Changeset 243848 in webkit

Timestamp:

Apr 3, 2019, 8:09:48 PM (7 years ago)

Author:

Chris Dumez

Message:

The page's focusedFrame / frameSetLargestFrame do not get cleared on process swap or crash
​https://bugs.webkit.org/show_bug.cgi?id=196588
<rdar://problem/49365787>

Reviewed by Ryosuke Niwa.

Source/WebKit:

The page's focusedFrame / frameSetLargestFrame do not get cleared on process swap or crash.
This can lead to returning stale frames to the client if it asks for those.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::resetState):

Tools:

Add API test coverage.

• TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp:

(TestWebKitAPI::nullJavaScriptCallback):
(TestWebKitAPI::didCrashCheckFrames):
(TestWebKitAPI::TEST):

Location:

trunk

Files:

• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/UIProcess/WebPageProxy.cpp (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp (modified) (3 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2019-04-03  Chris Dumez  <cdumez@apple.com>
+
+        The page's focusedFrame / frameSetLargestFrame do not get cleared on process swap or crash
+        https://bugs.webkit.org/show_bug.cgi?id=196588
+        <rdar://problem/49365787>
+
+        Reviewed by Ryosuke Niwa.
+
+        The page's focusedFrame / frameSetLargestFrame do not get cleared on process swap or crash.
+        This can lead to returning stale frames to the client if it asks for those.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::resetState):
+
 2019-04-03  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -6776 +6776 @@
 {
     m_mainFrame = nullptr;
+    m_focusedFrame = nullptr;
+    m_frameSetLargestFrame = nullptr;
 
 #if PLATFORM(COCOA)

trunk/Tools/ChangeLog

@@ +1 @@
+2019-04-03  Chris Dumez  <cdumez@apple.com>
+
+        The page's focusedFrame / frameSetLargestFrame do not get cleared on process swap or crash
+        https://bugs.webkit.org/show_bug.cgi?id=196588
+        <rdar://problem/49365787>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add API test coverage.
+
+        * TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp:
+        (TestWebKitAPI::nullJavaScriptCallback):
+        (TestWebKitAPI::didCrashCheckFrames):
+        (TestWebKitAPI::TEST):
+
 2019-04-03  Jonathan Bedard  <jbedard@apple.com>
 

trunk/Tools/TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp

@@ -31 +31 @@
 #include "PlatformWebView.h"
 #include "Test.h"
+#include <WebKit/WKPagePrivate.h>
 #include <WebKit/WKRetainPtr.h>
+#include <signal.h>
 
 namespace TestWebKitAPI {
@@ -37 +39 @@
 static bool loadBeforeCrash = false;
 static bool loadAfterCrash = false;
+static bool calledCrashHandler = false;
 
 static void didFinishLoad(WKPageRef page, WKNavigationRef, WKTypeRef userData, const void* clientInfo)
@@ -89 +92 @@
 }
 
+static void nullJavaScriptCallback(WKSerializedScriptValueRef, WKErrorRef, void*)
+{
+}
+
+static void didCrashCheckFrames(WKPageRef page, const void*)
+{
+    // Test if first load actually worked.
+    EXPECT_TRUE(loadBeforeCrash);
+
+    EXPECT_TRUE(!WKPageGetMainFrame(page));
+    EXPECT_TRUE(!WKPageGetFocusedFrame(page));
+    EXPECT_TRUE(!WKPageGetFrameSetLargestFrame(page));
+
+    calledCrashHandler = true;
+}
+
+TEST(WebKit, FocusedFrameAfterCrash)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreateWithConfiguration(nullptr));
+    PlatformWebView webView(context.get());
+
+    WKPageNavigationClientV0 loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+
+    loaderClient.base.version = 0;
+    loaderClient.didFinishNavigation = didFinishLoad;
+    loaderClient.webProcessDidCrash = didCrashCheckFrames;
+
+    WKPageSetPageNavigationClient(webView.page(), &loaderClient.base);
+
+    WKRetainPtr<WKURLRef> url = adoptWK(Util::createURLForResource("many-iframes", "html"));
+    WKPageLoadURL(webView.page(), url.get());
+    Util::run(&loadBeforeCrash);
+
+    EXPECT_FALSE(!WKPageGetMainFrame(webView.page()));
+
+    WKRetainPtr<WKStringRef> javaScriptString(AdoptWK, WKStringCreateWithUTF8CString("frames[2].focus()"));
+    WKPageRunJavaScriptInMainFrame(webView.page(), javaScriptString.get(), 0, nullJavaScriptCallback);
+
+    while (!WKPageGetFocusedFrame(webView.page()))
+        Util::spinRunLoop(10);
+
+    kill(WKPageGetProcessIdentifier(webView.page()), 9);
+
+    Util::run(&calledCrashHandler);
+}
+
+TEST(WebKit, FrameSetLargestFramAfterCrash)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreateWithConfiguration(nullptr));
+    PlatformWebView webView(context.get());
+
+    WKPageNavigationClientV0 loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+
+    loaderClient.base.version = 0;
+    loaderClient.didFinishNavigation = didFinishLoad;
+    loaderClient.webProcessDidCrash = didCrashCheckFrames;
+
+    WKPageSetPageNavigationClient(webView.page(), &loaderClient.base);
+
+    WKRetainPtr<WKURLRef> baseURL = adoptWK(WKURLCreateWithUTF8CString("about:blank"));
+    WKRetainPtr<WKStringRef> htmlString = Util::toWK("<frameset cols='25%,*,25%'><frame src='about:blank'><frame src='about:blank'><frame src='about:blank'></frameset>");
+
+    WKPageLoadHTMLString(webView.page(), htmlString.get(), baseURL.get());
+    Util::run(&loadBeforeCrash);
+
+    EXPECT_FALSE(!WKPageGetMainFrame(webView.page()));
+
+    while (!WKPageGetFrameSetLargestFrame(webView.page()))
+        Util::spinRunLoop(10);
+
+    kill(WKPageGetProcessIdentifier(webView.page()), 9);
+
+    Util::run(&calledCrashHandler);
+}
+
 } // namespace TestWebKitAPI