Does IE8 Really Pass Acid2? [Updated]

thevirtualcat found some inconsistencies in IE8's Acid2 results that made him wonder what's going on. Can anyone replicate these results or, better yet, explain them?
Update: 03/22 23:54 GMT by KD : Several readers pointed out this has to do with cross-site scripting prevention, as described here.

Comments

The answer...

[26199]

As TFA mentions (at the very end!) this is explained here.

Summary: cross-site security means that if you move the test off the original domain, the test changes. In fact IE8 does the wrong (nonstandard) thing in these cases, but according to them it's more secure (it fails earlier). They're considering making it more standards compliant once they're convinced it's secure enough.

Re:The answer...

[kat_skan]

Actually, Microsoft is not correct. The browser is supposed to be unable to load the object that is tripping IE's cross-domain security features. Regardless of whether the object fails to load because of security policies or because the resource flat out doesn't exist, the test is constructed so that the browser will display the fallback content for the object, which IE does not do.

Re:The answer...

[cheater512]

Microsoft did the correct thing with the cross domain scripting stuff.

However they then ignore the fall back content hence the problem.
The standard says that if there is a problem with the object tag then the html inside the html tag should be shown.
IE8 has a problem with the object tag and then ignores the fallback completely.

Why does it work on the official site?
Because its not cross scripting anymore, instead it fetches the page and gets a 404.
It then uses the fallback content.

In summary: Microsoft is making their own standard as per usual.

Re:The answer...

[pohl]

So the behaviour mandated by the standard is insecure?

No, that is not the case. IE8 is trying to prevent exploitation of their own, proprietary ActiveX API, and simply needs to make some minor corrections to make sure that they do it in such a way that does not violate the standards. The standards don't need to be revised since nobody else implements the swiss cheese that is ActiveX.

Re:On another note... Acid3

[Your.Master]

The IE team announced their internal IE8 build passed Acid2 in mid-December. Acid3 was released March 3. IE8's first public beta went out on March 5.

Re:I smell bullshit at the IE blog

[Chris Snook]

IE8 is using ActiveX *internally* because it can't natively render the html OBJECT. Invoking ActiveX triggers XSS checks. The bottom line is that they technically pass the test, but many web designers will do things that really should work, but won't in IE8. It's not because MS is cheating, just that they haven't fully implemented this feature, and they're erring on the side of caution with their partial implementation. Regardless of standards compliance, they'll need to fix this before IE8 is released.

Re:Simple stuff like CSS

[Bogtha]

Auto margins failing to centre block elements is a hallmark of quirks mode, which means that you aren't using a doctype, which means that you are writing invalid code, which means that you aren't in any position to criticise others for not following the specifications.

Re:Yes, that's true.

[Bogtha]

The Acid3 test is a NEW test that uses/tests the NEW feature that the CSS3 intoduces.

Let's do exactly what you suggest, and "RTFM". From the Acid3 page at webstandards.org, with links to the specifications and dates added by me:

Here is the list of specifications tested:

• DOM2 Core [specification published in 2000.]
• DOM2 Events [specification published in 2000.]
• DOM2 HTML [specification published in 2003.]
• DOM2 Range [specification published in 2000.]
• DOM2 Style (getComputedStyle, ...) [specification published in 2000.]
• DOM2 Traversal (NodeIterator, TreeWalker) [specification published in 2000.]
• DOM2 Views (defaultView) [specification published in 2000.]
• ECMAScript [specification published in 1997, although I could only locate the third edition, published in 1999.]
• HTML4 (<object>, <iframe>, ...) [specification published in 1997.]
• HTTP (Content-Type, 404, ...) [specification published in 1999.]
• Media Queries [specification published in 2002.]
• Selectors (:lang, :nth-child(), combinators, dynamic changes, ...) [specification published in 2001 , with some of it part of the CSS 2.0 specification published in 1998 .]
• XHTML 1.0 [specification published in 2000.]
• CSS2 (@font-face) [specification published in 1998.]
• CSS2.1 ('inline-block', 'pre-wrap', parsing...) [specification published in 2007.]
• CSS3 Color (rgba(), hsla(), ...) [specification published in 2003.]
• CSS3 UI ('cursor') [specification published in 2004.]
• data: URIs [specification published in 1998.]
• SVG (SVG Animation, SVG Fonts, ...) [specification published in 2001.]

As you can see, the majority of the Acid3 test is comprised of behaviour described in specifications published years ago, with a substantial portion of them over five years old and some over a decade old.

CSS3 intoduces many changes,

Actually, CSS 3 is not a single specification, but a group of