Changeset 233793 in webkit

Timestamp:

Jul 12, 2018, 8:13:19 PM (8 years ago)

Author:

dbates@webkit.org

Message:

JavaScript URL gives incorrect result when frame is navigated
​https://bugs.webkit.org/show_bug.cgi?id=187203
<rdar://problem/41438443>

Reviewed by David Kilzer.

• loader/SubframeLoader.cpp:

(WebCore::SubframeLoader::requestFrame):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• loader/SubframeLoader.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-07-12  Daniel Bates  <dabates@apple.com>
+
+        JavaScript URL gives incorrect result when frame is navigated
+        https://bugs.webkit.org/show_bug.cgi?id=187203
+        <rdar://problem/41438443>
+
+        Reviewed by David Kilzer.
+
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::requestFrame):
+
 2018-07-12  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/loader/SubframeLoader.cpp

@@ -37 +37 @@
 #include "DiagnosticLoggingClient.h"
 #include "DiagnosticLoggingKeys.h"
+#include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -86 +87 @@
         url = blankURL();
 
+    bool hasExistingFrame = ownerElement.contentFrame();
     Frame* frame = loadOrRedirectSubframe(ownerElement, url, frameName, lockHistory, lockBackForwardList);
     if (!frame)
         return false;
 
-    if (!scriptURL.isEmpty() && ownerElement.isURLAllowed(scriptURL))
+    // If we create a new subframe then an empty document is loaded into it synchronously and may
+    // cause script execution (say, via a DOM load event handler) that can do anything, including
+    // navigating the subframe. We only want to evaluate scriptURL if the frame has not been navigated.
+    bool canExecuteScript = hasExistingFrame || (frame->loader().documentLoader() && frame->loader().documentLoader()->originalURL() == blankURL());
+    if (!scriptURL.isEmpty() && canExecuteScript && ownerElement.isURLAllowed(scriptURL))
         frame->script().executeIfJavaScriptURL(scriptURL);