Why Isn't IE8 Passing Acid2?

Acid2 Smiley Face

Although we said that IE8 Beta 1 passes the ACID2 test, some of you may be seeing results like the image above; we thought we should explain what’s going on. IE8 passes the official ACID2 test hosted on https://www.webstandards.org/files/acid2/test.html. (Note, this seems to be a popular destination at the moment. You may have trouble reaching the site.)There are also a number of copies of this test around the net. One popular copy that I’ve seen of late is https://acid2.acidtests.org/

IE8 fails the copies of ACID2 due to the cross domain security checks IE performs for ActiveX controls.  Since IE does not natively handle HTML content in the OBJECT tag, but rather uses IE’s rendering engine as an ActiveX to display this HTML content, the same cross domain security checks also apply.

Given that, let’s take a look at how the acidtests.org copy from above relies on OBJECT fallback to render the eyes. Here’s the snippet of the test for the eyes:

<object data="data:application/x-unknown,ERROR">

<object data="https://www.damowmow.com/404/" type="text/html">

                <object data=”data:*the eyes DATAURI* …>

</object>

</object>

IE stops the OBJECT fallback process at the highlighted line above.  The team and I involved in this work decided that this is the right thing to do because IE would have to allow navigation to this cross domain content in order to determine if the failed resource is a 404 HTTP error code or any of the other failed resource indicators that are part of the standard.  To maintain compatibility and be secure by default we didn’t want to invoke fallback either, as original web authors might not have intended this behavior.  We started with the most secure solution and are now looking into whether we can safely loosen this restriction in a future beta. 
With all that said let’s also take a look at the official ACID2 page hosted by www.webstandards.org:

We see:

<object data="data:application/x-unknown,ERROR">

<object data="https://www.webstandards.org/404/" type="text/html">

     <object data="data:*the eyes DATAURI *>

</object>

</object>

Note that we see the same domain as the test, so everything works fine.  It’s worth mentioning that although most sites allow navigation like https://webstandards.org (note: the no www) this is also considered a cross domain access as www.webstandards.org != webstandards.org.  This will also cause us to fail the ACID2 test and render the picture that you see above. So please type www.webstandards.org!

Phil Nachreiner
Internet Explorer Developer

Edit: Added a space in first paragraph