how can unregister()'s same-origin check ever fail?

[wanderview]

Currently the first step of unregister is:

1. If the origin of job’s scope url is not job’s client's origin, then:
  1. Invoke Reject Job Promise with job and "SecurityError" DOMException.
  2. Invoke Finish Job with job and abort these steps.

In this case the scope URL is the scope from the ServiceWorkerRegistration. For this to fail a ServiceWorkerRegistration would have to be exposed in a cross-origin client context.

That doesn't seem possible... And if it is, there are probably bigger problems we need to fix.

Can we remove these steps from the spec?