Title: [125137] branches/chromium/1229/Source
- Revision
- 125137
- Author
- [email protected]
- Date
- 2012-08-08 18:46:16 -0700 (Wed, 08 Aug 2012)
Log Message
Merge 125077 - Crash when reloading a Chromium "platform" app
https://bugs.webkit.org/show_bug.cgi?id=93497
Reviewed by Eric Seidel.
Source/WebCore:
The framework for Chromium "platform" apps executes a big blob of
script during the didCreateScriptContext callback. This blob of scripts
interacts with a bunch of _javascript_ objects and triggers a number of
security checks.
When reloading a frame, the didCreateScriptContext is called during
Frame::setDocument (as a consequence of calling
ScriptController::updateDocument). At that time, the SecurityOrigin
object hasn't yet been copied over to the DOMWindow, and we crash
trying to grab it.
The long-term fix for this bug is to fix
https://bugs.webkit.org/show_bug.cgi?id=75793, at which point there
will no longer be a SecurityOrigin object on DOMWindow. In the
meantime, however, we can fix this crash by null checking the
DOMWindow's SecurityOrigin object.
* bindings/generic/BindingSecurity.cpp:
(WebCore::canAccessDocument):
Source/WebKit/chromium:
Test that we don't crash when executing script during the
didCreateScriptContext callback.
* tests/WebFrameTest.cpp:
* tests/data/hello_world.html: Added.
[email protected]
Modified Paths
Added Paths
Diff
Modified: branches/chromium/1229/Source/WebCore/bindings/generic/BindingSecurity.cpp (125136 => 125137)
--- branches/chromium/1229/Source/WebCore/bindings/generic/BindingSecurity.cpp 2012-08-09 01:45:47 UTC (rev 125136)
+++ branches/chromium/1229/Source/WebCore/bindings/generic/BindingSecurity.cpp 2012-08-09 01:46:16 UTC (rev 125137)
@@ -51,6 +51,16 @@
if (!active)
return false;
+ // If the embedder executes _javascript_ synchronously during the didCreateScriptContext callback,
+ // in some cases the active SecurityOrigin will not yet be copied to the DOMWindow. For example,
+ // Frame::setDocument can trigger didCreateScriptContext during ScriptController::updateDocument.
+ //
+ // FIXME: Remove this branch once we manage to delete DOMWindow::m_securityOrigin. Ideally, we'd
+ // get the SecurityOrigin from the Document rather than the DOMWindow. In that case, there
+ // shouldn't ever be a chance to execute script before the SecurityOrigin object is created.
+ if (!active->securityOrigin())
+ return false;
+
if (active->securityOrigin()->canAccess(targetDocument->securityOrigin()))
return true;
Modified: branches/chromium/1229/Source/WebKit/chromium/tests/WebFrameTest.cpp (125136 => 125137)
--- branches/chromium/1229/Source/WebKit/chromium/tests/WebFrameTest.cpp 2012-08-09 01:45:47 UTC (rev 125136)
+++ branches/chromium/1229/Source/WebKit/chromium/tests/WebFrameTest.cpp 2012-08-09 01:46:16 UTC (rev 125137)
@@ -804,6 +804,25 @@
EXPECT_TRUE(selectionHtml.isEmpty());
}
+class TestExecuteScriptDuringDidCreateScriptContext : public WebFrameClient {
+public:
+ virtual void didCreateScriptContext(WebFrame* frame, v8::Handle<v8::Context> context, int extensionGroup, int worldId) OVERRIDE
+ {
+ frame->executeScript(WebScriptSource("window.history = 'replaced';"));
+ }
+};
+
+TEST_F(WebFrameTest, ExecuteScriptDuringDidCreateScriptContext)
+{
+ registerMockedHttpURLLoad("hello_world.html");
+
+ TestExecuteScriptDuringDidCreateScriptContext webFrameClient;
+ WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "hello_world.html", true, &webFrameClient);
+
+ webView->mainFrame()->reload();
+ webkit_support::ServeAsynchronousMockedRequests();
+}
+
class TestDidCreateFrameWebFrameClient : public WebFrameClient {
public:
TestDidCreateFrameWebFrameClient() : m_frameCount(0), m_parent(0)
Copied: branches/chromium/1229/Source/WebKit/chromium/tests/data/hello_world.html (from rev 125077, trunk/Source/WebKit/chromium/tests/data/hello_world.html) (0 => 125137)
--- branches/chromium/1229/Source/WebKit/chromium/tests/data/hello_world.html (rev 0)
+++ branches/chromium/1229/Source/WebKit/chromium/tests/data/hello_world.html 2012-08-09 01:46:16 UTC (rev 125137)
@@ -0,0 +1,3 @@
+<script>
+document.write("Hello, world.");
+</script>
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
