[webkit-dev] DOMWindow::isCurrentlyDisplayedInFrame does not forbid PostMessageTimer for subframe

[Alexey Proskuryakov]

Hi!

Could you please file a bug at bugs.webkit.org? If you have a reproducible test case where any bad behavior happens, that would be most useful.

I think that the proposed fix would break a case where we currently match Firefox:

main.html:
---------------------
<button onclick="f()">Click</button>
<script>
function f()
{
   var child = window.open("child.html");
   child.navigator.foo = "bar";
   child.onload = function() {
       setTimeout(function() {
           var w = child.frames[0];
           w.navigator.foo = "bar"
           child.location = "about:blank";
           setTimeout(function() {
               alert("w.navigator.foo: " + w.navigator.foo +
               "\nw.parent.navigator.foo: " + w.parent.navigator.foo +
               "\nchild.navigator.foo: " + child.navigator.foo);
           }, 100);
       }, 100);
   }
}
</script>
---------------------

child.html:
---------------------
<iframe src="child2.html"></iframe>
---------------------

child2.html:
---------------------
<p>Hello, world!</p>
---------------------

In this test, we successfully access window.navigator of both main frame and subframe, even though they are in page cache, and DOMWindow::navigator() has an isCurrentlyDisplayedInFrame() check.

There was some unfinished work to make this code more reasonable, but it stopped long ago: <https://bugs.webkit.org/show_bug.cgi?id=62054>, <https://bugs.webkit.org/show_bug.cgi?id=68849>.

The name "isCurrentlyDisplayedInFrame" is clearly inaccurate, however it's not clear to me whether we should be trying to make this function better match what it claims to do, given the above. It seems that we should instead rename it, and inspect call sites like DOMWindow::postMessageTimerFired for whether they are doing the right thing.

- Alexey


03 сент. 2014 г., в 5:29, chenhao <chenhao at ucweb.com> написал(а):

> Hi,
> 
> We met one issue related with PostMessageTimer, it may launched while the Page had been moved in Page Cache. After checking the implementation, we doubt this situation should be forbid as below:
> void DOMWindow::postMessageTimerFired(PostMessageTimer& timer)
> {
>   if (!document() || !isCurrentlyDisplayedInFrame())
>       return;
> 
> But, unfortunately, isCurrentlyDisplayedInFrame() could not work well with sub-frame, because of the sub-frame and its document would be kept same as before moving in Page Cache, that means the judgement return true always for sub-frame.
> 
> So, what I want to do is to judge inPageCache() additionally. Just like below:
> 
> bool DOMWindow::isCurrentlyDisplayedInFrame() const
> {
>   return m_frame && m_frame->domWindow() == this && !m_frame->document()->inPageCache();
> }
> 
> That's appreciate to get your comments!
> 
> Thanks & Best Regards!
> Hao
> 
> 
> _______________________________________________
> webkit-dev mailing list
> webkit-dev at lists.webkit.org
> https://lists.webkit.org/mailman/listinfo/webkit-dev


- Alexey