Window.open() access is denied appears in the script - Access Denied Situation and Analysis_Basic Knowledge

Maybe some friends already know about this situation, but I still write down my analysis ideas for other friends’ reference.

Yesterday, I saved the blog page in another place to debug and change the blog skin locally.

Introduction:
I want to use script control to dynamically add the three buttons Run HTML code, CopyCode, and SaveCode to the multi-line text box with the css class name code_textarea when the onload page is loaded. inside.

Status description:
On the non-server side (that is, not debugging under the local server), all the buttons have appeared under the multi-line text box, but when debugging the script (click Run HTML code), " Access denied...Debugging on the server is normal.

Analysis:
Looking at the code, I found that there is an error in the script here. The code is as follows:
function fnRunHtmlCode(obj)
{
//try {
//if (typeof (obj)=="string") obj=document.getElementById(obj);
var wnd = window.open('', "_blank", '');
wnd.document.open('text /html', 'replace');
wnd.document.writeln(obj.value);
wnd.document.close();
//} catch(ex) { alert(ex.message ) };
};
Open with Mozilla, run the regex, and the script has no errors. After working on it for about half an hour, I deleted the rest of the code, copied the dynamically generated div and button codes in Mozilla to check, and copied the buttons dynamically loaded on IE to DW to check. There was no abnormality. Including running the above function on another page, it is still normal, and changing this function to window.open('','','') still access is denied.

Since access is denied, it must be cross-domain under normal circumstances. But for local debugging, no other code is added. How can it be cross-domain? Puzzled.
So I want to put it on the blog first. The strange thing is that it works fine if I put it on the server, so I put the local page on the local server and it works fine. This time it was even more strange. Is it an IE bug? Not true because the server can run. Code problem? This is not true because it works fine on other pages and no other code is involved. It's just a funtion, which means there must be something wrong with the downloaded page. Does the HTML page output by CSDN blog have code similar to document.domain?

Step-by-step debugging successful:
Remove all unnecessary parts of the original code (including Html). The final simplification is as follows:

<!-- saved from url=(0053)http://blog.csdn.net/BlueDestiny/category/184440.aspx --> <title>never-online 's Tech Blog In CSDN - JS & DHTML</title> <meta content="MSHTML 6.00.2800.1400" name="GENERATOR"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <div class="postText"> <textarea class="code_textarea" id="demo">

[Ctrl A Select all Note: If you need to introduce external Js, you need to refresh to execute