Changeset 195496 in webkit


Ignore:
Timestamp:
Jan 22, 2016 5:04:59 PM (8 years ago)
Author:
Chris Dumez
Message:

Document.open / Document.write should be prevented while the document is being unloaded
​https://bugs.webkit.org/show_bug.cgi?id=153255
<rdar://problem/22741293>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Document.open / Document.write should be prevented while the document
is being unloaded, as per the HTML specification:

This patch is aligning our behavior with the specification and Firefox.
Calling Document.open / Document.write during the document was being
unloaded would cause us to crash as this was unexpected.

Tests: fast/frames/page-hide-document-open.html

fast/frames/page-unload-document-open.html

  • WebCore.xcodeproj/project.pbxproj:

Add new IgnoreOpensDuringUnloadCountIncrementer.h header.

  • dom/Document.cpp:

(WebCore::Document::open):
Abort if the document's ignore-opens-during-unload counter is greater
than zero, as per:
​https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)

(WebCore::Document::write):
Abort if the insertion point is undefined and the document's
ignore-opens-during-unload counter is greater than zero, as per:
​https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)

  • dom/Document.h:

Add data member to maintain the document's ignore-opens-during-unload counter:
​https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter

  • dom/IgnoreOpensDuringUnloadCountIncrementer.h: Added.

Add utility class to increment / decrement a document's
ignore-opens-during-unload counter.

  • history/CachedFrame.cpp:

(WebCore::CachedFrame::CachedFrame):
When a page goes into PageCache, we don't end up calling
FrameLoader::detachChildren() so we need to increment the document's
ignore-opens-during-unload counter before calling stopLoading() on each
subframe.

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::detachChildren):
detachChildren() will end up firing the pagehide / unload events in each
child frame so we increment the parent frame's document's
ignore-opens-during-unload counter. This behavior matches the text of:
​https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document

As per the spec, the document's ignore-opens-during-unload counter should
be incremented before firing the pagehide / unload events at the document's
Window object. It should be decremented only after firing the pagehide /
unload events in each subframe. This is needed in case a subframe tries to
call document.open / document.write on a parent frame's document, from its
pagehide or unload handler.

(WebCore::FrameLoader::dispatchUnloadEvents):
Increment the document's ignore-opens-during-unload counter before firing
the pagehide / unload events and decrement it after. As per the spec, we
are not supposed to decrement this early. We actually supposed to wait
until the pagehide / unload events have been fired in all the subframes.
For this reason, we take care of re-incrementing the document's
ignore-opens-during-unload in detachChildren(), which will take care of
firing the pagehide / unload in the subframes.

LayoutTests:

Add layout tests that cover calling Document.open / Document.write from
unload and pagehide handlers.

  • fast/frames/page-hide-document-open-expected.txt: Added.
  • fast/frames/page-hide-document-open.html: Added.
  • fast/frames/page-unload-document-open-expected.txt: Added.
  • fast/frames/page-unload-document-open.html: Added.
  • fast/frames/resources/finish-test.html: Added.
  • fast/frames/resources/page-hide-document-open-frame.html: Added.
  • fast/frames/resources/page-hide-document-open-win.html: Added.
  • fast/frames/resources/page-unload-document-open-frame.html: Added.
  • fast/frames/resources/page-unload-document-open-win.html: Added.
Location:
trunk
Files:
10 added
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r195495 r195496  
     12016-01-22  Chris Dumez  <cdumez@apple.com>
     2
     3        Document.open / Document.write should be prevented while the document is being unloaded
     4        https://bugs.webkit.org/show_bug.cgi?id=153255
     5        <rdar://problem/22741293>
     6
     7        Reviewed by Ryosuke Niwa.
     8
     9        Add layout tests that cover calling Document.open / Document.write from
     10        unload and pagehide handlers.
     11
     12        * fast/frames/page-hide-document-open-expected.txt: Added.
     13        * fast/frames/page-hide-document-open.html: Added.
     14        * fast/frames/page-unload-document-open-expected.txt: Added.
     15        * fast/frames/page-unload-document-open.html: Added.
     16        * fast/frames/resources/finish-test.html: Added.
     17        * fast/frames/resources/page-hide-document-open-frame.html: Added.
     18        * fast/frames/resources/page-hide-document-open-win.html: Added.
     19        * fast/frames/resources/page-unload-document-open-frame.html: Added.
     20        * fast/frames/resources/page-unload-document-open-win.html: Added.
     21
    1222016-01-22  Brady Eidson  <beidson@apple.com>
    223

  • trunk/Source/WebCore/ChangeLog

    r195495 r195496  
     12016-01-22  Chris Dumez  <cdumez@apple.com>
     2
     3        Document.open / Document.write should be prevented while the document is being unloaded
     4        https://bugs.webkit.org/show_bug.cgi?id=153255
     5        <rdar://problem/22741293>
     6
     7        Reviewed by Ryosuke Niwa.
     8
     9        Document.open / Document.write should be prevented while the document
     10        is being unloaded, as per the HTML specification:
     11        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
     12        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)
     13
     14        This patch is aligning our behavior with the specification and Firefox.
     15        Calling Document.open / Document.write during the document was being
     16        unloaded would cause us to crash as this was unexpected.
     17
     18        Tests: fast/frames/page-hide-document-open.html
     19               fast/frames/page-unload-document-open.html
     20
     21        * WebCore.xcodeproj/project.pbxproj:
     22        Add new IgnoreOpensDuringUnloadCountIncrementer.h header.
     23
     24        * dom/Document.cpp:
     25        (WebCore::Document::open):
     26        Abort if the document's ignore-opens-during-unload counter is greater
     27        than zero, as per:
     28        https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
     29
     30        (WebCore::Document::write):
     31        Abort if the insertion point is undefined and the document's
     32        ignore-opens-during-unload counter is greater than zero, as per:
     33        https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)
     34
     35        * dom/Document.h:
     36        Add data member to maintain the document's ignore-opens-during-unload counter:
     37        https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter
     38
     39        * dom/IgnoreOpensDuringUnloadCountIncrementer.h: Added.
     40        Add utility class to increment / decrement a document's
     41        ignore-opens-during-unload counter.
     42
     43        * history/CachedFrame.cpp:
     44        (WebCore::CachedFrame::CachedFrame):
     45        When a page goes into PageCache, we don't end up calling
     46        FrameLoader::detachChildren() so we need to increment the document's
     47        ignore-opens-during-unload counter before calling stopLoading() on each
     48        subframe.
     49
     50        * loader/FrameLoader.cpp:
     51        (WebCore::FrameLoader::detachChildren):
     52        detachChildren() will end up firing the pagehide / unload events in each
     53        child frame so we increment the parent frame's document's
     54        ignore-opens-during-unload counter. This behavior matches the text of:
     55        https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document
     56
     57        As per the spec, the document's ignore-opens-during-unload counter should
     58        be incremented before firing the pagehide / unload events at the document's
     59        Window object. It should be decremented only after firing the pagehide /
     60        unload events in each subframe. This is needed in case a subframe tries to
     61        call document.open / document.write on a parent frame's document, from its
     62        pagehide or unload handler.
     63
     64        (WebCore::FrameLoader::dispatchUnloadEvents):
     65        Increment the document's ignore-opens-during-unload counter before firing
     66        the pagehide / unload events and decrement it after. As per the spec, we
     67        are not supposed to decrement this early. We actually supposed to wait
     68        until the pagehide / unload events have been fired in all the subframes.
     69        For this reason, we take care of re-incrementing the document's
     70        ignore-opens-during-unload in detachChildren(), which will take care of
     71        firing the pagehide / unload in the subframes.
     72
    1732016-01-22  Brady Eidson  <beidson@apple.com>
    274

  • trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj

    r195443 r195496  
    17011701                463EB6231B8789E00096ED51 /* TagCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 463EB6211B8789CB0096ED51 /* TagCollection.h */; };
    17021702                4669B2871B852A0B000F905F /* JSDOMNamedFlowCollectionCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 46F2768E1B85297F005C2556 /* JSDOMNamedFlowCollectionCustom.cpp */; };
     1703                467302021C4EFE7800BCB357 /* IgnoreOpensDuringUnloadCountIncrementer.h in Headers */ = {isa = PBXBuildFile; fileRef = 467302011C4EFE6600BCB357 /* IgnoreOpensDuringUnloadCountIncrementer.h */; };
    17031704                4689F1AF1267BAE100E8D380 /* FileMetadata.h in Headers */ = {isa = PBXBuildFile; fileRef = 4689F1AE1267BAE100E8D380 /* FileMetadata.h */; };
    17041705                46C83EFD1A9BBE2900A79A41 /* GeoNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 46C83EFB1A9BBE2900A79A41 /* GeoNotifier.cpp */; };
    … …  
    91219122                463EB6201B8789CB0096ED51 /* TagCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TagCollection.cpp; sourceTree = "<group>"; };
    91229123                463EB6211B8789CB0096ED51 /* TagCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TagCollection.h; sourceTree = "<group>"; };
     9124                467302011C4EFE6600BCB357 /* IgnoreOpensDuringUnloadCountIncrementer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IgnoreOpensDuringUnloadCountIncrementer.h; sourceTree = "<group>"; };
    91239125                4689F1AE1267BAE100E8D380 /* FileMetadata.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FileMetadata.h; sourceTree = "<group>"; };
    91249126                46C83EFB1A9BBE2900A79A41 /* GeoNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeoNotifier.cpp; sourceTree = "<group>"; };
    … …  
    2400524007                                C3CF17A315B0063F00276D39 /* IdTargetObserverRegistry.h */,
    2400624008                                8AB4BC76126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h */,
     24009                                467302011C4EFE6600BCB357 /* IgnoreOpensDuringUnloadCountIncrementer.h */,
    2400724010                                AA4C3A740B2B1679002334A2 /* InlineStyleSheetOwner.cpp */,
    2400824011                                AA4C3A750B2B1679002334A2 /* InlineStyleSheetOwner.h */,
    … …  
    2562525628                                2E75841E12779ADA0062628B /* FileReaderLoader.h in Headers */,
    2562625629                                2E75841F12779ADA0062628B /* FileReaderLoaderClient.h in Headers */,
     25630                                467302021C4EFE7800BCB357 /* IgnoreOpensDuringUnloadCountIncrementer.h in Headers */,
    2562725631                                2EDF369D122C94B4002F7D4E /* FileReaderSync.h in Headers */,
    2562825632                                2EF1BFEB121C9F4200C27627 /* FileStream.h in Headers */,

  • trunk/Source/WebCore/dom/Document.cpp

    r195452 r195496  
    476476    , m_frameElementsShouldIgnoreScrolling(false)
    477477    , m_updateFocusAppearanceRestoresSelection(SelectionRestorationMode::SetDefault)
    478     , m_ignoreDestructiveWriteCount(0)
    479478    , m_markers(std::make_unique<DocumentMarkerController>(*this))
    480479    , m_updateFocusAppearanceTimer(*this, &Document::updateFocusAppearanceTimerFired)
    … …  
    24982497void Document::open(Document* ownerDocument)
    24992498{
     2499    if (m_ignoreOpensDuringUnloadCount)
     2500        return;
     2501
    25002502    if (ownerDocument) {
    25012503        setURL(ownerDocument->url());
    … …  
    28462848
    28472849    bool hasInsertionPoint = m_parser && m_parser->hasInsertionPoint();
    2848     if (!hasInsertionPoint && m_ignoreDestructiveWriteCount)
     2850    if (!hasInsertionPoint && (m_ignoreOpensDuringUnloadCount || m_ignoreDestructiveWriteCount))
    28492851        return;
    28502852

  • trunk/Source/WebCore/dom/Document.h

    r195485 r195496  
    13391339    friend class Node;
    13401340    friend class IgnoreDestructiveWriteCountIncrementer;
     1341    friend class IgnoreOpensDuringUnloadCountIncrementer;
    13411342
    13421343    void updateTitleElement(Element* newTitleElement);
    … …  
    15291530    SelectionRestorationMode m_updateFocusAppearanceRestoresSelection;
    15301531
    1531     // http://www.whatwg.org/specs/web-apps/current-work/#ignore-destructive-writes-counter
    1532     unsigned m_ignoreDestructiveWriteCount;
     1532    // https://html.spec.whatwg.org/multipage/webappapis.html#ignore-destructive-writes-counter
     1533    unsigned m_ignoreDestructiveWriteCount { 0 };
     1534
     1535    // https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter
     1536    unsigned m_ignoreOpensDuringUnloadCount { 0 };
    15331537
    15341538    unsigned m_styleRecalcCount { 0 };

  • trunk/Source/WebCore/history/CachedFrame.cpp

    r194496 r195496  
    4040#include "HistoryController.h"
    4141#include "HistoryItem.h"
     42#include "IgnoreOpensDuringUnloadCountIncrementer.h"
    4243#include "Logging.h"
    4344#include "MainFrame.h"
    … …  
    158159    frame.loader().stopLoading(UnloadEventPolicyUnloadAndPageHide);
    159160
    160     // Create the CachedFrames for all Frames in the FrameTree.
    161     for (Frame* child = frame.tree().firstChild(); child; child = child->tree().nextSibling())
    162         m_childFrames.append(std::make_unique<CachedFrame>(*child));
     161    {
     162        // The following will fire the pagehide event in each subframe and the HTML specification states
     163        // that the parent document's ignore-opens-during-unload counter should be incremented while the
     164        // pagehide event is being fired in its subframes:
     165        // https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document
     166        IgnoreOpensDuringUnloadCountIncrementer ignoreOpensDuringUnloadCountIncrementer(m_document.get());
     167
     168        // Create the CachedFrames for all Frames in the FrameTree.
     169        for (Frame* child = frame.tree().firstChild(); child; child = child->tree().nextSibling())
     170            m_childFrames.append(std::make_unique<CachedFrame>(*child));
     171    }
    163172
    164173    // Active DOM objects must be suspended before we cache the frame script data,

  • trunk/Source/WebCore/loader/FrameLoader.cpp

    r195494 r195496  
    7878#include "HistoryItem.h"
    7979#include "IconController.h"
     80#include "IgnoreOpensDuringUnloadCountIncrementer.h"
    8081#include "InspectorController.h"
    8182#include "InspectorInstrumentation.h"
    … …  
    24272428void FrameLoader::detachChildren()
    24282429{
     2430    // detachChildren() will fire the unload event in each subframe and the
     2431    // HTML specification states that the parent document's ignore-opens-during-unload counter while
     2432    // this event is being fired in its subframes:
     2433    // https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document
     2434    IgnoreOpensDuringUnloadCountIncrementer ignoreOpensDuringUnloadCountIncrementer(m_frame.document());
     2435
    24292436    Vector<Ref<Frame>, 16> childrenToDetach;
    24302437    childrenToDetach.reserveInitialCapacity(m_frame.tree().childCount());
    … …  
    28792886    // We store the frame's page in a local variable because the frame might get detached inside dispatchEvent.
    28802887    ForbidPromptsScope forbidPrompts(m_frame.page());
     2888    IgnoreOpensDuringUnloadCountIncrementer ignoreOpensDuringUnloadCountIncrementer(m_frame.document());
    28812889
    28822890    if (m_didCallImplicitClose && !m_wasUnloadEventEmitted) {
Note: See TracChangeset for help on using the changeset viewer.