Title: [286871] trunk
- Revision
- 286871
- Author
- [email protected]
- Date
- 2021-12-10 13:24:43 -0800 (Fri, 10 Dec 2021)
Log Message
JSErrorHandler should not set window.event if invocation target is in shadow tree
https://bugs.webkit.org/show_bug.cgi?id=233834
Reviewed by Ryosuke Niwa.
LayoutTests/imported/w3c:
Update the test per https://github.com/web-platform-tests/wpt/pull/31893 as well as its expectations.
* web-platform-tests/dom/events/event-global-expected.txt:
* web-platform-tests/dom/events/event-global.html:
Source/WebCore:
This patch brings r233489 for JSErrorHandler (window.onerror handler for ErrorEvent),
implementing the spec [1] and aligning WebKit with Blink and Gecko.
[1] https://dom.spec.whatwg.org/#ref-for-window-current-event%E2%91%A1
Test: imported/w3c/web-platform-tests/dom/events/event-global.html
* bindings/js/JSErrorHandler.cpp:
(WebCore::JSErrorHandler::handleEvent):
Modified Paths
Diff
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (286870 => 286871)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2021-12-10 21:15:46 UTC (rev 286870)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2021-12-10 21:24:43 UTC (rev 286871)
@@ -1,3 +1,15 @@
+2021-12-10 Alexey Shvayka <[email protected]>
+
+ JSErrorHandler should not set window.event if invocation target is in shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=233834
+
+ Reviewed by Ryosuke Niwa.
+
+ Update the test per https://github.com/web-platform-tests/wpt/pull/31893 as well as its expectations.
+
+ * web-platform-tests/dom/events/event-global-expected.txt:
+ * web-platform-tests/dom/events/event-global.html:
+
2021-12-10 Patrick Griffis <[email protected]>
CSP: Implement protections against nonce-hijacking
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/dom/events/event-global-expected.txt (286870 => 286871)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/dom/events/event-global-expected.txt 2021-12-10 21:15:46 UTC (rev 286870)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/dom/events/event-global-expected.txt 2021-12-10 21:24:43 UTC (rev 286871)
@@ -3,6 +3,7 @@
PASS window.event is only defined during dispatch
PASS window.event is undefined if the target is in a shadow tree (event dispatched outside shadow tree)
PASS window.event is undefined if the target is in a shadow tree (event dispatched inside shadow tree)
+PASS window.event is undefined inside window.onerror if the target is in a shadow tree (ErrorEvent dispatched inside shadow tree)
PASS window.event is set to the current event during dispatch
PASS window.event is set to the current event, which is the event passed to dispatch
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/dom/events/event-global.html (286870 => 286871)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/dom/events/event-global.html 2021-12-10 21:15:46 UTC (rev 286870)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/dom/events/event-global.html 2021-12-10 21:24:43 UTC (rev 286871)
@@ -5,6 +5,8 @@
<script src=""
<div id=log></div>
<script>
+setup({allow_uncaught_exception: true});
+
test(t => {
assert_own_property(window, "event");
assert_equals(window.event, undefined);
@@ -63,6 +65,30 @@
}, "window.event is undefined if the target is in a shadow tree (event dispatched inside shadow tree)");
async_test(t => {
+ let parent = document.createElement("div");
+ let root = parent.attachShadow({mode: "open"});
+ document.body.append(parent)
+ let span = document.createElement("span");
+ root.append(span);
+ let shadowNode = root.firstElementChild;
+
+ shadowNode.addEventListener("error", t.step_func(e => {
+ assert_not_equals(window.event, e);
+ assert_equals(window.event, undefined);
+ }));
+
+ let windowOnErrorCalled = false;
+ window._onerror_ = t.step_func_done(() => {
+ windowOnErrorCalled = true;
+ assert_equals(typeof window.event, "object");
+ assert_equals(window.event.type, "error");
+ });
+
+ shadowNode.dispatchEvent(new ErrorEvent("error", {composed: true, bubbles: true}));
+ assert_true(windowOnErrorCalled);
+}, "window.event is undefined inside window.onerror if the target is in a shadow tree (ErrorEvent dispatched inside shadow tree)");
+
+async_test(t => {
let target1 = document.createElement("div");
let target2 = document.createElement("div");
Modified: trunk/Source/WebCore/ChangeLog (286870 => 286871)
--- trunk/Source/WebCore/ChangeLog 2021-12-10 21:15:46 UTC (rev 286870)
+++ trunk/Source/WebCore/ChangeLog 2021-12-10 21:24:43 UTC (rev 286871)
@@ -1,3 +1,20 @@
+2021-12-10 Alexey Shvayka <[email protected]>
+
+ JSErrorHandler should not set window.event if invocation target is in shadow tree
+ https://bugs.webkit.org/show_bug.cgi?id=233834
+
+ Reviewed by Ryosuke Niwa.
+
+ This patch brings r233489 for JSErrorHandler (window.onerror handler for ErrorEvent),
+ implementing the spec [1] and aligning WebKit with Blink and Gecko.
+
+ [1] https://dom.spec.whatwg.org/#ref-for-window-current-event%E2%91%A1
+
+ Test: imported/w3c/web-platform-tests/dom/events/event-global.html
+
+ * bindings/js/JSErrorHandler.cpp:
+ (WebCore::JSErrorHandler::handleEvent):
+
2021-12-10 Devin Rousso <[email protected]>
Allow `Pasteboard::readBuffer` to read from the pasteboard as a whole instead of a specific item
Modified: trunk/Source/WebCore/bindings/js/JSErrorHandler.cpp (286870 => 286871)
--- trunk/Source/WebCore/bindings/js/JSErrorHandler.cpp 2021-12-10 21:15:46 UTC (rev 286870)
+++ trunk/Source/WebCore/bindings/js/JSErrorHandler.cpp 2021-12-10 21:24:43 UTC (rev 286871)
@@ -84,7 +84,10 @@
auto* jsFunctionWindow = jsDynamicCast<JSDOMWindow*>(vm, jsFunction->globalObject());
if (jsFunctionWindow) {
savedEvent = jsFunctionWindow->currentEvent();
- jsFunctionWindow->setCurrentEvent(&event);
+
+ // window.event should not be set when the target is inside a shadow tree, as per the DOM specification.
+ if (!event.currentTargetIsInShadowTree())
+ jsFunctionWindow->setCurrentEvent(&event);
}
auto& errorEvent = downcast<ErrorEvent>(event);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
