Changeset 234680 in webkit


Ignore:
Timestamp:
Aug 7, 2018 4:54:25 PM (6 years ago)
Author:
rniwa@webkit.org
Message:

document.open and document.write must throw while the HTML parser is synchronously constructing a custom element
​https://bugs.webkit.org/show_bug.cgi?id=187319
<rdar://problem/42843012>

Reviewed by Frédéric Wang.

Source/WebCore:

Make document.open, document.write, document.writeln, and document.close throw InvalidStateError during
a synchronous custom element construction as specified:
​https://html.spec.whatwg.org/multipage/parsing.html#create-an-element-for-the-token
​https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter

Tests: fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html

fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html

  • WebCore.xcodeproj/project.pbxproj:
  • dom/Document.cpp:

(WebCore::Document::openForBindings): Throw InvalidStateError when m_throwOnDynamicMarkupInsertionCount is non-zero.
(WebCore::Document::closeForBindings): Ditto.
(WebCore::Document::write): Ditto.
(WebCore::Document::writeln): Ditto.

  • dom/Document.h: Re-ordered the related instance variables in the order they appear in the spec, and updated spec URLs.
  • dom/ThrowOnDynamicMarkupInsertionCountIncrementer.h: Added.

(WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer): Added.
(WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer::ThrowOnDynamicMarkupInsertionCountIncrementer):
(WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer::~ThrowOnDynamicMarkupInsertionCountIncrementer):

  • html/parser/HTMLDocumentParser.cpp:

(WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Instantiate ThrowOnDynamicMarkupInsertionCountIncrementer.

LayoutTests:

Added W3C style testharness.js tests. The WPT test added by ​https://github.com/web-platform-tests/wpt/pull/12037
doesn't test nearly as many edge cases.

  • fast/custom-elements/resources/navigation-destination.html: Added.
  • fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct-expected.txt: Added.
  • fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html: Added.
  • fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions-expected.txt: Added.
  • fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html: Added.
Location:
trunk
Files:
6 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r234678 r234680  
     12018-08-07  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        document.open and document.write must throw while the HTML parser is synchronously constructing a custom element
     4        https://bugs.webkit.org/show_bug.cgi?id=187319
     5        <rdar://problem/42843012>
     6
     7        Reviewed by Frédéric Wang.
     8
     9        Added W3C style testharness.js tests. The WPT test added by https://github.com/web-platform-tests/wpt/pull/12037
     10        doesn't test nearly as many edge cases.
     11
     12        * fast/custom-elements/resources/navigation-destination.html: Added.
     13        * fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct-expected.txt: Added.
     14        * fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html: Added.
     15        * fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions-expected.txt: Added.
     16        * fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html: Added.
     17
    1182018-08-07  Rob Buis  <rbuis@igalia.com>
    219

  • trunk/Source/WebCore/ChangeLog

    r234679 r234680  
     12018-08-07  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        document.open and document.write must throw while the HTML parser is synchronously constructing a custom element
     4        https://bugs.webkit.org/show_bug.cgi?id=187319
     5        <rdar://problem/42843012>
     6
     7        Reviewed by Frédéric Wang.
     8
     9        Make document.open, document.write, document.writeln, and document.close throw InvalidStateError during
     10        a synchronous custom element construction as specified:
     11        https://html.spec.whatwg.org/multipage/parsing.html#create-an-element-for-the-token
     12        https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter
     13
     14        Tests: fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html
     15               fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html
     16
     17        * WebCore.xcodeproj/project.pbxproj:
     18        * dom/Document.cpp:
     19        (WebCore::Document::openForBindings): Throw InvalidStateError when m_throwOnDynamicMarkupInsertionCount is non-zero.
     20        (WebCore::Document::closeForBindings): Ditto.
     21        (WebCore::Document::write): Ditto.
     22        (WebCore::Document::writeln): Ditto.
     23        * dom/Document.h: Re-ordered the related instance variables in the order they appear in the spec, and updated spec URLs.
     24        * dom/ThrowOnDynamicMarkupInsertionCountIncrementer.h: Added.
     25        (WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer): Added.
     26        (WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer::ThrowOnDynamicMarkupInsertionCountIncrementer):
     27        (WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer::~ThrowOnDynamicMarkupInsertionCountIncrementer):
     28        * html/parser/HTMLDocumentParser.cpp:
     29        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Instantiate ThrowOnDynamicMarkupInsertionCountIncrementer.
     30
    1312018-08-07  Alex Christensen  <achristensen@webkit.org>
    232

  • trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj

    r234620 r234680  
    1086010860                9B417062125662B3006B28FC /* ApplyBlockElementCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplyBlockElementCommand.h; sourceTree = "<group>"; };
    1086110861                9B417063125662B3006B28FC /* ApplyBlockElementCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplyBlockElementCommand.cpp; sourceTree = "<group>"; };
     10862                9B4376EF2117E872009D03A0 /* ThrowOnDynamicMarkupInsertionCountIncrementer.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ThrowOnDynamicMarkupInsertionCountIncrementer.h; sourceTree = "<group>"; };
    1086210863                9B50B1DC17CD4C0F0087F63C /* FormNamedItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FormNamedItem.h; sourceTree = "<group>"; };
    1086310864                9B532EA11BA928570038A827 /* SlotAssignment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SlotAssignment.cpp; sourceTree = "<group>"; };
    … …  
    2657626577                                E4D988B517BFEB210084FB88 /* TextNodeTraversal.cpp */,
    2657726578                                E4D988B317BFD1F60084FB88 /* TextNodeTraversal.h */,
     26579                                9B4376EF2117E872009D03A0 /* ThrowOnDynamicMarkupInsertionCountIncrementer.h */,
    2657826580                                0F54DD051881D5F5003EEDBB /* Touch.h */,
    2657926581                                0F54DD061881D5F5003EEDBB /* TouchEvent.h */,

  • trunk/Source/WebCore/dom/Document.cpp

    r234679 r234680  
    26102610ExceptionOr<Document&> Document::openForBindings(Document* responsibleDocument, const String&, const String&)
    26112611{
    2612     if (!isHTMLDocument())
     2612    if (!isHTMLDocument() || m_throwOnDynamicMarkupInsertionCount)
    26132613        return Exception { InvalidStateError };
    2614 
    2615     // FIXME: This should also throw if "document's throw-on-dynamic-markup-insertion counter is greater than 0".
    2616     // https://bugs.webkit.org/show_bug.cgi?id=187319
    26172614
    26182615    open(responsibleDocument);
    … …  
    27542751    //        http://www.whatwg.org/specs/web-apps/current-work/#dom-document-close
    27552752
    2756     if (!isHTMLDocument())
     2753    if (!isHTMLDocument() || m_throwOnDynamicMarkupInsertionCount)
    27572754        return Exception { InvalidStateError };
    2758 
    2759     // FIXME: This should also throw if "document's throw-on-dynamic-markup-insertion counter is greater than 0".
    2760     // https://bugs.webkit.org/show_bug.cgi?id=187319
    27612755
    27622756    close();
    … …  
    29852979ExceptionOr<void> Document::write(Document* responsibleDocument, Vector<String>&& strings)
    29862980{
    2987     if (!isHTMLDocument())
     2981    if (!isHTMLDocument() || m_throwOnDynamicMarkupInsertionCount)
    29882982        return Exception { InvalidStateError };
    2989 
    2990     // FIXME: This should also throw if "document's throw-on-dynamic-markup-insertion counter is greater than 0".
    2991     // https://bugs.webkit.org/show_bug.cgi?id=187319
    29922983
    29932984    SegmentedString text;
    … …  
    30022993ExceptionOr<void> Document::writeln(Document* responsibleDocument, Vector<String>&& strings)
    30032994{
    3004     if (!isHTMLDocument())
     2995    if (!isHTMLDocument() || m_throwOnDynamicMarkupInsertionCount)
    30052996        return Exception { InvalidStateError };
    3006 
    3007     // FIXME: This should also throw if "document's throw-on-dynamic-markup-insertion counter is greater than 0".
    3008     // https://bugs.webkit.org/show_bug.cgi?id=187319
    30092997
    30102998    SegmentedString text;

  • trunk/Source/WebCore/dom/Document.h

    r234679 r234680  
    14811481    friend class DocumentParserYieldToken;
    14821482    friend class Node;
     1483    friend class ThrowOnDynamicMarkupInsertionCountIncrementer;
     1484    friend class IgnoreOpensDuringUnloadCountIncrementer;
    14831485    friend class IgnoreDestructiveWriteCountIncrementer;
    1484     friend class IgnoreOpensDuringUnloadCountIncrementer;
    14851486
    14861487    bool shouldInheritContentSecurityPolicyFromOwner() const;
    … …  
    18551856    unsigned m_lastStyleUpdateSizeForTesting { 0 };
    18561857
    1857     // https://html.spec.whatwg.org/multipage/webappapis.html#ignore-destructive-writes-counter
     1858    // https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter
     1859    unsigned m_throwOnDynamicMarkupInsertionCount { 0 };
     1860
     1861    // https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#ignore-opens-during-unload-counter
     1862    unsigned m_ignoreOpensDuringUnloadCount { 0 };
     1863
     1864    // https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#ignore-destructive-writes-counter
    18581865    unsigned m_ignoreDestructiveWriteCount { 0 };
    1859 
    1860     // https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter
    1861     unsigned m_ignoreOpensDuringUnloadCount { 0 };
    18621866
    18631867    unsigned m_activeParserCount { 0 };

  • trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp

    r234608 r234680  
    4242#include "NavigationScheduler.h"
    4343#include "ScriptElement.h"
     44#include "ThrowOnDynamicMarkupInsertionCountIncrementer.h"
    4445
    4546namespace WebCore {
    … …  
    211212        // https://html.spec.whatwg.org/#create-an-element-for-the-token
    212213        {
     214            // Prevent document.open/write during reactions by allocating the incrementer before the reactions stack.
     215            ThrowOnDynamicMarkupInsertionCountIncrementer incrementer(*document());
    213216            CustomElementReactionStack reactionStack(document()->execState());
    214217            auto& elementInterface = constructionData->elementInterface.get();
Note: See TracChangeset for help on using the changeset viewer.