When loading a MHTML document, we set the base URL to the actual URL of the encoded document. This is done right after the notification that the frame was committed. It should be done before, so when the notification happens the base URL is correctly set on the document.
Created attachment 115933 [details] Patch
Comment on attachment 115933 [details] Patch Clearing flags on attachment: 115933 Committed r100852: <http://trac.webkit.org/changeset/100852>
All reviewed patches have been landed. Closing bug.