We have Winter 16 preview sandbox and can see that Canvas App is rendered now as iframe in iframe (there is outer and inner iframes now). Before this release there was just one iframe. For now I'm not sure if issue below is caused by changes in canvas rendering behavior, but are these changes described anywhere since I can't locate it in Release Notes?
We also use parent.postMessage(message, targetOrigin) function on canvas page to fire some js functions in parent window that contains canvas and use "targetOrigin" parameter of canvas signed request. Now, in Winter 16 postMessage fails with "Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://cs11.salesforce.com') does not match the recipient window's origin ('https://c.cs11.visual.force.com').". It means that "targetOrigin" parameter of canvas signed request is pointing to "https://cs11.salesforce.com" in Winter 16, however in Summer 15 release where there are no iframe in iframe "targetOrigin" parameter of canvas signed request is pointing to correct URL - 'https://c.cs11.visual.force.com'. Is it some kind of SF issue passing incorrect targetOrigin in canvas signed request in Winter 16?