zbarsky wrote: On 1/9/13 4:12 PM, Adam Barth wrote: window.addEventListener.call(otherWindow, click, function() {}); This example does not appear to throw an exception in Chrome. It appears to just returns undefined without doing anything (except logging a

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Adam Barth
On Wed, Jan 9, 2013 at 2:18 PM, Boris Zbarsky bzbar...@mit.edu wrote: On 1/9/13 4:33 PM, Adam Barth wrote: For what it's worth, that doesn't appear to be necessary for web compatibility. Any time WebKit would return a Document to a script in another origin, WebKit returns null instead. The

Re: [whatwg] Including HTML more directly into SVG

2013-01-09 Thread Rik Cabanier
On Fri, Dec 28, 2012 at 8:59 PM, Ian Hickson i...@hixie.ch wrote: On Mon, 10 Sep 2012, Tab Atkins Jr. wrote: 1. Check out http://www.xanthir.com/etc/railroad-diagrams/example.html . See all those boxes full of text in the diagrams? Looks simple, right? Just a box filled with text, with

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Adam Barth
On Wed, Jan 9, 2013 at 2:24 PM, Boris Zbarsky bzbar...@mit.edu wrote: On 1/9/13 5:19 PM, Adam Barth wrote: Those checks are neither required for compatibility nor security. The spec might say to perform the checks, but they aren't needed to build a secure, compatible browser. OK. So what

[whatwg] `window.location.origin` in sandboxed IFrames.

2013-01-09 Thread Mike West
Hello! In WebKit, loading 'iframe sandbox=allow-scripts src=frame.html/iframe' with a framed document containing 'scriptalert(window.location.origin);/script' alerts the actual origin of the document, which wasn't what I expected. I'm not sure what's intended, but I expected that treating the

Re: [whatwg] Including HTML more directly into SVG

2013-01-09 Thread Dirk Schulze
On Jan 9, 2013, at 2:18 PM, Rik Cabanier caban...@gmail.com wrote: On Fri, Dec 28, 2012 at 8:59 PM, Ian Hickson i...@hixie.ch wrote: On Mon, 10 Sep 2012, Tab Atkins Jr. wrote: 1. Check out http://www.xanthir.com/etc/railroad-diagrams/example.html . See all those boxes full of text in

Re: [whatwg] Including HTML more directly into SVG

2013-01-09 Thread Rik Cabanier
On Wed, Jan 9, 2013 at 3:26 PM, Dirk Schulze dschu...@adobe.com wrote: On Jan 9, 2013, at 2:18 PM, Rik Cabanier caban...@gmail.com wrote: On Fri, Dec 28, 2012 at 8:59 PM, Ian Hickson i...@hixie.ch wrote: On Mon, 10 Sep 2012, Tab Atkins Jr. wrote: 1. Check out

Re: [whatwg] Proposal: Add CanvasRenderingContext2D.fillRule with nonzero (default) and evenodd options

2013-01-09 Thread James Ascroft-Leigh
Hi, Thanks Rik for your counter proposal and thanks everyone for helping to refine it. I am in full agreement that an evenodd or nonzero argument to the fill() and clip() operations is better than a state property. The only thing I can think of in favor of the fillRule property that prompted

Re: [whatwg] Proposal: Add CanvasRenderingContext2D.fillRule with nonzero (default) and evenodd options

2013-01-09 Thread Rik Cabanier
On Wed, Jan 9, 2013 at 3:56 PM, James Ascroft-Leigh j...@jwal.me.uk wrote: Hi, Thanks Rik for your counter proposal and thanks everyone for helping to refine it. I am in full agreement that an evenodd or nonzero argument to the fill() and clip() operations is better than a state property.

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Ian Hickson
On Wed, 9 Jan 2013, Adam Barth wrote: On Wed, Jan 9, 2013 at 1:28 PM, Ian Hickson i...@hixie.ch wrote: On Wed, 9 Jan 2013, Adam Barth wrote: The Document interface (which is what we started this thread discussing) is never visible across origins and so does not have any of these

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Ian Hickson
On Wed, 9 Jan 2013, Boris Zbarsky wrote: On 1/9/13 4:33 PM, Adam Barth wrote: For what it's worth, that doesn't appear to be necessary for web compatibility. Any time WebKit would return a Document to a script in another origin, WebKit returns null instead. The HTML spec requires that

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Ian Hickson
On Wed, 9 Jan 2013, James Graham wrote: On Wed, 9 Jan 2013, Boris Zbarsky wrote: On 1/9/13 4:12 PM, Adam Barth wrote: window.addEventListener.call(otherWindow, click, function() {}); This example does not appear to throw an exception in Chrome. It appears to just returns

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Ian Hickson
On Wed, 9 Jan 2013, Anne van Kesteren wrote: On Tue, Jan 8, 2013 at 7:46 AM, Boris Zbarsky bzbar...@mit.edu wrote: Actually, that's not enough. You have to security-check arguments too. Otherwise this: document.createTreeWalker(crossFrameDoc, etc); would be bad. (Note that right

[whatwg] Canvas: compositing and blending operator as enumeration?

2013-01-09 Thread Dirk Schulze
Hi, After all the discussions about winding rules and the new introduced enumeration for nonzero and even odd, I wonder if the the compositing and blending modes should be two enumerations as well. enum CanvasCompositingMode { source-over, source-in, … } and enum

[whatwg] Reporting errors during Web Worker startup

2013-01-09 Thread Kenneth Russell
http://www.whatwg.org/specs/web-apps/current-work/multipage/workers.html#creating-workers doesn't seem to define what happens if there aren't enough resources to create a separate parallel execution environment. Would it be legal for a UA to consider this as violating a policy decision and throw

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

2013-01-09 Thread Boris Zbarsky
Adam, thank you for taking the time to put this together. I really appreciate it. There are lots of things here where we can converge behavior no matter what happens with other pieces of the platform. On 1/9/13 5:58 PM, Adam Barth wrote: Generally speaking, I'd recommend exposing as few

Re: [whatwg] Canvas: compositing and blending operator as enumeration?

2013-01-09 Thread Rik Cabanier
Hi Dirk, the 'globalCompositeOperation' property takes the same syntax as the css 'mix' so I don't think an enum will work. Rik On Wed, Jan 9, 2013 at 6:18 PM, Dirk Schulze dschu...@adobe.com wrote: Hi, After all the discussions about winding rules and the new introduced enumeration for

Re: [whatwg] Registration points for elements

2013-01-09 Thread Mikko Rantalainen
Ian Hickson, 2013-01-08 18:23 (Europe/Helsinki): You can do this with anything in HTML, using absolute positioning: set just one of the coordinates in each direction, and leave the other on 'auto'. As in: div { position: absolute: bottom: 10em; right: 10em; width: auto;