Whenever there is a domain mismatch and the domain name is set explicitly by a java script method, the Java Script Console message should display the domain names along with the error message.
What are the cases when this doesn't happen? Looking at error messages I have in the console now, I do see domain names (even with shipping 10.4 Safari/WebKit): Unsafe JavaScript attempt to access frame with URL http://newsru.com/finance/06aug2007/kurs.html from frame with URL http://ads.adfox.ru/715/test?p1=cnj&p2=nj&p3=0&p4=a&pr=328653&pt=on&pd=6&pw=1&pv=16&pq=b&pn=b. Domains must match.
(In reply to comment #1) > What are the cases when this doesn't happen? The domains shown are the ones from the URLs of loaded pages. But in some cases "domain relaxing" is performed using Javascript, per IE domain-relaxing rules. In this case we should show the internal document.domain attribute to let web developers know if their domain relaxing code is working correctly. This would help reveal issues with domain-relaxing Javascript code.
Same error for me in Safari 4.0.4... no JavaScript. Take a look at: http://www.eazyshoppinglist.com/ just HTML & CSS
I'm fairly certain we now do this, see the 'document.domain' set of messages in DOMWindow::crossDomainAccessErrorMessage: http://trac.webkit.org/browser/trunk/Source/WebCore/page/DOMWindow.cpp#L1841 I'll dupe this against https://bugs.webkit.org/show_bug.cgi?id=96247 where that landed. *** This bug has been marked as a duplicate of bug 96247 ***