Changeset 70282 in webkit


Ignore:
Timestamp:
Oct 21, 2010 6:27:27 PM (14 years ago)
Author:
tonyg@chromium.org
Message:

2010-10-21 Tony Gentilcore <​tonyg@chromium.org>

Reviewed by Adam Barth.

Ignore document.write() when it comes from a network task
​https://bugs.webkit.org/show_bug.cgi?id=47560

write()s from deferred scripts are now ignored. This matches the latest
Firefox 4 beta behavior. The defer-write expectations are updated, and
the other tests are now all moot since deferred scrits can't write().

  • fast/dom/HTMLScriptElement/defer-double-defer-write-expected.txt: Removed.
  • fast/dom/HTMLScriptElement/defer-double-defer-write.html: Removed.
  • fast/dom/HTMLScriptElement/defer-double-write-expected.txt: Removed.
  • fast/dom/HTMLScriptElement/defer-double-write.html: Removed.
  • fast/dom/HTMLScriptElement/defer-write.html: Updated to match FF4.
  • fast/dom/HTMLScriptElement/remove-source-expected.txt: Added.
  • fast/dom/HTMLScriptElement/remove-source.html: Added. Verifies that writes are still ignored when the src is removed after the script is requested but before it is executed.
  • fast/dom/HTMLScriptElement/two-defer-writes-expected.txt: Removed.
  • fast/dom/HTMLScriptElement/two-defer-writes.html: Removed.
  • fast/dom/HTMLScriptElement/write-after-ignored-write-expected.txt: Added. Verifies that after a write from a network task is ignored, a write which is not from a network task still blows away the document.
  • fast/dom/HTMLScriptElement/write-after-ignored-write.html: Added.

2010-10-21 Tony Gentilcore <​tonyg@chromium.org>

Reviewed by Adam Barth.

Ignore document.write() when it comes from a network task
​https://bugs.webkit.org/show_bug.cgi?id=47560

This implements the update to the spec made by:
​http://www.w3.org/Bugs/Public/show_bug.cgi?id=9767

It also matches the latest Firefox 4 beta. The notable change is that
document.write from a deferred script no longer works. This avoids
blowing the patch away.

  • dom/Document.cpp: (WebCore::Document::Document): (WebCore::Document::write):
  • dom/Document.h: (WebCore::DestructiveWriteCountIncrementer::DestructiveWriteCountIncrementer): (WebCore::Document::ignoreDestructiveWriteCountIncrementer):
  • dom/ScriptElement.cpp: (WebCore::ScriptElement::insertedIntoDocument): (WebCore::ScriptElementData::ScriptElementData): (WebCore::ScriptElementData::evaluateScript):
  • dom/ScriptElement.h:
  • html/parser/HTMLScriptRunner.cpp: (WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent):
Location:
trunk
Files:
2 added
3 deleted
12 edited
3 moved

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r70278 r70282  
     12010-10-21  Tony Gentilcore  <tonyg@chromium.org>
     2
     3        Reviewed by Adam Barth.
     4
     5        Ignore document.write() when it comes from a network task
     6        https://bugs.webkit.org/show_bug.cgi?id=47560
     7
     8        write()s from deferred scripts are now ignored. This matches the latest
     9        Firefox 4 beta behavior. The defer-write expectations are updated, and
     10        the other tests are now all moot since deferred scrits can't write().
     11
     12        * fast/dom/HTMLScriptElement/defer-double-defer-write-expected.txt: Removed.
     13        * fast/dom/HTMLScriptElement/defer-double-defer-write.html: Removed.
     14        * fast/dom/HTMLScriptElement/defer-double-write-expected.txt: Removed.
     15        * fast/dom/HTMLScriptElement/defer-double-write.html: Removed.
     16        * fast/dom/HTMLScriptElement/defer-write.html: Updated to match FF4.
     17        * fast/dom/HTMLScriptElement/remove-source-expected.txt: Added.
     18        * fast/dom/HTMLScriptElement/remove-source.html: Added. Verifies that writes are still ignored when the src is removed after the script is requested but before it is executed.
     19        * fast/dom/HTMLScriptElement/two-defer-writes-expected.txt: Removed.
     20        * fast/dom/HTMLScriptElement/two-defer-writes.html: Removed.
     21        * fast/dom/HTMLScriptElement/write-after-ignored-write-expected.txt: Added. Verifies that after a write from a network task is ignored, a write which is not from a network task still blows away the document.
     22        * fast/dom/HTMLScriptElement/write-after-ignored-write.html: Added.
     23
    1242010-10-21  James Robinson  <jamesr@chromium.org>
    225

  • trunk/LayoutTests/fast/dom/HTMLScriptElement/defer-write.html

    r66670 r70282  
    33    layoutTestController.dumpAsText();
    44</script>
    5 FAIL
    6 <script defer src="data:text/javascript,document.write('PASS');"></script>
     5PASS
     6<script defer src="data:text/javascript,document.write('FAIL');"></script>

  • trunk/LayoutTests/fast/dom/HTMLScriptElement/remove-source-expected.txt

    • Property svn:executable deleted

  • trunk/LayoutTests/fast/dom/HTMLScriptElement/write-after-ignored-write.html

    r70281 r70282  
    33    layoutTestController.dumpAsText();
    44</script>
     5<body onload="document.write('PASS')">
    56FAIL
    6 <script defer src="data:text/javascript,document.write('PASS');"></script>
    77<script defer src="data:text/javascript,document.write('FAIL');"></script>
     8

  • trunk/WebCore/ChangeLog

    r70281 r70282  
     12010-10-21  Tony Gentilcore  <tonyg@chromium.org>
     2
     3        Reviewed by Adam Barth.
     4
     5        Ignore document.write() when it comes from a network task
     6        https://bugs.webkit.org/show_bug.cgi?id=47560
     7
     8        This implements the update to the spec made by:
     9        http://www.w3.org/Bugs/Public/show_bug.cgi?id=9767
     10
     11        It also matches the latest Firefox 4 beta. The notable change is that
     12        document.write from a deferred script no longer works. This avoids
     13        blowing the patch away.
     14
     15        * dom/Document.cpp:
     16        (WebCore::Document::Document):
     17        (WebCore::Document::write):
     18        * dom/Document.h:
     19        (WebCore::DestructiveWriteCountIncrementer::DestructiveWriteCountIncrementer):
     20        (WebCore::Document::ignoreDestructiveWriteCountIncrementer):
     21        * dom/ScriptElement.cpp:
     22        (WebCore::ScriptElement::insertedIntoDocument):
     23        (WebCore::ScriptElementData::ScriptElementData):
     24        (WebCore::ScriptElementData::evaluateScript):
     25        * dom/ScriptElement.h:
     26        * html/parser/HTMLScriptRunner.cpp:
     27        (WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent):
     28
    1292010-10-21  Ryosuke Niwa  <rniwa@webkit.org>
    230

  • trunk/WebCore/GNUmakefile.am

    r70235 r70282  
    11421142        WebCore/dom/ExceptionCode.h \
    11431143        WebCore/dom/FragmentScriptingPermission.h \
     1144        WebCore/dom/IgnoreDestructiveWriteCountIncrementer.h \
    11441145        WebCore/dom/InputElement.cpp \
    11451146        WebCore/dom/InputElement.h \

  • trunk/WebCore/WebCore.gypi

    r70240 r70282  
    12131213            'dom/ExceptionCode.h',
    12141214            'dom/FragmentScriptingPermission.h',
     1215            'dom/IgnoreDestructiveWriteCountIncrementer.h',
    12151216            'dom/InputElement.cpp',
    12161217            'dom/InputElement.h',

  • trunk/WebCore/WebCore.vcproj/WebCore.vcproj

    r70235 r70282  
    4220442204                        </File>
    4220542205                        <File
     42206                                RelativePath="..\dom\IgnoreDestructiveWriteCountIncrementer.h"
     42207                                >
     42208                        </File>
     42209                        <File
    4220642210                                RelativePath="..\dom\InputElement.h"
    4220742211                                >

  • trunk/WebCore/WebCore.xcodeproj/project.pbxproj

    r70263 r70282  
    25982598                8A9A588711E84F37008ACFD1 /* JSTiming.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A9A587611E84C98008ACFD1 /* JSTiming.cpp */; };
    25992599                8A9A588811E84F37008ACFD1 /* JSTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A9A587711E84C98008ACFD1 /* JSTiming.h */; };
     2600                8AB4BC77126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AB4BC76126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h */; };
    26002601                8AF4E55511DC5A36000ED3DE /* Navigation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8AF4E55211DC5A36000ED3DE /* Navigation.cpp */; };
    26012602                8AF4E55611DC5A36000ED3DE /* Navigation.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AF4E55311DC5A36000ED3DE /* Navigation.h */; };
    … …  
    86618662                8A9A587611E84C98008ACFD1 /* JSTiming.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTiming.cpp; sourceTree = "<group>"; };
    86628663                8A9A587711E84C98008ACFD1 /* JSTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTiming.h; sourceTree = "<group>"; };
     8664                8AB4BC76126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IgnoreDestructiveWriteCountIncrementer.h; sourceTree = "<group>"; };
    86638665                8AF4E55211DC5A36000ED3DE /* Navigation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Navigation.cpp; sourceTree = "<group>"; };
    86648666                8AF4E55311DC5A36000ED3DE /* Navigation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Navigation.h; sourceTree = "<group>"; };
    … …  
    1809918101                                2442BBF81194C9D300D49469 /* HashChangeEvent.h */,
    1810018102                                8482B7441198C32E00BFB005 /* HashChangeEvent.idl */,
     18103                                8AB4BC76126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h */,
    1810118104                                08700BE60F086C5300919419 /* InputElement.cpp */,
    1810218105                                08591AA40F085C4E009BACB1 /* InputElement.h */,
    … …  
    2114221145                                089021A9126EF5DE0092D5EA /* SVGAnimatedLength.h in Headers */,
    2114321146                                089021AD126EF5E90092D5EA /* SVGAnimatedLengthList.h in Headers */,
     21147                                8AB4BC77126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h in Headers */,
    2114421148                        );
    2114521149                        runOnlyForDeploymentPostprocessing = 0;

  • trunk/WebCore/dom/Document.cpp

    r70047 r70282  
    365365    , m_containsValidityStyleRules(false)
    366366    , m_updateFocusAppearanceRestoresSelection(false)
    367     , m_writeDisabled(false)
     367    , m_ignoreDestructiveWriteCount(0)
    368368    , m_title("")
    369369    , m_rawTitle("")
    … …  
    21302130#endif
    21312131
    2132     // If the insertion point is undefined and the Document has the
    2133     // "write-neutralised" flag set, then abort these steps.
    21342132    bool hasInsertionPoint = m_parser && m_parser->hasInsertionPoint();
    2135     if (!hasInsertionPoint && writeDisabled())
     2133    if (!hasInsertionPoint && m_ignoreDestructiveWriteCount)
    21362134        return;
    21372135

  • trunk/WebCore/dom/Document.h

    r70047 r70282  
    10311031#endif
    10321032
    1033     bool writeDisabled() const { return m_writeDisabled; }
    1034     void setWriteDisabled(bool flag) { m_writeDisabled = flag; }
    1035 
    10361033    // Used to allow element that loads data without going through a FrameLoader to delay the 'load' event.
    10371034    void incrementLoadEventDelayCount() { ++m_loadEventDelayCount; }
    … …  
    10501047
    10511048private:
     1049    friend class IgnoreDestructiveWriteCountIncrementer;
     1050
    10521051    void detachParser();
    10531052
    … …  
    12041203    bool m_updateFocusAppearanceRestoresSelection;
    12051204
    1206     // http://www.whatwg.org/specs/web-apps/current-work/#write-neutralised
    1207     bool m_writeDisabled;
     1205    // http://www.whatwg.org/specs/web-apps/current-work/#ignore-destructive-writes-counter
     1206    unsigned m_ignoreDestructiveWriteCount;
    12081207
    12091208    String m_title;

  • trunk/WebCore/dom/ScriptElement.cpp

    r67245 r70282  
    3434#include "HTMLNames.h"
    3535#include "HTMLScriptElement.h"
     36#include "IgnoreDestructiveWriteCountIncrementer.h"
    3637#include "MIMETypeRegistry.h"
    3738#include "Page.h"
    … …  
    5758
    5859    // http://www.whatwg.org/specs/web-apps/current-work/#script
    59 
    60     // If the element's Document has an active parser, and the parser's script
    61     // nesting level is non-zero, but this script element does not have the
    62     // "parser-inserted" flag set, the user agent must set the element's
    63     // "write-neutralised" flag.
    64     DocumentParser* parser = data.element()->document()->parser();
    65     if (parser && parser->hasInsertionPoint())
    66         data.setWriteDisabled(true);
    6760
    6861    if (!sourceUrl.isEmpty()) {
    … …  
    143136    , m_cachedScript(0)
    144137    , m_createdByParser(false)
    145     , m_writeDisabled(false)
    146138    , m_requested(false)
    147139    , m_evaluated(false)
    … …  
    192184        return;
    193185
    194     if (Frame* frame = m_element->document()->frame()) {
     186    RefPtr<Document> document = m_element->document();
     187    ASSERT(document);
     188    if (Frame* frame = document->frame()) {
    195189        if (!frame->script()->canExecuteScripts(AboutToExecuteScript))
    196190            return;
    … …  
    200194        // http://www.whatwg.org/specs/web-apps/current-work/#script
    201195
    202         // If the script element's "write-neutralised" flag is set, then flag
    203         // the Document the script element was in when the "write-neutralised"
    204         // flag was set as being itself "write-neutralised". Let neutralised doc
    205         // be that Document.
    206         if (m_writeDisabled) {
    207             ASSERT(!m_element->document()->writeDisabled());
    208             m_element->document()->setWriteDisabled(true);
    209         }
    210 
    211         // Create a script from the script element node, using the script
    212         // block's source and the script block's type.
    213         // Note: This is where the script is compiled and actually executed.
    214         frame->script()->evaluate(sourceCode);
    215 
    216         // Remove the "write-neutralised" flag from neutralised doc, if it was
    217         // set in the earlier step.
    218         if (m_writeDisabled) {
    219             ASSERT(m_element->document()->writeDisabled());
    220             m_element->document()->setWriteDisabled(false);
     196        {
     197            IgnoreDestructiveWriteCountIncrementer ignoreDesctructiveWriteCountIncrementer(m_requested ? document.get() : 0);
     198            // Create a script from the script element node, using the script
     199            // block's source and the script block's type.
     200            // Note: This is where the script is compiled and actually executed.
     201            frame->script()->evaluate(sourceCode);
    221202        }
    222203

  • trunk/WebCore/dom/ScriptElement.h

    r63998 r70282  
    8383    bool createdByParser() const { return m_createdByParser; }
    8484    void setCreatedByParser(bool value) { m_createdByParser = value; }
    85     bool writeDisabled() const { return m_writeDisabled; }
    86     void setWriteDisabled(bool value) { m_writeDisabled = value; }
    8785    bool haveFiredLoadEvent() const { return m_firedLoad; }
    8886    void setHaveFiredLoadEvent(bool firedLoad) { m_firedLoad = firedLoad; }
    … …  
    102100    CachedResourceHandle<CachedScript> m_cachedScript;
    103101    bool m_createdByParser; // HTML5: "parser-inserted"
    104     bool m_writeDisabled; // http://www.whatwg.org/specs/web-apps/current-work/#write-neutralised
    105102    bool m_requested;
    106103    bool m_evaluated; // HTML5: "already started"

  • trunk/WebCore/html/parser/HTMLScriptRunner.cpp

    r70181 r70282  
    3636#include "HTMLInputStream.h"
    3737#include "HTMLNames.h"
     38#include "IgnoreDestructiveWriteCountIncrementer.h"
    3839#include "NestingLevelIncrementer.h"
    3940#include "NotImplemented.h"
    … …  
    136137    {
    137138        NestingLevelIncrementer nestingLevelIncrementer(m_scriptNestingLevel);
     139        IgnoreDestructiveWriteCountIncrementer ignoreDestructiveWriteCountIncrementer(m_document);
    138140        if (errorOccurred)
    139141            scriptElement->dispatchEvent(createScriptErrorEvent());
Note: See TracChangeset for help on using the changeset viewer.