chrome - Dave's Blog


Tweet from David Rousset

2016 Dec 6, 8:45
Creating an extension for all browsers: , , , & : 

Tweet from Šime Vidas

2016 Nov 17, 3:14
Chrome Canary has enabled scroll anchoring which prevents “jumps” when the layout above the viewport changes (demo: )

Tweet from emily schechter

2016 Sep 8, 1:12
in Chrome 56, we'll mark HTTP pages with password or credit card form fields as "not secure". turn on HTTPS before! 

Tweet from David Risney

2016 Jun 5, 4:10
I played Chrome, Edge, FF & IE against each other in WebDriverChess. Edge just beats out Firefox for #1. Results: 

Tweet from Eric Lawrence

2016 Jun 2, 10:32
Chrome relaxes IDN display of Punycode (old restrictions were like IE) to match Firefox instead: 

Retweet of stevefaulkner

2016 Feb 10, 4:57
Chrome change breaks the visual viewport … by @ppk via @powrsurg

Retweet of securinti

2016 Feb 4, 6:11
[WRITE-UP] A tale of two offline @google Chrome UXSS vulns! …

Retweet of tobint

2015 Jul 29, 3:54
Thanks, @googlechrome! The icing suffers from rendering/layout issues. It's what's inside that counts! What's inside?

Retweet of ChromiumDev

2015 Apr 14, 7:29
Now in Chrome 43, document.execCommand() gives you programmatic access to copy and cut content to the clipboard! …

Retweet of sleevi_

2015 Apr 7, 2:41
Rad to see Mozilla in on the fun! For Chrome, see!topic/blink-dev/2LXKVWYkOus … and!topic/security-dev/pnsUO-KxzTs … // @metromoxie …

Tweet from David_Risney

2015 Mar 26, 4:20
Anyone know why Chrome percent-encodes single quote in URI query?  Its a reserved char so encoding changes URI.

Tweet from David_Risney

2015 Mar 24, 9:59
Chrome to implement pointer events!!topic/blink-dev/ODWmcKNQl0I …

Tweet from David_Risney

2015 Mar 19, 11:31
Push messaging and notifications are landing in Chrome 42. … via @ChromiumDev

Tweet from David_Risney

2015 Mar 11, 9:57
Chrome moving Service Worker's fetch() API to the window. Like XHR but with promises … via @ChromiumDev

Retweet of mrlacey

2015 Mar 1, 6:42
Chrome is not one browser

Retweet of bai0

2015 Feb 7, 12:49
@textfiles @jwz I added some more turtles. VRML in NS2 in WebGL on Chrome on an Oculus Rift. Achievement unlocked.

Subtleties of postMessage

2013 Jul 15, 1:00

In IE10 and other new browsers one may create MessageChannel objects that have two MessagePorts each connected (w3c spec calls it entangled) to one another such that postMessage on one port results in the message event firing on the other. You can pass an array of ports as the last parameter to postMessage and they show up in the ports property of the message event arg.


The postMessage here is like the worker postMessage and unlike the window and iframe postMessage in that it applies no origin checking:

  1. No origin postMessage in workers and MessagePorts: postMessage(messageData, ports)
  2. Origin postMessage in windows and iframes: postMessage(messageData, targetOrigin, ports)

Unfortunately the origin isn't an optional parameter at the end to make the two postMessages have the same signature.

On the event handler side, the event arg always has an origin property. But in the no origin case it is always the empty string.


There is also a source property on the message event arg which if set is an object that has a postMessage property allowing you to post back to your caller. It is set for the origin case, however, in the no origin case this property is null. This is somewhat reasonable because in the case of MessagePort and Workers there are only two endpoints so you always know the source of a message implicitly. Unlike the origin case in which any iframe or window can be calling postMessage on any other iframe or window and the caller is unknown. So not unreasonable but it would be nice if the source property was always set for consistency.

MessageChannel start

When a MessageChannel is created it has two MessagePorts, but until those ports are started they will queue up any messages they receive. Once started they will dispatch all queued messages. Ports don't have to be started to send messages.

A port may be started in two ways, either by explicitly calling the start method on the port, or by setting the onmessage callback property on the port. However, adding an event listener via addEventListener("message", does not start the port. It works this way in IE and Chrome and the spec states this as well.

The justification is that since you can have only one callback via onmessage that once set you must implicitly be ready to receive messages and its fine to start the port. As opposed to the addEventListener in which case the user agent cannot start implicitly because it doesn't know how many event listeners will be added.  I found Hixie stating this justification in geoloc meeting notes.


W3C Spec

Opera introduction

PermalinkCommentsDOM html javascript postMessage technical web-worker worker

Everybody hates Firefox updates - Evil Brain Jono's Natural Log

2012 Jul 16, 1:59

Former FireFox developer on the switch to their continuous update cycle. 

Oh no, Chrome is doing such-and-such; we’d better do something equivalent or we’ll fall behind! We thought we needed a rapid update process like Chrome. We were jealous of their rapid update capability, which let them deploy improvements to users continuously. We had to “catch up” with Chrome’s updating capability.

Dealing with servicing on IE for years had led me to some of the same thoughts when I heard FireFox was switching to continuous updates.

PermalinkCommentsfirefox via:ericlaw web-browser technical web browser servicing update software

A Tale Of Two Pwnies (Part 2)

2012 Jun 11, 6:39

Summary of one of the Chrome security exploits from pwn2own.  Basically XSS into the chrome URI scheme which gives access to special APIs.

PermalinkCommentstechnical browser web-browser security xss

Try Chrome in Metro mode

2012 Jun 7, 3:34

Early Chrome for Win8 Metro!

PermalinkCommentschrome google web-browser web metro win8 windows technical
Older Entries Creative Commons License Some rights reserved.