The following page creates an XMLHttpRequest object, makes a request to Google, and displays its progress in alerts: <html><body><script type="text/javascript"> var req = new XMLHttpRequest(); req.onreadystatechange = result; req.open("GET", "http://www.google.com", true); req.send(); function result() {alert(req.responseText);} </script></body></html> This works fine in Safari. However, it's also possible to use JavaScript to write to a new browser window, and it can even write JavaScript into the window. This also works in Safari. However, if we use JavaScript to write the above code, the XMLHttpRequest never gets sent. For example: <html><body><script type="text/javascript"> winRef=window.open(); winRef.document.writeln("<html><body><script type=\"text/javascript\">"); winRef.document.writeln("var req = new XMLHttpRequest();"); winRef.document.writeln("req.onreadystatechange = result;"); winRef.document.writeln("req.open(\"GET\", \"http://www.google.com\", true);"); winRef.document.writeln("req.send();"); winRef.document.writeln("function result() {alert(req.responseText);}"); winRef.document.writeln("<\/script></body></html>"); winRef.document.close(); </script></body></html>
The problem here is that the created document has an about:blank URL, so it isn't considered a local file, and isn't allowed to use XMLHttpRequest.
Created attachment 5244 [details] test case Safari: winRef.document.URL: file:///Users/ap/Desktop/4343.html document.URL: about:blank Firefox 1.5: winRef.document.URL: about:blank document.URL: file:///Users/ap/Desktop/4343.html
See also: bug 5292.
This was fixed in <http://trac.webkit.org/projects/webkit/changeset/34506> and related check-ins. Looks like this exact scenario doesn't have a test yet, so I'll make a patch to land a test for XHR from a pop-up window.
Created attachment 28218 [details] test case for landing
Comment on attachment 28218 [details] test case for landing r=me
Committed revision 41382.