COEP reporting for workers: fix which variable to use for 'owner'

[zcorpan]

Fixes #6518

cc @whatwg/cross-origin-isolation

• At least two implementers are interested (and none opposed):
  • chromium
  • (This is a spec bug fix for something AFAIK other browsers haven't yet implemented)
• Tests are written and can be reviewed and commented upon at:
  • Test COEP reporting in workers and nested workers web-platform-tests/wpt#28261
  • Test 'current environment settings object' for Worker() URL parsing and COEP report web-platform-tests/wpt#28313
• Implementation bugs are filed:
  • Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=1060837
  • Firefox: N/A
  • Safari: N/A

(See WHATWG Working Mode: Changes for more details.)

---

/workers.html ( diff )

[mikewest]

This looks like a bug fix that doesn't change intended behavior. LGTM!

[zcorpan]

Looks like a relevant test here was added in https://chromium-review.googlesource.com/c/chromium/src/+/2650015 (reporting-to-owner.https.html) but was then reverted in https://chromium-review.googlesource.com/c/chromium/src/+/2717382

Reporting for workers in workers doesn't seem to be covered in that test though.

[yutakahirano]

cc: @d0iasm

[zcorpan]

Test written here: web-platform-tests/wpt#28261

[d0iasm]

Thank you for updating the test and the spec!
Let me clarify the behavior.

• when a document creates a worker, reports are sent to the document with the invalid COEP worker loading.
• when a worker (A) creates a child worker (B), reports are sent to the worker (A) with the invalid worker (B) loading.

Is my understanding correct?

[zcorpan]

That matches my understanding, though which document "the document" is depends on how the Worker constructor was invoked.

https://html.spec.whatwg.org/multipage/workers.html#dom-worker

Let outside settings be the current settings object.

I'll try to submit a test for this today for COEP report for worker, but essentially, the environment settings object that the Worker constructor algorithm uses for parsing scriptURL is the same as the one that should be used for the COEP report.

[zcorpan]

OK, test that exercises "entry environment settings object" vs "incumbent environment settings object" vs "current environment settings object": web-platform-tests/wpt#28313

[domenic]

Thanks for going the extra mile on testing!!