Changeset 273438 in webkit

Timestamp:

Feb 24, 2021, 2:03:41 PM (6 years ago)

Author:

Chris Dumez

Message:

Regression(r268700) postMessage changes prototype of basic types
​https://bugs.webkit.org/show_bug.cgi?id=222228
<rdar://problem/74612853>

Reviewed by Geoffrey Garen.

Source/WebCore:

r268700 updated ScriptExecutionContext::globalObject() to call:
WebCore::globalObject(mainThreadNormalWorld(), downcast<Document>(*this).page())
instead of
frame ? frame->script().globalObject(mainThreadNormalWorld()) : nullptr

This was not right for subframes because globalObject() gets the globalObject from
the page's main frame instead of the document's frame.

This patch gets rid of the error-prone WebCore::globalObject() taking in a Page*
and replaces it with one taking in a Frame* to avoid such issues in the future.

Test: fast/dom/Window/postMessage-Object-prototype.html

• bindings/js/ScriptState.cpp:

(WebCore::globalObject):

• bindings/js/ScriptState.h:
• dom/ScriptExecutionContext.cpp:

(WebCore::ScriptExecutionContext::globalObject):

• inspector/InspectorFrontendHost.cpp:

(WebCore::InspectorFrontendHost::addSelfToGlobalObjectInWorld):
(WebCore::InspectorFrontendHost::showContextMenu):

LayoutTests:

Add layout test coverage.

• fast/dom/Window/postMessage-Object-prototype-expected.txt: Added.
• fast/dom/Window/postMessage-Object-prototype.html: Added.
• fast/dom/Window/resources/postMessage-Object-prototype-frame.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/Window/postMessage-Object-prototype-expected.txt (added)
• LayoutTests/fast/dom/Window/postMessage-Object-prototype.html (added)
• LayoutTests/fast/dom/Window/resources/postMessage-Object-prototype-frame.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/ScriptState.cpp (modified) (1 diff)
• Source/WebCore/bindings/js/ScriptState.h (modified) (2 diffs)
• Source/WebCore/dom/ScriptExecutionContext.cpp (modified) (1 diff)
• Source/WebCore/inspector/InspectorFrontendHost.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-02-24  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r268700) postMessage changes prototype of basic types
+        https://bugs.webkit.org/show_bug.cgi?id=222228
+        <rdar://problem/74612853>
+
+        Reviewed by Geoffrey Garen.
+
+        Add layout test coverage.
+
+        * fast/dom/Window/postMessage-Object-prototype-expected.txt: Added.
+        * fast/dom/Window/postMessage-Object-prototype.html: Added.
+        * fast/dom/Window/resources/postMessage-Object-prototype-frame.html: Added.
+
 2021-02-24  Jonathan Bedard  <jbedard@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-02-24  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r268700) postMessage changes prototype of basic types
+        https://bugs.webkit.org/show_bug.cgi?id=222228
+        <rdar://problem/74612853>
+
+        Reviewed by Geoffrey Garen.
+
+        r268700 updated ScriptExecutionContext::globalObject() to call:
+        `WebCore::globalObject(mainThreadNormalWorld(), downcast<Document>(*this).page())`
+        instead of
+        `frame ? frame->script().globalObject(mainThreadNormalWorld()) : nullptr`
+
+        This was not right for subframes because globalObject() gets the globalObject from
+        the page's main frame instead of the document's frame.
+
+        This patch gets rid of the error-prone WebCore::globalObject() taking in a Page*
+        and replaces it with one taking in a Frame* to avoid such issues in the future.
+
+        Test: fast/dom/Window/postMessage-Object-prototype.html
+
+        * bindings/js/ScriptState.cpp:
+        (WebCore::globalObject):
+        * bindings/js/ScriptState.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::globalObject):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::addSelfToGlobalObjectInWorld):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+
 2021-02-24  Ziran Sun  <zsun@igalia.com>
 

trunk/Source/WebCore/bindings/js/ScriptState.cpp

@@ -93 +93 @@
 }
 
-JSC::JSGlobalObject* globalObject(DOMWrapperWorld& world, Page* page)
+JSC::JSGlobalObject* globalObject(DOMWrapperWorld& world, Frame* frame)
 {
-    return page ? page->mainFrame().script().globalObject(world) : nullptr;
+    return frame ? frame->script().globalObject(world) : nullptr;
 }
 

trunk/Source/WebCore/bindings/js/ScriptState.h

@@ -43 +43 @@
 class Frame;
 class Node;
-class Page;
 class ScriptExecutionContext;
 class WorkerOrWorkletGlobalScope;
@@ -54 +53 @@
 
 JSC::JSGlobalObject* globalObject(DOMWrapperWorld&, Node*);
-WEBCORE_EXPORT JSC::JSGlobalObject* globalObject(DOMWrapperWorld&, Page*);
+WEBCORE_EXPORT JSC::JSGlobalObject* globalObject(DOMWrapperWorld&, Frame*);
 JSC::JSGlobalObject* globalObject(WorkerOrWorkletGlobalScope&);
 

trunk/Source/WebCore/dom/ScriptExecutionContext.cpp

@@ -513 +513 @@
 {
     if (is<Document>(*this))
-        return WebCore::globalObject(mainThreadNormalWorld(), downcast<Document>(*this).page());
+        return WebCore::globalObject(mainThreadNormalWorld(), downcast<Document>(*this).frame());
 
     if (is<WorkerOrWorkletGlobalScope>(*this))

trunk/Source/WebCore/inspector/InspectorFrontendHost.cpp

@@ -159 +159 @@
 void InspectorFrontendHost::addSelfToGlobalObjectInWorld(DOMWrapperWorld& world)
 {
-    auto& lexicalGlobalObject = *globalObject(world, m_frontendPage);
+    auto& lexicalGlobalObject = *globalObject(world, m_frontendPage ? &m_frontendPage->mainFrame() : nullptr);
     auto& vm = lexicalGlobalObject.vm();
     JSC::JSLockHolder lock(vm);
@@ -504 +504 @@
     ASSERT(m_frontendPage);
 
-    auto& lexicalGlobalObject = *globalObject(debuggerWorld(), m_frontendPage);
+    auto& lexicalGlobalObject = *globalObject(debuggerWorld(), &m_frontendPage->mainFrame());
     auto& vm = lexicalGlobalObject.vm();
     auto value = lexicalGlobalObject.get(&lexicalGlobalObject, JSC::Identifier::fromString(vm, "InspectorFrontendAPI"));