DocumentTimeline constructor is probably a security hole

[bzbarsky]

https://w3c.github.io/web-animations/#dom-documenttimeline-documenttimeline says:

Creates a new DocumentTimeline object associated with the active document of the current browsing context.

but the active document of any browsing context need not be same-origin with the code calling the constructor, nor same origin-domain, or same anything, really.

I really doubt any browsers implementing this API do anything remotely involving getting the active document of any browsing context here. I know for a fact Firefox does not. It uses the document of the "current global", as defined at https://html.spec.whatwg.org/multipage/webappapis.html#current-global-object, which is guaranteed to be a Window in this case.

[bzbarsky]

Oh, and I should note that it's not even clear what "current browsing context" means. But fixing this to not use "active document" will likely make that problem go away too.

[birtles]

Oops, I actually meant to push 6d2ddc9 to a branch and get @bzbarsky to review. Hopefully it is ok.

[bzbarsky]

Yes, that looks reasonable.

[birtles]

Great, thanks Boris!