Changeset 195628 in webkit

Timestamp:

Jan 26, 2016 3:22:18 PM (8 years ago)

Author:

Chris Dumez

Message:

document.open() / write() should be prevented in beforeunload event handlers
​https://bugs.webkit.org/show_bug.cgi?id=153432

Reviewed by Ryosuke Niwa.

Source/WebCore:

document.open() / write() should be prevented in beforeunload event handlers:

• ​https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
• ​https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)
• ​https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter
• ​https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document

Test: fast/frames/page-beforeunload-document-open.html

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::dispatchBeforeUnloadEvent):

LayoutTests:

Add a layout test to check that document.open() / write() is indeed
prevented inside 'beforeunload' event handlers.

• fast/frames/page-beforeunload-document-open-expected.txt: Added.
• fast/frames/page-beforeunload-document-open.html: Added.
• fast/frames/resources/page-beforeunload-document-open-frame.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/frames/page-beforeunload-document-open-expected.txt (added)
• LayoutTests/fast/frames/page-beforeunload-document-open.html (added)
• LayoutTests/fast/frames/resources/page-beforeunload-document-open-frame.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/FrameLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-01-26  Chris Dumez  <cdumez@apple.com>
+
+        document.open() / write() should be prevented in beforeunload event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=153432
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a layout test to check that document.open() / write() is indeed
+        prevented inside 'beforeunload' event handlers.
+
+        * fast/frames/page-beforeunload-document-open-expected.txt: Added.
+        * fast/frames/page-beforeunload-document-open.html: Added.
+        * fast/frames/resources/page-beforeunload-document-open-frame.html: Added.
+
 2016-01-26  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-01-26  Chris Dumez  <cdumez@apple.com>
+
+        document.open() / write() should be prevented in beforeunload event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=153432
+
+        Reviewed by Ryosuke Niwa.
+
+        document.open() / write() should be prevented in beforeunload event handlers:
+        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
+        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)
+        - https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter
+        - https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document
+
+        Test: fast/frames/page-beforeunload-document-open.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchBeforeUnloadEvent):
+
 2016-01-26  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/loader/FrameLoader.cpp

@@ -2952 +2952 @@
     {
         ForbidPromptsScope forbidPrompts(m_frame.page());
+        IgnoreOpensDuringUnloadCountIncrementer ignoreOpensDuringUnloadCountIncrementer(m_frame.document());
         domWindow->dispatchEvent(beforeUnloadEvent, domWindow->document());
     }