Resolve nested element URL getters against the owning document base

[wieslawsoltes]

Parent: #267. Related: #264, #903.

Reproduced in installed unchanged Code OSS

The signed AppScene/WebScene Release from WebScene 5b4739c8, AppScene
36d7a82e and unchanged Code OSS 645f29cc loads the virtual-HTTPS
Markdown prelude. Its nested iframe is owned by that prelude document and
authored as ./fake.html?id=.... In a bounded main-realm native probe,
frame.ownerDocument.baseURI is the virtual-HTTPS prelude URL, while
reading frame.src returns a loopback http://127.0.0.1:<port>/fake.html.
The authored attribute remains relative. Evidence is recorded in
vscode-demo/docs/validation/markdown-preview-layout-20260921.md and
build/appscene-webview-398/native-preview-36d7a82-final-diagnostic.log.

webscene_v8_runtime_dom_properties.inc::get_element_url resolves reflected
src/href against current_base_address(), which selects the caller's
document. Other owner-sensitive paths use effective_document_base and
css_cascade_root_for_node. This observation does not prove the actual
nested navigation requested the wrong origin; that request has a separate
resolution path.

Proposed focused fix and gates

Resolve URL-valued element properties against the element's owning document
base, including same-origin cross-document reads and <base> changes. Keep
getAttribute authored, navigation request URLs and cross-origin access
policy separate. Add a browser-referenced nested relative iframe.src,
img.src, and a.href contract, plus native direct caller/owner realm,
detached node, base mutation, and virtual-origin checks. Compare Chromium
before/after; ensure no additional resource requests or retained documents.
Then rerun unchanged Markdown preview; do not close webview acceptance until
its content paints and passes layout/security/lifecycle/performance gates.

[wieslawsoltes]

Focused WebScene PR #905 is open at f9e89f1a. It resolves connected nested element URL getters against the owner document base, preserving authored attributes and navigation/security paths. Its Release native iframe lifecycle gate passes: connected nested a.href and input.src before/after <base> mutation, 100 create/load/write/replace/remove cycles, 1 MiB update p95 3.73 ms versus the 250 ms bound, and flat 1,849,528-byte heap. A checked-in Chrome 152 headless reference returns PASS. The full WPT matrix, detached-node semantics and unchanged Markdown rendering remain open. The PR is awaiting its related CI runners and will merge when those pass; consolidation PR #76 remains open.

[wieslawsoltes]

Focused PR #905 merged as WebScene 4715b38d on 21 September. The demo locally pins that merge at cbb08c4b/ff404ad7 and remains unpushed. The connected nested href/src getter and <base> mutation regression passed in the native 100-cycle iframe lifecycle gate; checked-in Chrome 152 reference passed. The change-related Linux CI build/test passed before merge, and superseded queued PR workflows were canceled afterward. Keep #904 open for the remaining detached/virtual-origin URL matrix, WPT runner qualification, and unchanged Markdown installed acceptance. The latest signed diagnostic app predates #905 and still shows a 0×0 overlay; #903 owns that CSS/layout blocker. No refreshed #905 SDK/app acceptance is claimed yet.